Combining network data analytics function and machine learning for abnormal traffic detection in beyond 5G

The Network Data Analytics Function (NWDAF) is a key component of the 5G Core Network (CN) architecture whose role is to generate analytics and insights from the network data to accommodate end users and improve the network performance.

NWDAF allows the collection, processing, and analysis of network data to enable a variety of applications, such as User Equipment (UE) mobility analytics and UE abnormal behaviour. Although defined by 3GPP, realizing these applications is still an open problem. To fill this gap: (i) we propose a microservices architecture of NWDAF to plug the 3GPP applications as microservices enabling greater flexibility and scalability of NWDAF; (ii) devise a Machine Learning (ML) algorithm, specifically an LSTM Auto-encoder whose role is to detect abnormal traffic events using real network data extracted from the Milano dataset [1]; (iii) we integrate and test the abnormal traffic detection

algorithm in the NWDAF based on OpenAirInterface (OAI) 5G CN and RAN [2]. The experimental results show the ability of NWDAF to collect data from a real 5G CN using 3GPP-compliant interfaces and detect abnormal traffic generated by a real UE

using ML.