5GC Inspector

A research platform for collecting, analysing, and learning from operational data in a 5G core network. Built on top of Open5GS and OCUDU, the project captures per-UE logs and metrics across 38 controlled scenarios and uses them to train models capable of reconstructing network procedures and detecting anomalies.

Repository Structure

5gCore-Inspector/
├── data/
│   └── raw/                      # Raw log captures, one folder per scenario
│       ├── scenario_01/          # Initial Registration
│       ├── scenario_02/          # Authentication Failure
│       │   ...
│       └── scenario_38/          # Connect and Disconnect Loop
└── README.md

Scenarios

Each scenario folder contains a README.md with: description, NFs involved, procedure flow, metrics to capture, log sources, expected outcome, and ML labels.

Normal — Control Plane

#	Scenario	Key NFs	Label
01	Initial Registration	AMF, AUSF, UDM, NRF	normal
02	Authentication Failure	AMF, AUSF, UDM	anomalous
03	Registration Retry	AMF, AUSF, UDM	anomalous
04	Deregistration	AMF, SMF, UPF, PCF	normal

Normal — Sessions

#	Scenario	Key NFs	Label
05	PDU Session Establishment	AMF, SMF, UPF, PCF	normal
06	PDU Session Release	AMF, SMF, UPF, PCF	normal
07	Multiple PDU Sessions	AMF, SMF, UPF, PCF	normal

Normal — Mobility and State

#	Scenario	Key NFs	Label
08	Idle Mode	AMF, UPF	normal
09	Paging	AMF, SMF, UPF	normal
10	Service Request	AMF, SMF, UPF	normal
11	UE Mobility (Handover)	AMF, SMF, UPF	normal
12	Tracking Area Update	AMF, UDM, NRF	normal
13	Network Slice Selection	AMF, NSSF, NRF	normal
14	QoS Flow Creation	SMF, UPF, PCF, AMF	normal
15	UE Detach During Active Session	AMF, SMF, UPF	anomalous

Traffic

#	Scenario	Protocol	Label
16	Web Browsing	HTTP/HTTPS (TCP)	normal
17	Video Streaming	TCP / QUIC	normal
18	File Download	TCP	normal
19	Continuous Ping	ICMP	normal
20	UDP Traffic	UDP	normal
21	TCP Throughput Test	TCP	normal

Scalability

#	Scenario	Scale	Label
22	Multiple UEs Register Simultaneously	10 / 50 / 100 / 500 / 1000 UEs	normal → stress
23	Massive PDU Session Creation	Up to 500 concurrent sessions	normal → stress
24	High Traffic Load	All UEs transmit simultaneously	normal → stress

Failure and Resilience

#	Scenario	Component	Label
25	AMF Restart	AMF	anomalous
26	SMF Restart	SMF	anomalous
27	UPF Restart	UPF	anomalous
28	NRF Restart	NRF	anomalous
29	Database Failure	UDR / MongoDB	anomalous

Security

#	Scenario	Attack Type	Label
30	Rogue UE	Unauthorised device	anomalous
31	IMSI/SUCI Related Tests	Identity protection	normal / anomalous
32	Registration Flood	Signalling DoS	anomalous
33	Invalid NAS Messages	Protocol fuzzing	anomalous
34	Invalid GTP Messages	User plane fuzzing	anomalous
35	DoS Against the Core	Resource exhaustion	anomalous

Long Duration

#	Scenario	Duration	Label
36	24-Hour Connected UE	24 hours	normal
37	Continuous Traffic	4–8 hours	normal
38	Connect and Disconnect Loop	1000 cycles	normal

Data Collection

Each scenario produces raw log files captured from Open5GS network functions:

Log File	Network Function	What It Contains
amf.log	Access and Mobility Management	Registration, authentication, mobility events
smf.log	Session Management	PDU session lifecycle, IP allocation
ausf.log	Authentication Server	Auth vectors, 5G-AKA/EAP-AKA' results
udm.log	Unified Data Management	Subscriber lookups, location updates
upf.log	User Plane Function	GTP-U tunnel events, PFCP sessions
pcf.log	Policy Control	QoS rules, PCC policy decisions
nrf.log	Network Repository	NF registration, service discovery