Evaluating the Security Posture of 5G Networks by Combining State Auditing and Event Monitoring

Abstract

5G network technology is being rapidly adopted in various critical infrastructures, mainly due to its unique benefits (e.g., higher throughput, lower latency, and better scalability). This wide-spread and fast adoption necessitates securing those critical services deployed over 5G technology. However, evaluating the security posture of a 5G network is challenging due to the heterogeneous and large-scale nature of 5G networks coupled with new security threats. Moreover, existing 5G security approaches fall short as their results are typically binary and difficult to be translated into the overall security posture of a 5G network. In this paper, we propose a novel solution for evaluating the security posture of 5G networks by combining the results of existing security solutions for state auditing and event monitoring. To that end, our main idea is to first build a novel event-state model that captures both events and states in a 5G network, and then extend this model to evaluate the overall security posture and how such security posture may evolve over time due to persistent threats. We integrate this approach with free5GC (a popular 5G open-source project) and evaluate its effectiveness.

Appendices

Appendix

A Definition of Event-State Model

To evaluate security postures in 5G, we build a model, namely, event-state model (a combination of the event model and state model). The state model captures the results of auditing system states, and the event model captures the results of monitoring system events. We define these models more formally as follows.

Event Model (EM). Given a list of event types event-types and the log of historical events hist, the event model is defined as a Bayesian network $EM = (G_{e}, E_{e})$, where $G_{e}$ is a directed acyclic graph (DAG) in which each node represents an event type in event-types, and each directed edge between two nodes indicates the first node would immediately precede the other in some event sequences in hist whose probability is part of the list of parameters $E_{e}$.

State Model (SM). Given a list of breaches of different security control from different security standards, B and the pre-, and post-conditions of individual breach, P, and the auditing logs of the system over time auHist, the state model is defined as a dependency graph [51] $SM = (G_{s}, E_{s})$, where $G_{s}$ is a set of DAGs in which each node corresponds to the breach of security control and their pre-or post-condition from B and P, and each directed edge between two nodes indicates the transition probability derived from auHist and it is part of the list of parameters $E_{s}$.

Event-State Model (ESM). Event-State Model is a Bayesian network $ESM = (G_{c}, E_{c})$, where $G_{c} = \{G_{e} \cup G_{s}\}$ (i.e., all the nodes in both the event and state models) and $E_{c} = \{E_{e} \cup E_{s} \cup E_{p}\}$, where $E_p$ is the set of edges that connects the privilege escalation vertices (responsible for lateral movement caused by a breach) to the resulted vertices (either from EM or SM) and the edge values are coming from hist and auHist as a probability which is part of the list of parameters $E_{c}$.

B Algorithm for Building Event-State Model

Algorithm 1 is used to construct an event-state model from the event model, and the state model. We define two distinct functions: vertical_fusing (Lines 3 to 16), and horizontal_fusing (Lines 17 to 28) to combine the model vertically and horizontally. For vertical fusing, in Line 6, we first list all the privilege escalation nodes manually by taking help from an expert. Then, for each privilege escalation node, we attach the breach node and the event node to the privilege escalation node in Lines 9–13. In Lines 29–36, we define one utility function named findCommonNode to list all the common nodes between two models for horizontal fusing. Line 18 of the horizontal_fusing function utilizes this utility function. Line 23 and 24 adds the parent and child subgraphs from both the event model and the state model to the common node.

Algorithm 1

Building event-state Model