Rule-Based Anomaly Detection Model with Stateful Correlation Enhancing Mobile Network Security

Abstract

The global Signalling System No. 7 (SS7) network protocol standard has been developed and regulated based only on trusted partner networks. The SS7 network protocol by design neither secures the communication channel nor verifies the entire network peers. The SS7 network protocol used in telecommunications has deficiencies that include verification of actual subscribers, precise location, subscriber's belonging to a network, absence of illegitimate message filtering mechanism, and configuration deficiencies in home routing networks. Attackers can take advantage of these deficiencies and exploit them to impose threats such as subscriber or network data disclosure, intercept mobile traffic, perform account frauds, track subscriber location, and deny services. Existing methods are unable to identify suspicious hosts as they use a minimal number of network parameters. So, there is a vital need to overcome these deficiencies to detect the abnormal behaviour of users and hence mitigate security attacks in a mobile network. This research proposes a model for anomaly detection in mobile networks based on Rule-based filtering with stateful correlation. The performance of the proposed method is evaluated using synthetic datasets. Results show that the proposed anomaly detection model performs 0.37% better in terms of security attack detection rate, 24.25% better in terms of false alarm rate, and 31.45% better in terms of true positive rate when compared with the existing pattern recognition Artificial Neural Network (ANN) algorithm.

Mobile cellular network security vulnerability detection using machine learning

“…Extract a higher level and generalisable function representation from the abstract syntax tree (AST), use this function representation as the training set to train a vulnerability classification model on the bidirectional LSTM neural network, and apply it to the vulnerability detection task in cross project scenarios (Islam et al, 2019;Zhang et al, 2018). A novel numerical vector is calculated using the control flow chart of each binary function, and then the similarity can be effectively detected by measuring the distance between the embedding of two functions (Adi et al, 2020;Afzal and Murugesan, 2022). Use the neural network to learn the patterns in the input file from the past fuzzy exploration, and perform fuzzy mutation according to the past mutation and the corresponding code coverage information to guide future fuzzy exploration (Ashraf et al, 2020;da Costa et al, 2019).…”