An Empirical Study of Deep Learning-Based SS7 Attack Detection

Signalling protocols are responsible for fundamental tasks such as initiating and terminating communication identifying the state of in telecommunication core networks. System No. 7 (SS7), Diameter, GPRS Tunneling Protocol (GTP) main used 2G to 4G, while 5G uses standard Internet its signalling. Despite their distinct features, especially security guarantees, they most vulnerable attacks roaming scenarios: that target location update function call subscribers who located a visiting network. The literature tells us rule-based detection mechanisms ineffective against attacks, hope lies deep learning (DL)-based solutions. In this paper, we provide large-scale empirical study state-of-the-art DL models, including eight supervised five semi-supervised, detect scenario. Our experiments use real-world dataset simulated SS7, can be straightforwardly carried out other signalling upon availability corresponding datasets. results show semi-supervised models generally outperform ones since leverage both labeled unlabeled data training. Nevertheless, ensemble-based model NODE outperforms others category some category. Among all, PReNet performs best regarding Recall F1 metrics when all training, it is also stable one. experiment shows performances different could differ lot size