Combining network data analytics function and machine learning for abnormal traffic detection in beyond 5G

The Network Data Analytics Function (NWDAF) is a key component of the 5G Core Network (CN) architecture whose role is to generate analytics and insights from the network data to accommodate end users and improve the network performance. NWDAF allows the collection, processing, and analysis of network data to enable a variety of applications, such as User Equipment (UE) mobility analytics and UE abnormal behavior. Although defined by 3GPP, realizing these applications is still an open problem. To fill this gap: (i) we propose a microservices architecture of NWDAF to plug the 3GPP applications as microservices enabling greater flexibility and scalability of NWDAF; (ii) devise a Machine Learning (ML) algorithm, specifically an LSTM Auto-encoder whose role is to detect abnormal traffic events using real network data extracted from the Milano dataset; (iii) we integrate and test the abnormal traffic detection algorithm in the NWDAF based on OpenAirInterface (OAI) 5G CN and RAN.