Security has become the primary concern in many telecommunications industries today as risks can have high consequences. Especially, as the core and enable technologies will be associated with 5G network, the confidential information will move at all layers in future wireless systems. Several incidents revealed that the hazard encountered by an infected wireless network, not only affects the security and privacy concerns, but also impedes the complex dynamics of the communications ecosystem. Consequently, the complexity and strength of security attacks have increased in the recent past making the detection or prevention of sabotage a global challenge. From the security and privacy perspectives, this paper presents a comprehensive detail on the core and enabling technologies, which are used to build the 5G security model; network softwarization security, PHY (Physical) layer security and 5G privacy concerns, among others. Additionally, the paper includes discussion on security monitoring and management of 5G networks. This paper also evaluates the related security measures and standards of core 5G technologies by resorting to different standardization bodies and provide a brief overview of 5G standardization security forces. Furthermore, the key projects of international significance, in line with the security concerns of 5G and beyond are also presented. Finally, a future directions and open challenges section has included to encourage future research.

/pdf/a-survey-on-security-and-privacy-of-5g-technologies-1hq5wqw2pb.pdf

A Survey on Security and Privacy of 5G Technologies: Potential Solutions, Recent Advancements, and Future Directions

Internet of Things (IoT) is one of the most rapidly used technologies in the last decade in various applications. The smart things are connected in wireless or wired for communication, processing, computing, and monitoring different real-time scenarios. The things are heterogeneous and have low memory, less processing power. The implementation of the IoT system comes with security and privacy challenges because traditional based existing security protocols do not suitable for IoT devices. In this survey, the authors initially described an overview of the IoT technology and the area of its application. The primary security issue CIA (confidentially, Integrity, Availability) and layer-wise issues are identified. Then the authors systematically study the three primary technology Machine learning(ML), Artificial intelligence (AI), and Blockchain for addressing the security issue in IoT. In the end, an analysis of this survey, security issues solved by the ML, AI, and Blockchain with research challenges are mention.

Survey on IoT security: Challenges and solution using machine learning, artificial intelligence and blockchain technology

Service-oriented architecture (SOA) is gaining momentum as an emerging distributed system architecture for business-to-business collaborations. This momentum can be observed in both industry and academic research. SOA presents new challenges and opportunities for testing and verification, leading to an upsurge in research. This paper surveys the previous work undertaken on testing and verification of service-centric systems, which in total are 177 papers, showing the strengths and weaknesses of current strategies and testing tools and identifying issues for future work. Copyright © 2012 John Wiley & Sons, Ltd.

Testing and verification in service-oriented architecture: a survey

A scalable distributed machine learning approach for attack detection in edge computing environments

Security attacks typically result from unintended behaviors or invalid inputs. Security testing is labor intensive because a real-world program usually has too many invalid inputs. It is highly desirable to automate or partially automate security-testing process. This paper presents an approach to automated generation of security tests by using formal threat models represented as Predicate/Transition nets. It generates all attack paths, i.e., security tests, from a threat model and converts them into executable test code according to the given Model-Implementation Mapping (MIM) specification. We have applied this approach to two real-world systems, Magento (a web-based shopping system being used by many online stores) and FileZilla Server (a popular FTP server implementation in C++). Threat models are built systematically by examining all potential STRIDE (spoofing identity, tampering with data, repudiation, information disclosure, denial of service, and elevation of privilege) threats to system functions. The security tests generated from these models have found multiple security risks in each system. The test code for most of the security tests can be generated and executed automatically. To further evaluate the vulnerability detection capability of the testing approach, the security tests have been applied to a number of security mutants where vulnerabilities are injected deliberately. The mutants are created according to the common vulnerabilities in C++ and web applications. Our experiments show that the security tests have killed the majority of the mutants.

Automated Security Test Generation with Formal Threat Models

Abstract The modern communications landscape requires reliable, high-speed, high-throughput and secure links and sessions between user equipment instances and the data network. The 5G core implements the newly defined 3GPP network architecture enabling faster connectivity, low latency, higher bit rates and network reliability. The full potential of this set of networks will support a set of critical Internet of things (IoT) and industrial use cases. Nevertheless, several components and interfaces of the next-generation radio access network (NG-RAN) have proven to be vulnerable to attacks that can potentially obstruct the network’s capability to provide reliable end-to-end communication services. Various inherent security flaws and protocol-specific weaknesses have also been identified within the 5G core itself. However, little to no research has gone into testing and exposing said core-related weaknesses, contrary to those concerning the NG-RAN. In this paper, we investigate, describe, develop, implement and finally test a set of attacks on the Packet Forwarding Control Protocol (PFCP) inside the 5G core. We find that, by transmitting unauthorised session control packets, we were able to disrupt established 5G tunnels without disrupting subscribers’ connectivity to the NG-RAN, thus hindering the detection of said attacks. We evaluate the identified PFCP attacks in a drone-based scenario involving 5G tunnelling between two swarms. 

/pdf/threatening-the-5g-core-via-pfcp-dos-attacks-the-case-of-8prsn3jl.pdf

Threatening the 5G core via PFCP DoS attacks: the case of blocking UAV communications

Most software system properties can be quantified with the application of measurement processes. OMG's Structured Metrics Meta-Model (SMM) supports the meta-model agnostic method to define these measurements. This paper introduces the first building block of the MEASURE (Measuring Software Engineering) [5] project tool chain: the Modelio modeling tool together with the SMM Module developed based in Modelio's open source distribution. These tools permit the formal specification of metrics and a common interchange format enabling interoperability between the project's tools. This paper presents this new approach of metrics specification that simplifies their combination and their integration into compliant platforms and tools

Modeling OMG SMM metrics using the Modelio modeling tool in the MEASURE project

Due to the modern iterative development practices and new automated software engineering tools and methods brought by the DevOps agile method, the traditional metrics and evaluation methods are not enough to ensure software security. Besides, the recent years have seen probably the most continuous and extreme software security attacks ever recorded against organizations in an assortment of enterprises. Security is presently a vast range, critical for business achievement. The existing metrics must be redefined, and new security metrics should be determined based on multiple measures to increase the reliability of the values. Due to the short cycles of iterative processes in DevOps method, the feedback must come quickly, so the measurement should be automated and continuous. Due to the massive amount of information, the results must be visualized at a suitable level of abstraction, which may be different for the various stakeholders. In this paper, we propose a unique Metric-driven approach to help improve the software engineering processes by increasing the quality, adaptability and security of software and decreasing costs and time-to-market.

Metrics-driven DevSecOps.

This paper presents a security assurance platform to monitor and control the security in the context of multi-cloud applications. Indeed, this property is a crucial issue in multi cloud-based environments where many aspects need to be faced, including risk management, data privacy and isolation, security-by-design applications, and vulnerability scans. Moreover, it also becomes necessary to have an efficient system that interrelates and operates all security controls that are configured and executed independently on each component of the system.

A Platform for Security Monitoring of Multi-cloud Applications

After more than one decade of research efforts, ICN technologies seem mature enough to move from a design and implementation phase to early deployment trials. However, if one wants an ICN stack to be operated in a production context, some major locks, related to the lack of adequate deployment infrastructure, the migration of relevant services, and the capability to accurately monitor an overall ICN domain, must be addressed. In this article we present a feedback experience of the deployment of a Named Data Networking island. The latter considers HTTP over NDN as a primary service deployed through dedicated gateways and NFV as a substrate for deploying and orchestrating ICN components. From the performance assessment of individual components up to the opening of the testbed to end users in a university campus, we propose an analysis that can guide further research efforts in the ICN area.

/pdf/an-orchestrated-ndn-virtual-infrastructure-transporting-web-3k64lnn2lp.pdf

Wissam Mallouli

Papers

Threatening the 5G core via PFCP DoS attacks: the case of blocking UAV communications

Modeling OMG SMM metrics using the Modelio modeling tool in the MEASURE project

Metrics-driven DevSecOps.

A Platform for Security Monitoring of Multi-cloud Applications

An Orchestrated NDN Virtual Infrastructure Transporting Web Traffic: Design, Implementation, and First Experiments with Real End Users