Francesco G. Caccavale
Huu-Nghia Nguyen
ABSTRACT
5G networks become increasingly pervasive, ensuring the robustness and integrity of network functions. The adoption of HTTP/2 in 5G core functions brings notable performance benefits but also introduces potential security risks. By analyzing HTTP/2 related threats, this research aims to shed light on the security challenges faced by 5G networks. The paper proposes effective security testing methodologies using an open-source solution called 5Greplay to detect these security breaches, enabling network operators to protect against potential attacks, safeguard user privacy, and ensure uninterrupted service continuity. By addressing the specific concerns of HTTP/2 related threats, this research contributes to the overall security posture of 5G network functions and provides valuable insights for the secure deployment of 5G networks in an evolving threat landscape.
- M. Liyanage J. Okwuibe M. Ylianttila. I. Ahmad, T. Kumar and A. Gurtov.2018. Overview of 5g security challenges and solutions.Google Scholar
- M. Liyanage J. Okwuibe M. Ylianttila. I. Ahmad, T. Kumar and A. Gurtov.Feb 2022. Enisa threat landscape for 5G networks.Google Scholar
- Baig Z. Lam C.P. Hingston Adi, E.2015. Low-rate denial-of-service attacks against http/2 services. Security and Privacy in Communication Networks (2015), 1–5.Google Scholar
- Jin Cao, Maode Ma, Hui Li, Ruhui Ma, Yunqing Sun, Pu Yu, and Lihui Xiong. 2020. A Survey on Security Aspects for 3GPP 5G Networks. IEEE Commun. Surv. Tutorials 22, 1 (2020), 170–195. https://doi.org/10.1109/COMST.2019.2951818Google ScholarDigital Library
- Efstratios Chatzoglou, Vasileios Kouliaridis, Georgios Kambourakis, Georgios Karopoulos, and Stefanos Gritzalis. 2023. A hands-on gaze on HTTP/3 security through the lens of HTTP/2 and a public dataset. Comput. Secur. 125 (2023), 103051. https://doi.org/10.1016/j.cose.2022.103051Google ScholarDigital Library
- Ning Zhang Fatima Salahdine, Tao Han. 2023. Security in 5G and beyond recent advances and future challenges. Security Privacy. (2023). https://doi.org/10.1002/spy2.271Google ScholarCross Ref
- Xinxin Hu, Caixia Liu, Shuxin Liu, Wei You, and Yu. Zhao. 2018. Signalling security analysis: Is HTTP/2 secure in 5G core network?Security and Privacy in Communication Networks (2018).Google Scholar
- Z. Mukhtar2 B. Yahaya2 Y. Ibrahim2 M. O. Momoh K. O. Shobowale1, *. 2023. Latest Advances on Security Architecture f or 5 G Technology and Services.INTERNATIONAL JOURNAL OF SOFTWARE ENGINEERING & COMPUTER SYSTEMS (IJSECS) 9, ISSUE 1 (2023), 27 – 38. https://doi.org/10.15282/ijsecs.9.1.2023.3.0107Google ScholarCross Ref
- Rabia Khan; Pardeep Kumar; Dushantha Nalin K. Jayakody; Madhusanka Liyanage. 2020. A Survey on Security and Privacy of 5G Technologies: Potential Solutions, Recent Advancements, and Future Directions. IEEE Communications Surveys & Tutorials 22 (2020).Google Scholar
- Martin Thomson Mike Belshe, Roberto Peon. 2015. RFC Hypertext Transfer Protocol Version 2 (HTTP/2). https://datatracker.ietf.org/doc/html/rfc7540Google Scholar
- Montimage. 2023. 5GReplay Documentation. http://5greplay.org/Google Scholar
- Zujany Salazar, Huu Nghia Nguyen, Wissam Mallouli, Ana R. Cavalli, and Edgardo Montes de Oca. 2021. 5Greplay: A 5G Network Traffic Fuzzer - Application to Attack Injection. In Proceedings of the 16th International Conference on Availability, Reliability and Security(ARES 21). Article 106, 8 pages. https://doi.org/10.1145/3465481.3470079Google ScholarDigital Library
- Zujany Salazar, Fatiha Zaïdi, Huu Nghia Nguyen, Wissam Mallouli, Ana Rosa Cavalli, and Edgardo Montes de Oca. 2023. A Network Traffic Mutation Based Ontology, and Its Application to 5G Networks. IEEE Access 11 (2023), 43925–43944. https://doi.org/10.1109/ACCESS.2023.3268759Google ScholarCross Ref
- T.2020. 3rd Generation Partnership Project (3GPP) 3gpp ts 33.117. catalogue of general security assurance requirements (2020).Google Scholar
- Silvio Valenti, Dario Rossi, Alberto Dainotti, Antonio Pescapè, Alessandro Finamore, and Marco Mellia. 2013. Reviewing Traffic Classification. Springer Berlin Heidelberg, Berlin, Heidelberg, 123–147. https://doi.org/10.1007/978-3-642-36784-7_6Google ScholarCross Ref
- Nathalie *Wehbe, Hyame Assem Alameddine, Makan Pourzandi, Elias Bou-Harb, and Chadi. Assi. [n. d.]. Assessment of HTTP/2 Usage in 5G Service Based Architecture.IEEE Communications Magazine ([n. d.]).Google Scholar
- Shouling Ji Meng Han Xiang Ling1, Chunming Wu1. 2023. H2DoS: An Application-Layer DoS Attack Towards HTTP/2 Protocol. Security and Privacy in Communication Networks (2023), 550–570. https://link.springer.com/chapter/10.1007/978-3-319-78813-5_28Google Scholar
Index Terms
- HTTP/2 Attacks Generation using 5Greplay
Recommendations
5Greplay: a 5G Network Traffic Fuzzer - Application to Attack Injection
ARES '21: Proceedings of the 16th International Conference on Availability, Reliability and SecurityThe fifth generation of mobile broadband is more than just an evolution to provide more mobile bandwidth, massive machine-type communications, and ultra-reliable and low-latency communications. It relies on a complex, dynamic and heterogeneous ...
Distributed denial-of-service attacks against HTTP/2 services
HTTP/2 is the second major version of the HTTP protocol published by the internet engineering steering group. The protocol is designed to improve reliability and performance Such enhancements have thus delineated the protocol as being more vulnerable to ...
Slow rate denial of service attacks against HTTP/2 and detection
HTTP/2 is a newly standardized protocol designed to efficiently utilize the TCP's transmission rate and has other advantages compared to HTTP/1.1. However its threat vectors are not completely understood yet. Our contribution in this paper is threefold. ...
Comments