5G Core Behavioral Profiling: AMF, SMF, UPF Monitoring

The New Frontier: 5G Core Behavioral Profiling

As 5G networks roll out globally, the core network—comprising the Access and Mobility Management Function (AMF), Session Management Function (SMF), and User Plane Function (UPF)—becomes the backbone of critical infrastructure. However, the very flexibility that makes 5G powerful also makes it vulnerable. Attackers no longer need to brute-force firewalls; they can exploit subtle deviations in signaling behavior to launch zero-day attacks. 5G core behavioral profiling offers a proactive defense by establishing baselines for each network function and detecting anomalies in real time.

The 5G core’s service-based architecture (SBA) uses HTTP/2 for control-plane communication, while the user plane relies on GTP-U tunnels. This dual-plane design means that anomalies can manifest in signaling frequency, session establishment patterns, or data throughput. For enterprise security teams, understanding these behavioral baselines is the first step toward zero-day detection.

Why AMF, SMF, and UPF Matter for Security

Each core network function has a distinct role:

• AMF: Handles registration, mobility, and reachability. It’s the first point of contact for UE (User Equipment).
• SMF: Manages session establishment, modification, and termination. It controls PDU sessions.
• UPF: Forwards user-plane traffic, applying QoS and charging rules.

Anomalies in AMF behavior might indicate SIM-swapping attacks or rogue devices. SMF anomalies could signal session hijacking or resource exhaustion. UPF anomalies often point to data exfiltration or DDoS amplification. Behavioral profiling across all three provides a holistic view.

Building Behavioral Baselines for 5G Core

To detect anomalies, we first need baselines. A baseline is a statistical model of normal behavior over time. For 5G core components, we consider:

• Message frequency: How often does a specific AMF receive registration requests from a given cell?
• Session duration: What’s the typical lifespan of a PDU session managed by an SMF?
• Throughput patterns: What’s the average data rate through a UPF for a given slice?

These baselines can be built using time-series analysis. For example, using a rolling window of 24 hours, we can compute mean and standard deviation for message counts. Here’s a simplified pseudo-code for AMF registration request monitoring:

# Pseudo-code: AMF baseline monitor
import numpy as np

class AMFBehavioralProfile:
    def __init__(self, window_size=24*60):
        self.window = deque(maxlen=window_size)
        self.mean = 0
        self.std = 0

    def update(self, request_count):
        self.window.append(request_count)
        if len(self.window) > 100:
            self.mean = np.mean(self.window)
            self.std = np.std(self.window)

    def is_anomalous(self, current_count):
        if self.std == 0:
            return False
        z_score = (current_count - self.mean) / self.std
        return abs(z_score) > 3  # threshold

This simple approach works for known patterns, but zero-day attacks often mimic normal behavior with subtle shifts. That’s where machine learning comes in.

Signaling-Plane Anomaly Detection at Scale

The signaling plane (N1/N2/N4 interfaces) is where most 5G core attacks begin. For example, an attacker might send malformed N2 messages to the AMF to trigger a buffer overflow. Or they might rapidly create and delete PDU sessions to exhaust SMF resources. Behavioral profiling must handle high throughput—millions of signaling messages per second in a large network.

We can use a combination of rule-based and ML-based detection. Rules catch known patterns (e.g., too many deregistration requests), while ML models detect novel anomalies. For instance, an autoencoder trained on SMF session establishment sequences can flag unusual sequences that don’t match training data. Here’s a sample approach for UPF throughput anomaly detection using a rolling window:

# Pseudo-code: UPF throughput anomaly
import pandas as pd

def detect_upf_anomaly(upf_data, window='5T'):
    """
    upf_data: DataFrame with columns ['timestamp', 'bytes_sent', 'bytes_received']
    window: rolling window size (e.g., '5T' for 5 minutes)
    """
    df = upf_data.set_index('timestamp').resample(window).sum()
    df['rolling_mean'] = df['bytes_sent'].rolling(24).mean()
    df['rolling_std'] = df['bytes_sent'].rolling(24).std()
    df['anomaly'] = (df['bytes_sent'] > (df['rolling_mean'] + 3*df['rolling_std'])) | \
                    (df['bytes_sent'] < (df['rolling_mean'] - 3*df['rolling_std']))
    return df[df['anomaly']]

For real-world deployment, we need to correlate anomalies across AMF, SMF, and UPF. A single UPF throughput spike might be legitimate, but if it coincides with an AMF registration surge from a new cell tower, it could indicate a coordinated attack.

Ethereon’s Approach: AI-Native Zero-Day Detection

At CyberNytronX SMC-Private Limited, we built Ethereon to solve this exact problem. Ethereon ingests telemetry from 5G core network functions via standard interfaces (e.g., 3GPP N32, N4). It uses unsupervised learning to build behavioral profiles for each AMF, SMF, and UPF instance. The platform doesn’t rely on signatures—it learns what’s normal for your specific network.

Ethereon’s architecture includes:

• Data pipeline: Kafka-based ingestion of signaling and user-plane logs.
• Feature extraction: Real-time computation of features like message inter-arrival times, session duration distribution, and GTP-U tunnel count.
• Anomaly detection engine: Ensemble of models (Isolation Forest, LSTM autoencoders) that flag deviations.
• Correlation layer: Maps anomalies to MITRE ATT&CK for 5G (a community framework) to prioritize incidents.

For example, during a recent test with a tier-1 operator, Ethereon detected a zero-day attack where an attacker used a fake UE to send malformed N2 messages to the AMF. Traditional IDS missed it because the message structure was valid. But the AMF’s behavioral profile showed an abnormal spike in processing time—a 300% increase—which Ethereon flagged within 2 seconds.

Key Takeaways for 5G Security Teams

Behavioral profiling is not optional for 5G core security. Here are actionable steps:

• Start with baselines: Collect at least 7 days of normal traffic for each network function. Use tools like Prometheus to store metrics.
• Focus on signaling: The N2 and N4 interfaces are high-risk. Monitor for unusual message sequences.
• Correlate across functions: An isolated AMF anomaly might be benign, but combined with SMF session failures, it could be a breach.
• Invest in AI-native detection: Rule-based systems fail against zero-day. Use unsupervised learning to adapt to new threats.
• Test with real data: Simulate attacks in a lab environment using tools like 5Greplay to validate your models.

The 5G core is the nervous system of modern connectivity. By profiling AMF, SMF, and UPF behavior, security teams can detect the earliest signs of compromise—before damage spreads. Ethereon by CyberNytronX SMC-Private Limited provides the AI-native platform to make this practical at scale.

For a deeper dive, explore our research on 5G security at ethereon.io.