View: session overviewtalk overview
Offline
| 09:00 | SCU-CGAN: Enhancing Fire Detection through Synthetic Fire Image Generation and Dataset Augmentation PRESENTER: Ju-Young Kim ABSTRACT. Fire has long been linked to human life, causing severe disasters and losses. Early detection is crucial, and with the rise of home IoT technologies, household fire detection systems have emerged. However, the lack of sufficient fire datasets limits the performance of detection models. We propose the SCU-CGAN model, which integrates U-Net, CBAM, and an additional discriminator to generate realistic fire images from non-fire images. We evaluate the image quality and confirm that SCU-CGAN outperforms existing models. Specifically, SCU-CGAN achieved a 41.5% improvement in KID score compared to CycleGAN, demonstrating the superior quality of the generated fire images. Furthermore, experiments demonstrate that the augmented dataset significantly improves the accuracy of fire detection models without altering their structure. For the YOLOv5 nano model, the most notable improvement was observed in the mAP@0.5:0.95 metric, which increased by 56.5%, highlighting the effectiveness of the proposed approach. |
| 09:18 | Clock Glitch-based Fault Attacks on Convolutional Neural Networks PRESENTER: Seongwoo Hong ABSTRACT. Deep learning models have often been adopted to recognize input images in edge devices. However, edge devices that implement a Deep Neural Network (DNN) are physically accessible to a malicious attacker. In particular, fault injection attacks on these devices can lead to misclassification of an image and can cause serious accidents. In this paper, we implement a CNN model, a deep learning model widely used for image classification, on a hardware device and perform fault injection attacks. Fault injection attacks are conducted on each layer of the CNN model, and the resulting faulty outputs and misclassifications are analyzed. Consequently, it is demonstrated that fault injection attacks can be performed on all layers utilizing loops, leading to potential misclassifications. |
| 09:36 | Federated Random Forests for Privacy-Preserving Intrusion Detection in IoT Networks PRESENTER: Karl Andersson ABSTRACT. The rapid expansion of the Internet of Things (IoT) has brought about significant advancements in connectivity and automation across various industries. However, the inherent vulnerabilities of IoT devices, coupled with the absence of standardized security protocols, have made them susceptible to cyberattacks. Network-based Intrusion Detection Systems (NIDS) play a crucial role in safeguarding IoT ecosystems by monitoring network traffic for malicious activities. This paper explores the application of Federated Learning (FL) for IoT intrusion detection, emphasizing its ability to revolutionize network security. FL enables collaborative model training across distributed devices while preserving data privacy, addressing the limitations of traditional centralized machine learning approaches. We investigate the challenges and opportunities associated with deploying FL in IoT environments, assess its effectiveness in detecting various attacks, and propose a framework for integrating FL into existing NIDS. Our research aims to contribute to the development of more resilient and adaptive IoT security solutions that protect the diverse landscape of connected devices while respecting privacy considerations. In this paper, we implement FL using a shallow Neural Network (NN) and the Random Forest model (FRF), with experiments carried out on the CICIDS2017 datasets. The results demonstrate that FL can be a viable alternative to centralized instruction detection systems, maintaining data privacy while achieving competitive performance metrics. |
| 09:54 | Fair Incentive Distribution Mechanism in Hierarchical Federated Learning PRESENTER: Siwan Noh ABSTRACT. The integration of artificial intelligence (AI) in healthcare, powered by Internet of Medical Things (IoMT) data, offers significant potential for personalized and efficient patient care. Hierarchical federated learning (HFL) is a promising approach for healthcare applications, combining cross-silo and cross-device federated learning. This architecture allows hospitals to train local models using patient data, while sharing anonymized parameters with other hospitals to improve diagnosis. However, existing studies on incentive mechanisms in HFL often focus on determining optimal incentive values but neglect the integration of these incentives into the reward stage. Moreover, the two-layer architecture of HFL introduces challenges related to disparities in patient volume and diversity across hospitals. In this paper, we propose a fair incentive distribution mechanism for hierarchical systems using blockchain state channels. We ensure equal incentive budget contributions from all organizations, preventing free-riders in the HFL system with a channel factory solution. Additionally, virtual channels support transactions without intermediaries, minimizing computational costs in the blockchain network. |
Offline
| 09:00 | Lightweight Object-detection Model on Edge Devices for Safety and Security Applications ABSTRACT. Deep learning models have achieved significant success in a range of computer vision tasks and object detection, particularly in safety and security applications. However, deploying these models on edge devices, presents unique challenges due to limited computational resources, particularly for those cost-effective edge devices without GPU chips, such as Raspberry Pi 4. This work designed a lightweight object recognition model that can be used on edge computing devices with or without a GPU chip, enabling object recognition functionality. Compared to directly running YOLOv7-tiny model on the Raspberry Pi 4, the speed increased by 14 times. |
| 09:18 | Proposal of Early Heavy Rain Warning System by Micrometeorological and Geographical Factors with Numerous IoT Sensors PRESENTER: Noriki Uchida ABSTRACT. In recent years, heavy rainfall disasters, such as linear precipitation zones or typhoons, have caused significant damage to human life and agricultural and livestock products. So, research is shifting from traditional hourly-scale predictions at the kilometer level using rain cloud radars to highly detailed and real-time microclimate predictions at the meter level. However, when considering actual heavy rainfall disasters, particularly in mountainous regions, it is necessary to account for not only the atmospheric conditions predicted by micrometeorological models but also the rapidly changing river states, localized groundwater eruptions, reservoirs, and buildings, which are region-specific geographical factors. Therefore, this paper aims to propose the highly detailed and reliable Early Heavy Rain Warning System with numerous IoT sensors. In detail, the proposed Enhanced MQTT is introduced to enable simultaneous wireless connections of a large number of IoT sensors and agricultural drones to observe geographic factors. Then, by combining the micrometeorological predictions from the cloud services and these geographical observations, the anomaly detection with the Extended Kalman Filter is proposed for the recognition of early warnings. At last, the paper reported the experiments of the proposed Enhanced MQTT for the wireless connections of IoT sensors, and future studies are discussed. |
| 09:36 | Adapting Matrix Factorization for Multivariate Time Series Imputation PRESENTER: Minje Kim ABSTRACT. As interest in artificial intelligence such as deep learning and large language models continues to rise, a wide range of AI-related research is being conducted. This surge in research requires a high level of computing power, leading to the development of numerous facilities such as data centers. These facilities necessitate proper management, which is achieved through the continuous monitoring of automatically collected data from the centers. However, issues such as system failures or power outages can occur, resulting in missing values in the time series data. These missing values disrupt the continuity of the time series, and various studies have been conducted to address this problem. To address this issue, researchers have proposed deep learning approaches aimed at imputing missing values by capturing both auto-correlation and inter-variable correlations within a given time series. In this study, we propose a method that integrates matrix factorization (MF), a relatively simple and efficient machine learning technique for sparse matrices, with complex deep learning models to enhance their overall performance. Experiments on complex real-world datasets demonstrate that our method significantly enhances the performance of state-of-the-art approaches. |
| 09:54 | Detecting Cryptojacking Containers in Kubernetes Using eBPF ABSTRACT. As the use of containers has become mainstream in the cloud environment, various security threats targeting containers have also been increasing. Among them, a notable malicious activity is a cryptojacking attack that steals resources without the consent of an instance owner to mine cryptocurrency. However, detecting such anomalies in a containerized environment is more complex because containers share the host kernel, making it challenging to pinpoint resource usage and anomalies at the container granularity without introducing significant overhead. To this end, this study proposes a new framework for real-time detection of malicious mining behavior in the cloud-native environment. By utilizing Tetragon, an eBPF-based runtime security tool, we capture system call sequences in real time and convert them into n-gram feature sets, which were used to train machine learning models. As a result of the experiment, our framework delivers up to 99.93\% classification accuracy with moderate runtime monitoring overhead. |
Online
| 09:00 | Percolation-based Optimization for Enhancing SDN Structure Resilience PRESENTER: Yizhong Hu ABSTRACT. To meet the requirements of network scalability and diversity, the rapid advancement of SDN networks has become an established standard solution. Therefore, the security and reliability mechanisms in SDN is a crucial issue. However, existing solutions mainly focus on enhancing the partial security of the control plane and data plane, lacking research the security of SDN network structure. For instance, Robust Controller Placement (RCP) is an algorithm that only considers controller deployment in a given network based on betweenness centrality. To address these issues, we propose a network resilience performance evaluation framework based on percolation theory. This framework employs a dynamic optimization cycle of “input-simulation-evaluation-rebuild”, which can effectively identify and analyze weak points and critical areas of the network structure, to enhance the resilience of SDN networks. Based on this resilience evaluation framework, we propose a dynamic topology reconstruction for robust controller placement (DTR-RCP), which reconstructs network topology using a bimodal network and selects controllers. Experimental results show that DTR-RCP is better than existing solutions in maintaining network survivability under multi points failure scenarios. |
| 09:18 | A Three-Pronged Approach to Malicious APK: Combining Snort, Wireshark, and Wazuh for Advanced Threat Management ![]() ABSTRACT. Abstract. In the evolving landscape of mobile security threats, traditional detection methods often struggle to effectively identify and mitigate the risks posed by malicious APKs. This study introduces an integrated approach that combines the strengths of Snort and Wireshark with the dynamic response capabilities of Wazuh Manager. Initially, we leverage Snort’s robust network intrusion detection capabilities, enhanced through a custom plugin in Wireshark, to monitor and analyze APK file transfers. This setup allows for effective capture and initial screening of APKs based on known malicious signatures and anomalous network patterns. Subsequently, Wazuh Manager is employed to facilitate an active response strategy. It automates the response to threats detected by Snort, such as isolating affected systems, alerting administrators, and preventing the execution of suspicious APKs. This proactive approach not only aims to stop malware before it causes harm but also adapts to the evolving threat landscape by continuously updating detection rules and response strategies based on new intelligence. Our research indicates that an effective defense against malicious APKs involves monitoring, detecting, and actively responding to these threats. The integration of these tools provides a scalable and adaptable framework that can evolve with emerging threats, offering practical solutions for both organizational and individual security needs. This research underscores the potential of combining network analysis tools with active response systems and lays the groundwork for future advancements in mobile security methodologies with such layered defense approach. |
| 09:36 | Resilient Multi-Path Aggregation Transmission Mechanism for Bandwidth Enhancement PRESENTER: Qixuan Zhang ABSTRACT. With the increasing popularity of high-bandwidth applications, the need for applications capable of multi-path aggregation transmission has risen. These applications enhance bandwidth utilization and network redundancy, simultaneously optimizing network performance by employing multiple network paths. However, deploying such technology involves complex processes and necessitates advanced equipment. We propose a solution that leverages an open-source routing platform combined with multi-path aggregation transmission, aiming to enhance network performance through software upgrades rather than hardware replacement. The system comprises Proxy Router and Aggregation Server, which facilitate the conversion of traditional TCP traffic into multi-path aggregation transmission traffic. Experiments demonstrate that the system substantially improves transmission efficiency and network reliability for users possessing single network interfaces that lack native support for the protocol, thereby broadening the potential applications of multi-path aggregation transmission. |
| 09:54 | Infiltrating the Metaverse: A Security Assessment of Multifaceted Voice Command Manipulation and Undermine ABSTRACT. In the Metaverse, our virtual reality, new technologies are advancing every day. Combining these new technologies with the current systems compromises the security of the Metaverse modules. As a result, this gives attackers access to new potential attack vectors. Attacks against the Metaverse are inevitable due to the lack of thorough investigation and preparation for the mitigation of these potential target vectors. Voice command implementation is one of the significant threats to Metaverse users. Voice commands have the ability to retrieve, traverse, and interpret commands within a user's Metaverse environment, which contains vital user data. Misinterpreting and manipulating these vocal commands could negatively impact the user experience in the virtual world, potentially exposing user data to risk. In the future, the Metaverse will incorporate numerous voice-controlled applications and technologies. In order to investigate the impact of voice command manipulation and misinterpretation by attackers, we examine the voice command interpretation flow in Oculus Quest 2 utilizing Facebook Meta. We perform security analysis on two potential attack surfaces that have been discovered. We use Facebook Meta to analyze the voice command interpretation flow in Oculus Quest 2 in order to look at the effects of voice command manipulation and misinterpretation by attackers. We perform security analysis on the two identified potential attack surfaces. Finally, we arrive at an assessment of new potential attack vectors, and we extensively exploit them using external physical and internal noise. |
Offline
| 10:30 | Bidirectional Proxy Re-Encryption based on Isogenies PRESENTER: Jiawei Chen ABSTRACT. Proxy re-encryption (PRE) allows a semi-honest entity (called a proxy) to convert a ciphertext under a public key into a ciphertext under another public key. Due to this functionality, there are many applications such as e-mail forwarding and encrypted file systems. The existing post-quantum PRE schemes are almostly based on lattice assumptions. In this paper, we propose an isogeny-based PRE scheme as a new post-quantum PRE. Our scheme is multi-hop bidirectional PRE and achieves security against chosen plaintext attacks. We construct the PRE scheme by employing an isogeny-based public key encryption called SiGamal. |
| 10:48 | PRNG-Oriented Side-Channel Security Evaluation for TI-AES PRESENTER: Yusaku Harada ABSTRACT. Side-channel attacks, which leverage physical information during encryption, are a significant threat to cryptographic hardware systems. One widely used countermeasure against such attacks is Threshold Implementation (TI), which employs randomness to disrupt the correlation between intermediate values and side-channel information. TI needs a massive amount of fresh randomness every clock for the refreshing process, which adds randomness to intermediate values to obtain uniformity. Thus, reducing the cost of randomness generation is a huge implementation challenge. In this paper, we investigate the impact on the side-channel resistance of TI-AES when altering the conditions of input sharing or the Pseudo-Random Number Generator (PRNG) algorithm used in refreshing. Furthermore, we meticulously conduct a comparative analysis of the hardware implementation cost of PRNGs based on either Keccak, XORSHIFT-ADD, or Linear Feedback Shift Register (LFSR). This comprehensive study provides a clear understanding of the strengths and weaknesses of each PRNG, aiding in the selection of the most suitable implementation for a given application. Then we demonstrate that a key recovery attack is possible when TI is implemented with unshared input values, and that side-channel leakage occurs when the PRNG used in refreshing has a very short period. |
| 11:06 | A Blockchain-Based Approach for Secure Email Encryption with Variable ECC Key Lengths Selection PRESENTER: Md. Biplob Hossain ABSTRACT. Email security remains crucial in today’s digital information exchange, with Pretty Good Privacy (PGP) which is one of the widely used encryption technique for email. However, PGP’s key distribution vulnerabilities persist as a significant challenge. We previously integrated Blockchain technology with Elliptic Curve Cryptography (ECC) and zero-knowledge proofs (zk-SNARKs) to enhance PGP key distribution. This approach utilized blockchain’s immutability for secure key sharing and zk-SNARKs for efficient verification without exposing sensitive data. While our initial implementation improved key distribution security, it utilized a fixed ECC key length, which did not address the diverse security needs of users across various contexts. Email communications range from simple personal messages to highly sensitive corporate or government correspondence, each requiring different levels of encryption strength. Additionally, users operate on devices with varying computational capabilities, from smartphones to high-performance workstations. This paper introduces a flexible key length mechanism to our blockchain-based PGP key distribution system. We implement support for multiple ECC key lengths (ECC-256, ECC-384, and ECC-521), allowing users to dynamically adjust encryption strength based on message sensitivity, recipient requirements, and device capabilities. We evaluate this approach by analyzing Blockchain performance metrics, including gas consumption, transaction costs, and memory requirements, through case studies of three different scenarios: casual personal email, professional communication, and highly confidential business communication. |
| 11:24 | Analysis of Numerous Security Algorithm Performance with Data Encryption on Edge Device PRESENTER: Sangmyung Lee ABSTRACT. As the Internet of Things (IoT) industry continues to advance rapidly, the importance of real-time data processing using edge devices, such as gas sensors, smart farms, and CCTV systems, is becoming increasingly significant. Moreover, when handling sensitive information such as personal data on these edge devices, encryption is essential to protect against external attacks. Therefore, it is crucial to perform encryption efficiently on edge devices. Given the limited hardware resources of edge devices, even small computational differences can significantly impact overall system performance, making the choice of an appropriate encryption algorithm highly important. In this paper, we use the System-on-Chip device, Jetson Orin Nano, to identify license plates from real-world vehicle images and encrypt the extracted text using well-known encryption algorithms such as AES, RSA, and ECC. To analyze the impact of encryption on the device, we utilize Jetson Stats provided by Nvidia to monitor and track CPU and memory usage, power consumption, and device temperature in real-time during the encryption process. Our analysis reveals that there can be up to a 2.4× difference in temperature variation depending on the encryption algorithm used. |
| 11:42 | Lightweight IoT Data Encryption using Time Parameter based Ascon Algorithm PRESENTER: Kunlin Tsai ABSTRACT. The Internet of Things (IoT) technology has become an important part of modern life, connecting a wide range of devices through networks. However, as IoT adoption grows, the increasing number of connected devices also heightens the risk of security threats, making these devices prime targets for hackers. Traditional cryptographic algorithms are not suitable for securing IoT environments due to the limited memory, energy consumption, and communication bandwidth of IoT devices. As a result, lightweight cryptographic algorithms have been developed specifically for IoT systems with constrained computational resources and energy, leading to the creation of various IoT authentication protocols based on these algorithms. Despite these efforts, many existing protocols struggle to balance lightweight efficiency with robust security. Some protocols have been proposed to address these challenges, but they still suffer from issues such as vulnerability to tag impersonation attacks, insecure transmission of messages from readers to tags, and inadequate protection of authentication keys. In this paper, we propose a lightweight IoT data encryption method by using time parameter on Ascon algorithm, which was recently selected as the NIST standard for lightweight cryptography. By incorporating a time parameter, the proposed method enhances the security of IoT data transmission, particularly for sensitive information such as personal data. Our analysis shows that the proposed method offers improved security compared to existing approaches without significantly increasing transmission or computational overhead. |
Offline
| 10:30 | Development of Stepping-stone Intrusion Detection and its Trend PRESENTER: Jianhua Yang ABSTRACT. Employing stepping-stones to launch attacks have become popular and popular since emerging of the Internet. Most professional attackers use this way to gain benefits and also protect themselves. Even worse, most computers under stepping-stone intrusion have no idea they are actually under attacking since unlike other cyberattacks, stepping-stone intrusion does not present any apparent sign. Detecting stepping-stone intrusion is thus important and critical to the security of the Internet infrastructure. In this paper, we summarize the most typical approaches developed to detect stepping-stone intrusion since 1995 including host-based and network-based detection algorithms. At the end of the paper, we discuss the future trend for the development of stepping-stone intrusion detection, especially, focusing on upstream detection. We also introduce the progress we have made in stepping-stone intrusion upstream detection by using the distribution of inter packets time gap. |
| 10:48 | Multi-channel Transmission Techniques of Multiple Encryption Keys and Ciphertext for Secure Firmware-Over-The-Air Mechanism PRESENTER: Chae-Yeon Park ABSTRACT. A secure and lightweight firmware over-the-air (FOTA) update system is essential for the Internet of Things (IoT), which is managed remotely to promptly address security vulnerabilities. This study proposes a FOTA update method to prevent man-in-the-middle (MITM) attacks in lightweight environments. The proposed method minimizes the file size and encryption complexity of firmware files by employing a dual-XOR operation and DEFLATE compression, while enhancing security through the utilization of multiple transmission channels. This approach reduces the delay associated with changes in file size to an average of approximately 0.71% of the delay time experienced with the conventional method. Additionally, it reduces the delay time due to changes in entropy to an average of about 0.72% of the conventional method's delay time, while maintaining the same level of accuracy. Furthermore, the average security is 12 times improved compared to the conventional method. |
| 11:06 | Exploring the Potential of Anomaly Detection through Prompt Engineering PRESENTER: Sungjune Park ABSTRACT. In recent years, anomaly detection in digital environments has become a critical research area because of issues such as spam messages and fake news, which can lead to privacy breaches, social disruption, and undermine information reliability. Traditional anomaly-detection models often require specific training for each task, resulting in significant time and resource consumption and limited flexibility. This study explored the use of prompt engineering with transformer-based large language models (LLMs) to address these challenges more efficiently. By comparing techniques, such as Zero-shot, Few-shot, Chain-of-Thought (CoT), self-consistency (SC), and tree-of-thought (ToT) prompting, this study identified CoT and SC as particularly effective, achieving up to 96\% accuracy in spam detection without the need for task-specific training. However, ToT has limitations owing to biases and misinterpretations. These findings emphasize the importance of selecting appropriate prompting strategies to optimize LLM performance across various tasks, highlighting the potential of prompt engineering to reduce costs and improve the adaptability of anomaly detection systems. Further research is required to explore the broad applicability and scalability of these methods. |
| 11:24 | Co-EDR: Cooperative-based Event Data Recording Technique for Efficient Firmware Fuzzing PRESENTER: Seung-Ha Ji ABSTRACT. As the Internet of Things (IoT) becomes increasingly integrated into everyday life and across industries, the efficiency of data processing and security within large-scale IoT networks has become crucial. Traditionally, firmware vulnerabilities are patched through wireless updates. However, challenges remain in timely patching these vulnerabilities, leading to active research interest in efficient fuzzing techniques to address these issues. Conventional fuzzing techniques typically rely on random input generation, which often fails to adequately cover the code and can result in increased overhead and reduced detection performance when attempting to inject all possible input combinations. To address these limitations, this paper proposes a cooperative event data recording (CoEDR) technique that efficiently verifies firmware stability in wireless communication systems. Co-EDR improves fuzzing efficiency by recording event data that previously caused crashes and using these data as input. Additionally, the cooperation of multiple devices during fuzzing enhances code coverage and vulnerability detection performance. Experimental results demonstrate that Co-EDR reduces fuzzing time by 99.99% compared to the R-fuzzing method, achieving a 100% vulnerability detection rate and improving fuzzing efficiency by up to 41.80%. |
Online
| 10:30 | NGAP Anomaly Detection based on Signaling Sequences in 5GC Boundary PRESENTER: Shaocong Feng ABSTRACT. The Service-Based Architecture (SBA) of 5G networks introduces new communication technologies and advanced features, as well as new security requirements and challenges. The commercial 5G core (5GC) is a highly secure closed network with interfaces defined the 3rd Generation Partnership Project (3GPP) specifications to fulfill the communication requirements. However, due to the availability of open-source cellular software suites and Universl Software Radio Peripheral (USRP) devices, the 5GC boundary, especially the Radio Access Networks (RAN), are exposed to various security threats. In this paper, we summarize the threat model of N2 interfaces at the 5GC boundary and construct a dataset of abnormal behaviors based on simulated 5G network. In addition, we propose an Next Generation Application Protocol (NGAP) anomaly detection method based on signaling sequences, which extracts sequence features at the granularity of User Equipment (UE). With baseline comparison and ablation experiments, we designed an Long short-term memory (LSTM) model that can accurately learn the dependencies of uplink/downlink signaling. The model achieves 99.20% accuracy and 98.82% F1 score, which can effectively detect NGAP abnormal behavior. |
| 10:48 | ADL: A Method of Attack Detection with LLM by Assigning Traffic Sequencing in 5G IoT ABSTRACT. The growth of data volume and access users in the 5G Internet of Things (IoT) has made network traffic increasingly complicated and diversified. Conventional attack traffic detection has been unable to meet the needs of security assurance. Large Language Model (LLM) technology has demonstrated outstanding efficiency in numerous domains. It's a novel direction to using its potent performance for attack detection.This paper proposes an attack detection method called ADL, which uses the LLM performance to detect DDoS attacks through the cloud edge collaboration in the 5G IoT. For optimal LLM performance and first-time traffic detection, the Multi-Layer Perceptron (MLP) is placed at the edge of the Internet of Things and the LLM is deployed in the cloud center. A personalized model parameter method is proposed, so that the detection results of LLM can be fed back to the edge to provide training basis for MLP. In addition, a traffic processing method is proposed to make the traffic sequential for LLM to understand and process it. The experimental results demonstrate a significant improvement in accuracy, recall rate, and F1 value over the conventional neural network detection scheme in the proposed attack detection method's detection performance for five distinct DDoS attacks. |
| 11:06 | Enhancing Security in Open RAN Networks: Leveraging Zero Trust Architecture to Address Emerging Threats PRESENTER: Dowon Kim ABSTRACT. The rapid advancement of telecommunications networks demands greater flexibility, scalability, and cost-effectiveness, exposing the limitations of traditional, vendor-locked Radio Access Network (RAN) architectures. Open RAN addresses these challenges by decoupling hardware and software, enabling a vendor-agnostic infrastructure through technologies like software-defined networking (SDN) and network functions virtualization (NFV). However, the increased openness of Open RAN introduces new security vulnerabilities, especially with the integration of third-party services and cloud-based solutions. To mitigate these risks, Zero Trust Architecture (ZTA) has been proposed, offering continuous authentication, dynamic access control, and comprehensive monitoring. This paper examines the security threats of Open RAN, the role of ZTA in enhancing network security, and highlights future research directions, including the integration of artificial intelligence (AI), machine learning (ML), and blockchain for decentralized identity management and predictive security responses. The study underscores the importance of a robust security framework to ensure the successful deployment of secure and reliable Open RAN networks. |
| 11:24 | A Security Testing Framework for NAS Protocol Based on Template Modification and Signaling Fuzzing PRESENTER: Changnan Li ABSTRACT. With the rapid development of new 5G technologies and scenarios, the security research of the 5G core network has become a hot topic. This paper proposes an innovative detection framework for the NAS protocol in the 5G core network. The framework consists of a template modification module, state transition module, and signaling fuzzer, supporting the modification of signaling templates in preceding interactions and multi-mode signaling fuzzing. To verify the effectiveness of this framework, we designed a prototype system and conducted multiple signaling tests on the open-source core network free5gc. The results revealed issues such as memory errors, array out-of-bounds, and NAS message decoding errors. Additionally, compared to traditional fuzz testing, this system reduced the testing time to less than 30 seconds per test, significantly improving testing efficiency. |
| 11:42 | 5G Sentinel: High-Precision Elastic Deep Intrusion Detection System for 5G Network PRESENTER: Shengjia Chang ABSTRACT. The growing openness and interconnectivity of mobile communication networks provide users with greater convenience, while simultaneously expanding the attack surface and introducing more sophisticated attacks. Traditional static defense strategies are no longer enough to handle the broader and deeper security threats in 5G networks. Researchers have delved into deep intrusion detection technology to effectively detect security threats in these networks, achieving certain outcomes. However, implementation of intrusion detection in 5G networks faces challenges like inflexible traffic feature characterization and the inability of classification models to effectively detect ambiguous traffic. This paper proposes 5G Sentinel, a high-precision elastic deep intrusion detection system for 5G networks. The system utilizes an improved Concrete Autoencoder to achieve elastic reconstruction of network traffic features and enables precise detection of ambiguous traffic through the ResCLA model. The proposed system achieved F1 Scores of over 99.19% in all 5G and related scenarios. 5G Sentinel can elastically achieve effective detection of regular and ambiguous traffic in 5G and related scenarios, which has significant implications for the security practices of 5G and future 6G networks. |
Offline
