Emulation Digital Twin Framework: Case Study on NGAP Attacks in 5G Control Plane

The signalling protocols at the 5G network control plane may be exploited to perform Denial-of-Service (DoS) attacks. The countermeasures developed have to be evaluated in realistic conditions to validate their effectiveness and performance overhead. However, current emulation frameworks offer limited automation, which prevents large-scale and iterative what-if analysis. To address these needs, we present the Emulation Digital Twin (EDT) Framework, which is a modular three-layered architecture. Here, the Emulation Layer utilises open-source tools of Containerlab, UERANSIM, and an extended Open5GS with designed signalling hooks. Then, the Digital Twin (DT) Layer utilises these to form a graph-based representation and employs the attack detection and mitigation modules. Furthermore, the Orchestration Layer automates scenario generation, deployment, traffic/attack injection, and experiment management. We validate EDT, respectively, with a case study on Next Generation Application Protocol (NGAP) DoS attack performed through the N2 interface between a gNB and Access and Mobility Function (AMF). Here, we showcase how the EDT framework reduces experimental configuration complexity by 81% in lines of code with minimal resource consumption increase.