A METHODOLOGY FOR BUILDING AN ATTACK DETECTION DATASET ON A 5G TESTBED BASED ON OPEN5GS AND UERANSIM

Abstract

The quality of machine learning based intrusion detection in 5G networks depends directly on the data used to train it. The widely used CIC-IDS2017, UNSW-NB15 and BoT-IoT datasets were collected in conventional IP networks and therefore contain no GTP-U tunnelling, no NGAP signalling and no network slices. This paper describes a 5G standalone testbed built in VirtualBox from the Open5GS core and the UERANSIM gNB/UE simulator. It presents the benign and attack traffic scenarios, packet capture on the N3 and N6 interfaces, GTP-U decapsulation, flow labelling from an experiment manifest, and a data split that prevents leakage between training and test sets. The methodology is used in a doctoral study to build a dataset for training and validating a hybrid, explainable IDS model.