Citation: Kim, Y.-E.; Kim, Y.-S.; Kim,
H. Effective Feature Selection
Methods to Detect IoT DDoS Attack
in 5G Core Network. Sensors 2022, 22,
3819. https://doi.org/10.3390/
s22103819
Academic Editor: Paolo Bellavista
Received: 30 April 2022
Accepted: 16 May 2022
Published: 18 May 2022
Publisher’s Note: MDPI stays neutral
with regard to jurisdictional claims in
published maps and institutional affil-
iations.
Copyright: © 2022 by the authors.
Licensee MDPI, Basel, Switzerland.
This article is an open access article
distributed under the terms and
conditions of the Creative Commons
Attribution (CC BY) license (https://
creativecommons.org/licenses/by/
4.0/).
Article
Effective Feature Selection Methods to Detect IoT DDoS Attack
in 5G Core Network
Ye-Eun Kim
1
, Yea-Sul Kim
1
and Hwankuk Kim
2,
*
1
Department of Electronics Information and System Engineering, Sangmyung University,
Cheonan 31066, Korea; yeni0.0king@gmail.com (Y.-E.K.); rlavnf10106@gmail.com (Y.-S.K.)
2
Department of Information Security Engineering, Sangmyung University, Cheonan 31066, Korea
* Correspondence: rinyfeel@smu.ac.kr; Tel.: +82-41-550-5101
Abstract:
The 5G networks aim to realize a massive Internet of Things (IoT) environment with low
latency. IoT devices with weak security can cause Tbps-level Distributed Denial of Service (DDoS)
attacks on 5G mobile networks. Therefore, interest in automatic network intrusion detection using
machine learning (ML) technology in 5G networks is increasing. ML-based DDoS attack detection in
a 5G environment should provide ultra-low latency. To this end, utilizing a feature-selection process
that reduces computational complexity and improves performance by identifying features important
for learning in large datasets is possible. Existing ML-based DDoS detection technology mostly
focuses on DDoS detection learning models on the wired Internet. In addition, studies on feature
engineering related to 5G traffic are relatively insufficient. Therefore, this study performed feature
selection experiments to reduce the time complexity of detecting and analyzing large-capacity DDoS
attacks in real time based on ML in a 5G core network environment. The results of the experiment
showed that the performance was maintained and improved when the feature selection process was
used. In particular, as the size of the dataset increased, the difference in time complexity increased
rapidly. The experiments show that the real-time detection of large-scale DDoS attacks in 5G core
networks is possible using the feature selection process. This demonstrates the importance of the
feature selection process for removing noisy features before training and detection. As this study
conducted a feature study to detect network traffic passing through the 5G core with low latency
using ML, it is expected to contribute to improving the performance of the 5G network DDoS attack
automation detection technology using AI technology.
Keywords: 5G; sensor network; machine learning; feature selection; IoT DDoS; DDoS detection
1. Introduction
A 5G network is a massive IoT environment with low latency [
1
,
2
]. When an IoT device
with weak security is connected to a 5G network, a Tbps-level DDoS attack targeting the
5G mobile network occurs, resulting in a network failure (delay) [
3
]. This can cause major
security problems for 5G core network functions and devices connected to the networks.
Machine learning (ML) models learn the rules for making intrusion decisions. Building an
automated intrusion detection system using ML can solve the time and cost limitations. In
addition, generalized performance can be guaranteed for new attack patterns. Therefore,
interest in the automation of intrusion detection using ML in 5G networks is increasing.
However, DDoS attack detection using ML in 5G networks is limited by the processing of
large amounts of data generated by 5G devices. Using all available features as input can
lead to ML models performing poorly and wasted training and detection time. Therefore,
the massive amount of 5G data raises the problem of selecting key features related to
real-time learning and detection to provide ultra-low latency. To detect large amounts of
traffic in 5G networks in real time, determining fewer important features while ensuring
the learning performance is necessary. Thus, the feature-selection process can be used.
Sensors 2022, 22, 3819. https://doi.org/10.3390/s22103819 https://www.mdpi.com/journal/sensors
