{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,2,19]],"date-time":"2026-02-19T16:59:30Z","timestamp":1771520370133,"version":"3.50.1"},"reference-count":36,"publisher":"MDPI AG","issue":"10","license":[{"start":{"date-parts":[[2022,5,18]],"date-time":"2022-05-18T00:00:00Z","timestamp":1652832000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"name":"Institute of Information &amp; communications Technology Planning &amp; Evaluation (IITP)","award":["2021-0-00796"],"award-info":[{"award-number":["2021-0-00796"]}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Sensors"],"abstract":"<jats:p>The 5G networks aim to realize a massive Internet of Things (IoT) environment with low latency. IoT devices with weak security can cause Tbps-level Distributed Denial of Service (DDoS) attacks on 5G mobile networks. Therefore, interest in automatic network intrusion detection using machine learning (ML) technology in 5G networks is increasing. ML-based DDoS attack detection in a 5G environment should provide ultra-low latency. To this end, utilizing a feature-selection process that reduces computational complexity and improves performance by identifying features important for learning in large datasets is possible. Existing ML-based DDoS detection technology mostly focuses on DDoS detection learning models on the wired Internet. In addition, studies on feature engineering related to 5G traffic are relatively insufficient. Therefore, this study performed feature selection experiments to reduce the time complexity of detecting and analyzing large-capacity DDoS attacks in real time based on ML in a 5G core network environment. The results of the experiment showed that the performance was maintained and improved when the feature selection process was used. In particular, as the size of the dataset increased, the difference in time complexity increased rapidly. The experiments show that the real-time detection of large-scale DDoS attacks in 5G core networks is possible using the feature selection process. This demonstrates the importance of the feature selection process for removing noisy features before training and detection. As this study conducted a feature study to detect network traffic passing through the 5G core with low latency using ML, it is expected to contribute to improving the performance of the 5G network DDoS attack automation detection technology using AI technology.<\/jats:p>","DOI":"10.3390\/s22103819","type":"journal-article","created":{"date-parts":[[2022,5,18]],"date-time":"2022-05-18T23:14:26Z","timestamp":1652915666000},"page":"3819","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":48,"title":["Effective Feature Selection Methods to Detect IoT DDoS Attack in 5G Core Network"],"prefix":"10.3390","volume":"22","author":[{"ORCID":"https:\/\/orcid.org\/0000-0001-7028-4449","authenticated-orcid":false,"given":"Ye-Eun","family":"Kim","sequence":"first","affiliation":[{"name":"Department of Electronics Information and System Engineering, Sangmyung University, Cheonan 31066, Korea"}]},{"given":"Yea-Sul","family":"Kim","sequence":"additional","affiliation":[{"name":"Department of Electronics Information and System Engineering, Sangmyung University, Cheonan 31066, Korea"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-4449-5821","authenticated-orcid":false,"given":"Hwankuk","family":"Kim","sequence":"additional","affiliation":[{"name":"Department of Information Security Engineering, Sangmyung University, Cheonan 31066, Korea"}]}],"member":"1968","published-online":{"date-parts":[[2022,5,18]]},"reference":[{"key":"ref_1","unstructured":"Samsung Research (2020, December 01). The Next Hyper-Connected Experience for All. Available online: https:\/\/cdn.codeground.org\/nsr\/downloads\/researchareas\/20201201_6G_Vision_web.pdf."},{"key":"ref_2","unstructured":"Rysavy Research, and 5G Americas (2020, September 10). Global 5G: Rise of a Transformational Technology. Available online: https:\/\/www.5gamericas.org\/wp-content\/uploads\/2020\/09\/Global-5G-Rise-of-a-transformational-technology.pdf."},{"key":"ref_3","first-page":"1","article-title":"5G core network security issues and attack classification from network protocol perspective","volume":"10","author":"Kim","year":"2020","journal-title":"J. Internet Serv. Inf. Secur."},{"key":"ref_4","doi-asserted-by":"crossref","first-page":"70","DOI":"10.1016\/j.neucom.2017.11.077","article-title":"Feature selection in machine learning: A new perspective","volume":"300","author":"Cai","year":"2018","journal-title":"Neurocomputing"},{"key":"ref_5","doi-asserted-by":"crossref","first-page":"245","DOI":"10.1016\/S0004-3702(97)00063-5","article-title":"Selection of relevant features and examples in machine learning","volume":"97","author":"Blum","year":"1997","journal-title":"Artif. Intell."},{"key":"ref_6","doi-asserted-by":"crossref","unstructured":"Liu, H., and Motoda, H. (1998). Feature Selection for Knowledge Discovery and Data Mining, Springer Science and Business Media. [1st ed.].","DOI":"10.1007\/978-1-4615-5689-3"},{"key":"ref_7","first-page":"1157","article-title":"An introduction to variable and feature selection","volume":"3","author":"Guyon","year":"2003","journal-title":"JMLR"},{"key":"ref_8","unstructured":"Yang, X. (2018, January 11\u201315). 5G security in ITU-T SG17. Proceedings of the ETSI Security Week 2018 on International Telecommunication Un-ion (ITU), Sophia Antipolis, France."},{"key":"ref_9","unstructured":"3rd Generation Partnership Project (3GPP) (2022, April 29). Technical Specification (TS) 33.501; Security Architecture and Procedures for 5G System; Version 17.4.1; Release 17. Available online: https:\/\/www.3gpp.org\/ftp\/Specs\/archive\/33_series\/33.501\/33501-h41.zip."},{"key":"ref_10","first-page":"269","article-title":"Intelligent network data analytics function in 5G cellular networks using machine learning","volume":"22","author":"Sevgican","year":"2020","journal-title":"JCN"},{"key":"ref_11","unstructured":"3rd Generation Partnership Project (3GPP) (2022, April 29). Technical Specification (TS) 23.288; Architecture Enhancements for 5G System (5GS) to Support Network Data Analytics Services; Version 17.1.0; Release 17. Available online: https:\/\/www.3gpp.org\/ftp\/Specs\/archive\/23_series\/23.288\/23288-h10.zip."},{"key":"ref_12","doi-asserted-by":"crossref","first-page":"4467","DOI":"10.32604\/cmc.2022.026581","article-title":"Detecting IoT Botnet in 5G Core Network Using Machine Learning","volume":"72","author":"Kim","year":"2022","journal-title":"CMC"},{"key":"ref_13","doi-asserted-by":"crossref","unstructured":"Babaagba, K.O., and Adesanya, S.O. (2019, January 2\u20134). A study on the effect of feature selection on malware analysis using machine learning. Proceedings of the 2019 8th International Conference on Educational and Information Technology, Cambridge, UK.","DOI":"10.1145\/3318396.3318448"},{"key":"ref_14","doi-asserted-by":"crossref","first-page":"4867","DOI":"10.1007\/s11227-018-2263-3","article-title":"A machine learning approach for feature selection traffic classification using security analysis","volume":"74","author":"Shafiq","year":"2018","journal-title":"J. Supercomput."},{"key":"ref_15","doi-asserted-by":"crossref","first-page":"3193","DOI":"10.1007\/s10489-018-1141-2","article-title":"Semi-supervised machine learning approach for DDoS detection","volume":"48","author":"Idhammad","year":"2018","journal-title":"Appl. Intell."},{"key":"ref_16","first-page":"688","article-title":"A multi-class neural network model for rapid detection of IoT botnet attacks","volume":"11","author":"Alzahrani","year":"2020","journal-title":"Int. J. Adv. Comp. Sci. Appl."},{"key":"ref_17","doi-asserted-by":"crossref","unstructured":"Soe, Y.N., Feng, Y., Santosa, P.I., Sakurai, K., and Hartanto, R. (2020). Machine learning-based IoT-botnet attack detection with sequential architecture. Sensors, 20.","DOI":"10.3390\/s20164372"},{"key":"ref_18","doi-asserted-by":"crossref","unstructured":"Mirsky, Y., Doitshman, T., Elovici, Y., and Shabtai, A. (2018). Kitsune: An Ensemble of Autoencoders for Online Network Intrusion De-tection. arXiv.","DOI":"10.14722\/ndss.2018.23204"},{"key":"ref_19","unstructured":"(2022, April 29). Kitsune Network Attack Dataset. Available online: https:\/\/www.kaggle.com\/datasets\/ymirsky\/network-attack-dataset-kitsune."},{"key":"ref_20","unstructured":"Kim, Y., Kim, M., and Kim, H. (2021, January 7\u20139). A Study on Analysis of Machine Learning-based IoT Botnet Traffic in 5G Core Networks. Proceedings of the 5th International Symposium on Mobile Internet Security (MobiSec\u201921), Jeju Island, Korea."},{"key":"ref_21","first-page":"9","article-title":"Machine Learning for Securing SDN based 5G Network","volume":"174","author":"Alamri","year":"2021","journal-title":"Int. J. Comput. Appl."},{"key":"ref_22","doi-asserted-by":"crossref","first-page":"53","DOI":"10.1049\/iet-net.2017.0212","article-title":"Machine learning-based IDS for software-defined 5G network","volume":"7","author":"Li","year":"2018","journal-title":"IET Netw."},{"key":"ref_23","doi-asserted-by":"crossref","unstructured":"Polat, H., Polat, O., and Cetin, A. (2020). Detecting DDoS Attacks in Software-Defined Networks Through Feature Selection Methods and Machine Learning Models. Sustainability, 12.","DOI":"10.3390\/su12031035"},{"key":"ref_24","doi-asserted-by":"crossref","first-page":"114","DOI":"10.1016\/j.jnca.2019.02.030","article-title":"Traffic-flow analysis for source-side DDoS recognition on 5G environments","volume":"136","author":"Monge","year":"2019","journal-title":"J. Netw. Comput. Appl."},{"key":"ref_25","doi-asserted-by":"crossref","first-page":"7700","DOI":"10.1109\/ACCESS.2018.2803446","article-title":"A self-adaptive deep learning-based system for anomaly detection in 5G networks","volume":"6","author":"Clemente","year":"2018","journal-title":"IEEE Access"},{"key":"ref_26","unstructured":"3rd Generation Partnership Project (3GPP) (2022, April 29). Technical Specification (TS) 23.501; System Architecture for the 5G System (5GS); Version 17.2.0; Release 17. Available online: https:\/\/www.3gpp.org\/ftp\/Specs\/archive\/23_series\/23.501\/23501-h20.zip."},{"key":"ref_27","unstructured":"3rd Generation Partnership Project (3GPP) (2022, April 29). Technical Specification (TS) 29.060; GPRS Tunneling Protocol (GTP) across the Gn and Gp Interface; Version 17.1.0; Release 17. Available online: https:\/\/www.3gpp.org\/ftp\/Specs\/archive\/29_series\/29.060\/29060-h10.zip."},{"key":"ref_28","unstructured":"Brown, G. (2022, April 29). Serviced-Based Architecture for 5g Core Networks. Huawei. Available online: https:\/\/www.3g4g.co.uk\/5G\/5Gtech_6004_2017_11_Service-Based-Architecture-for-5G-Core-Networks_HR_Huawei.pdf."},{"key":"ref_29","unstructured":"(2022, April 27). Open5GS. Available online: https:\/\/open5gs.org\/open5gs\/docs\/."},{"key":"ref_30","doi-asserted-by":"crossref","first-page":"107516","DOI":"10.1016\/j.comnet.2020.107516","article-title":"Open, programmable, and virtualized 5G networks: State-of-the-art and the road ahead","volume":"182","author":"Bonati","year":"2020","journal-title":"Comput. Netw."},{"key":"ref_31","unstructured":"3rd Generation Partnership Project (3GPP) (2022, April 29). Technical Specification (TS) 23.503; Policy and Charging Control Framework for the 5G System (5GS); Version 17.2.0; Release 17. Available online: https:\/\/www.3gpp.org\/ftp\/Specs\/archive\/23_series\/23.503\/23503-h20.zip."},{"key":"ref_32","doi-asserted-by":"crossref","unstructured":"Chandramouli, D., Liebhart, R., and Pirskanen, J. (2019). 5G for the Connected World, Wiley. [1st ed.].","DOI":"10.1002\/9781119247111"},{"key":"ref_33","doi-asserted-by":"crossref","unstructured":"Duan, Q. (2021). Intelligent and Autonomous Management in Cloud-Native Future Networks-A Survey on Related Standards from an Architectural Perspective. Future Internet, 13.","DOI":"10.3390\/fi13020042"},{"key":"ref_34","doi-asserted-by":"crossref","first-page":"226","DOI":"10.1016\/j.comcom.2021.03.024","article-title":"Security policies definition and enforcement utilizing policy control function framework in 5G","volume":"172","author":"Gomez","year":"2021","journal-title":"Comput. Commun."},{"key":"ref_35","doi-asserted-by":"crossref","first-page":"127639","DOI":"10.1109\/ACCESS.2019.2939938","article-title":"5G evolution: A view on 5G cellular technology beyond 3GPP release 15","volume":"7","author":"Ghosh","year":"2019","journal-title":"IEEE Access"},{"key":"ref_36","unstructured":"(2022, April 29). 5G Traffic Flow. Available online: https:\/\/www.netmanias.com\/en\/post\/oneshot\/14104\/5g\/5g-traffic-flow."}],"container-title":["Sensors"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/1424-8220\/22\/10\/3819\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,10]],"date-time":"2025-10-10T23:13:58Z","timestamp":1760138038000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/1424-8220\/22\/10\/3819"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2022,5,18]]},"references-count":36,"journal-issue":{"issue":"10","published-online":{"date-parts":[[2022,5]]}},"alternative-id":["s22103819"],"URL":"https:\/\/doi.org\/10.3390\/s22103819","relation":{},"ISSN":["1424-8220"],"issn-type":[{"value":"1424-8220","type":"electronic"}],"subject":[],"published":{"date-parts":[[2022,5,18]]}}}