Montimage (France)

The present work was done during the PRECINCT (Preparedness and Resilience Enforcement for Critical INfrastructure Cascading Cyberphysical Threats and effects with focus on district or regional protection) project. The PRECINCT Ecosystem Platform (PEP), part of the PRECINCT approach, serves to “unify” different Critical Infrastructures (CIs) – through a cybersecurity ecosystem platform - and helps in improving facility protection against cascading effects resulting from cyber-physical attacks, in minimizing service disruptions and in managing interfaces with other CIs. In recent years, CIs have been equipped with Industrial Internet of Things (IIoT) technologies including sensors and actuators which communicate using open protocols (e.g., MQTT, AMQP, CoAP, Modbus, DNP3) or commercially licensed protocols (LoRA, IEC 6870-5-101, Profibus) to share data and commands. Furthermore, the management of these CIs is built on Information Communication Technologies (ICTs) which became Critical Information Infrastructure (CII). Therefore, this paper proposes an approach for the deployment of ICT tools used in CI Protection (CIP) projects. Indeed, the PEP’s deployment in PRECINCT’s Living Labs (LLs) was described using Topology and Orchestration Specification for Cloud Applications (TOSCA). TOSCA, in addition to the usage of reference architectures, is proposed by this paper for re-usability and transferability of CIP projects outcomes.

Artificial Intelligence (AI) will play a critical role in future networks, exploiting real-time data collection for optimized utilization of network resources. However, current AI solutions predominantly emphasize model performance enhancement, engendering substantial risk when AI encounters irregularities such as adversarial attacks or unknown misbehaves due to its "black-box" decision process. Consequently, AI-driven network solutions necessitate enhanced accountability to stakeholders and robust resilience against known AI threats. This paper introduces a high-level process, integrating Explainable AI (XAI) techniques and illustrating their application across three typical use cases: encrypted network traffic classification, malware detection, and federated learning. Unlike existing task-specific qualitative approaches, the proposed process incorporates a new set of metrics, measuring model performance, explainability, security, and privacy, thus enabling users to iteratively refine their AI network solutions. The paper also elucidates future research challenges we deem critical to the actualization of trustworthy, AI-empowered networks.

This is an electronic reprint of the original article. This reprint may differ from the original in pagination and typographic detail.

This work presents a Moving Target Defense (MTD) framework for the protection of network slices and virtual resources in a telco cloud environment. The preliminary implementation provides a closed-loop security management of services with proactive MTD operations to reduce the success probability of attacks, and reactive MTD operations, empowered by a tampering detection and a traffic-based anomaly detection system. MTD strategies are adaptive and optimized with deep reinforcement learning (deep-RL) for balancing costs, security, and availability goals defined in a Multi-Objective Markov Decision Process (MOMDP).

Fifth-generation technology standard for broadband cellular networks, 5G, delivers a significant increase in data speeds and capacity, as well as new capabilities such as higher energy efficiency, lower latency, and the ability to connect a large number of devices. These advances come with a new set of security challenges, as 5G networks will be more complex and integrated with critical infrastructure than previous generations. In order to correctly address such challenges there is the need for fine-grained threat models, that collect a set of well-detailed threats, each of them clearly addressing a system component, taking into account how components are connected and interact with each other, the specific technology and/or the protocols are involved. A fine-grained threat model can be used to support the definition of a penetration testing plan or to identify and verify the effectiveness of technical countermeasures. This paper extends an existing automated threat modelling methodology focusing on 5G architecture and defines a process to build in a systematic way the catalogue of threats on which the technique relies. In order to obtain such results, we extended our modelling technique, in order to model 5G architectures, defined a process to extend our methodology to address additional domains and applied the approach to a concrete case study, applying our technique to a common 5G open-source architecture proposed by our industrial partner. The main contribution of this paper can be summarized as follows: 1) technique to systematically produce an extension of our modelling technique and a threat catalogue for a specific Domain; 2) 5G systems threat catalogue; 3) 5G systems graph-based modelling technique. As an additional result, we validated our approach, applying our technique in a real context and involving industrial experts for the evaluation of the generated fine-grained threat model.

The modern communications landscape requires reliable, high-speed, high-throughput and secure links and sessions between user equipment instances and the data network. The 5G core implements the newly defined 3GPP network architecture enabling faster connectivity, low latency, higher bit rates and network reliability. The full potential of this set of networks will support a set of critical Internet of things (IoT) and industrial use cases. Nevertheless, several components and interfaces of the next-generation radio access network (NG-RAN) have proven to be vulnerable to attacks that can potentially obstruct the network’s capability to provide reliable end-to-end communication services. Various inherent security flaws and protocol-specific weaknesses have also been identified within the 5G core itself. However, little to no research has gone into testing and exposing said core-related weaknesses, contrary to those concerning the NG-RAN. In this paper, we investigate, describe, develop, implement and finally test a set of attacks on the Packet Forwarding Control Protocol (PFCP) inside the 5G core. We find that, by transmitting unauthorised session control packets, we were able to disrupt established 5G tunnels without disrupting subscribers’ connectivity to the NG-RAN, thus hindering the detection of said attacks. We evaluate the identified PFCP attacks in a drone-based scenario involving 5G tunnelling between two swarms.