X-Mind: A XGBoost-Based Multi-Classification Detector for NAS Attacks in Cellular Networks

With the evolution of cellular radio access networks, new threat paradigms such as spoofing and denial of service have been introduced by attackers exploiting protocol vulnerabilities prior to the establishment of a security context, targeting NonAccess Stratum (NAS) messages. The NAS protocol covers critical controls such as user authentication and mobility management, and thus NAS attack detection is essential to ensure cellular network security and reliability is crucial. In this paper, we propose an improved Extreme Gradient Boosting Tree (XGBoost) -based Multi-class NAS attack detection framework-X-MIND, which can efficiently deal with the feature representations of NAS message sequences and internal fields, and solve the problems of class imbalance and overfitting risk. The 16 -class NAS attack patterns are constructed based on public data and laboratory environment, and the X-MIND framework trained on this dataset realizes highprecision recognition of attacks with an accuracy of 94%.