This work addresses the problem of detecting patterns of attacks on 4G-LTE network security by relying on the Contrast Sequential Pattern Mining (CSPM) task leveraging the declarative framework of Answer Set Programming (ASP). Pattern mining is widely applied for diferent application in network security; see Buczak et al. [1] for a survey. Whereas sequence mining is extensively explored in network security, the Contrast Sequential Pattern Mining (CSPM) task [2] has not been addressed so far in this application domain to the best of our knowledge. In this extended abstract, we consider the problem of detecting patterns of attacks to 4G-LTE network security relying on the CSPM task. Our approach, fully described in [3], utilizes the declarative framework of Answer Set Programming (ASP) [4], thereby aligning with the research area known as Declarative Pattern Mining (DPM) [5, 6, 7]. In particular, Guyet et al. [5] describes the first proposal of an ASP-based approach to sequence mining and compares it with a dedicated algorithm. Later, Guyet et al. [7] introduce ASP encodings for two representations of embeddings (fill-gaps vs. skip-gaps) in sequence mining. Lisi and Sterlicchio [8] introduced the initial ASP formulation for the CSPM issue, which we will call Mining with Answer Set Solving - Contrast Sequential Patterns (MASS-CSP) from now on. When tackling the DPM challenges related to network security, our work in [3] enhances both the performance and efectiveness of MASS-CSP by incorporating span and gap restrictions during the sequence mining phase. We then perform a comparative evaluation using trace sets from two types of network attack: authentication failure and numb attacks [9]. The paper is organized as follows. In Section 2 and 3 we briefly describe the MASS-CSP approach , and report some evaluation results obtained on sets of traces for the numb attack, respectively. Section 4 concludes the paper with final remarks.
We begin by making a couple of observations regarding the constraints of MASS-CSP. To illustrate, consider the pattern ⟨, ⟩ along with the sequences ⟨, , ⟩ and ⟨, , , ⟩. First, the number of gaps between successive embeddings is not addressed. In other words, within a sequence, two neighboring elements of a sequential pattern may be separated by gaps, which is 0 and 2 in the given example. Secondly, ⟨, ⟩ appears in both sequences but exhibits diferent spans, specifically 1 and 3, respectively. Our study builds on these insights because in many application areas, patterns exhibiting certain properties are more informative.
Many types of constraints on patterns and embeddings for sequence mining are available in the
literature [
As noted by [
CSPM can be particularly useful to 4G-LTE. It does this by analyzing sequences of network events
to identify patterns that help in making better decisions regarding network configurations, resource
allocations, and managing network trafic, all while ensuring that quality of service standards are
met. CSPM can detect abnormal or suspicious network activities, which can signify potential security
threats. By analyzing these patterns, it is s possible to diferentiate between normal and potentially
harmful behaviors. Our emphasis is on security, and finding contrast sequential patterns can reveal
anomalies or irregularities in network activity, aiding in the identification of possible security risks.
These patterns illustrate typical and malicious behavior as reflected in various traces. Our work considers
the authentication failure attack and the numb attack as a case study for which we used the traces made
available by [
< a t t a c h _ r e q u e s t , a u t h e n t i c a t i o n _ r e q u e s t , a u t h e n t i c a t i o n _ r e s p o n s e , security_mode_command , s e c u r i t y _ m o d e _ c o m p l e t e , a t t a c h _ a c c e p t , a t t a c h _ c o m p l e t e , d e t a c h _ r e q u e s t , d e t a c h _ a c c e p t , a t t a c h _ r e q u e s t , a u t h e n t i c a t i o n _ r e q u e s t , a u t h e n t i c a t i o n _ r e s p o n s e , security_mode_command , s e c u r i t y _ m o d e _ c o m p l e t e , a t t a c h _ a c c e p t , a t t a c h _ c o m p l e t e >
The primary aim of the evaluation is to demonstrate the practicality of using a declarative approach
for CSPM within network security. Additionally, the experiments are structured to ofer a comparative
assessment between the original MASS-CSP documented in [
By setting minimum and maximum gap constraints, the process refines and controls the types of patterns generated, ensuring that only relevant patterns are produced. This refinement reduces computational output and enhances eficiency by saving time during the pattern generation phase. However, in terms of memory usage, it is not much variation as the values remain similar or slightly increase. Overall, the gap constraint is highlighted for its performance improvements, particularly in minimizing extraneous patterns and expediting the process without adversely afecting memory usage significantly. By implementing the span constraint, we can decrease the number of patterns and reduce 1https://github.com/CLC-UIowa/SySLite execution time. However, this approach does not lead to any improvements in memory usage and may actually require more storage space. In contrast, using the gap constraint ofers the greatest benefits, significantly enhancing overall performance.
(a)
This research investigates the detection of attack patterns of the 4G LTE network security, focusing on attacks like authentication failure and the numb attack. We leverage Contrast Sequential Pattern Mining (CSPM) implemented using Answer Set Programming (ASP) to analyze 4G LTE network trafic behavior. This method allows us to identify sequential patterns that diferentiate between normal and attack-related network behavior. The resulting patterns are valuable for understanding attack progression and creating efective countermeasures.
The research demonstrates that using a declarative method for detecting network security attacks is possible. By incorporating specific constraints — namely span and gap constraints — the system becomes more eficient by reducing the number of patterns it needs to process. This leads to lower memory usage and faster execution times. Additionally, because the approach is based solely on analyzing execution traces, it is highly adaptable and can be applied to various types of attacks across diferent network systems, including advanced technologies like 5G. This versatility ensures that the method remains relevant and efective as network technologies evolve.
This work was partially supported by the project FAIR - Future AI Research (PE00000013), under the NRRP MUR program funded by the NextGenerationEU.