{'fraction_non_alphanumeric': 0.0340332697027543, 'fraction_numerical': 0.012844286883010635, 'mean_word_length': 4.898504101656748, 'pattern_counts': {'":': 0, '<': 0, '<?xml version=': 0, '>': 0, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 3, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
A Triangular Fuzzy based Multicriteria Decision Making Approach for Assessing Security Risks in 5G Networks

The emerging 5G network is a new global wireless standard after 1G, 2G, 3G, and 4G networks. In comparison to 4G, it has lower latency, larger capacity, and more bandwidth. These network upgrades will have a profound impact on how people throughout the world live and work. The current research investigates mechanisms to protect the 5G networks to meet resilience requirements and to minimize the damage from attacks that do occur. The main contribution of this paper includes: (1) Improving the current 5G security testbed by orchestrating the security services using the OSM and Open stack, Integrating the FlexRan with the testbed components to control and manage the eNodeB, and implementing some real-time security experiments to test and validate the testbed. (2) Develop an intelligent fuzzy method to improve the accuracy of the current Vulnerability Assessment Approach (VAA) using a new approach that integrates the Triangular Fuzzy Numbers (TFNs) and a multi-criteria decision-making technique to find the attack graph paths where the attack most probably will propagate in the 5G network.


INTRODUCTION
5G has the potential to make the world much more connected. It enables a new kind of network that is designed to connect virtually everything and to expand the scope of mobile technology beyond the capabilities of LTE. Devices in locations without access to traditional broadband networks can be deployed using 5G network connectivity. 5G offers higher speeds, lower latency, and increased capacity that make it a potential option for devices where 4G LTE was not a viable option. However, with this growth in systems connected to 5G networks, the 5G network is a potential target for security attacks.
The DoD's 5G strategy implementation plan [1] provides a roadmap for addressing the 5G technology and security aspects. This strategy introduced four recommendations for developing a threat intelligent model that studies the 5G threats and vulnerabilities. Among these recommendations (1) developing techniques to identify, track, and mitigate threats and vulnerabilities that arise from different choices, configurations, and combinations of network equipment, software components, and deployment environments. (2) demonstrating how vulnerabilities in underlying hardware could be exploited by an adversary to impact 5G-enabled capabilities and operations. In the light of these recommendations, a new security method is needed to react to 5G network changes in real-time.
To the best of our knowledge, a few works introduce a real-time security solution that specifically works for 5G networks and considers these networks' real-time scalability and dynamic features due to the lack of publicly available 5G security testbeds, datasets, and attack graphs. This paper contributes towards: 1) Improving the current 5G security testbed by (a) orchestrating the security services using the OSM and Open stack. We develop a security deployment model that deploys the intrusion detection agents at the edge of the network and connects them to a central management system. The testbed leverages various open-source projects and tools that are used in deploying 5G networks and cybersecurity systems such as OpenStack, Kubernetes, OSSIM, SNORT, and OSSEC. The testbed is flexible to accommodate different aspects of the security analysis from SDN, NFV, intrusion detection to malware analysis. It also includes a programmable traffic generator that can be used to generate real-world traffic load. (b)Integrating the FlexRan with the testbed components to control and manage the eNodeB resources, and (c) run some real-time security experiments to test and validate the testbed. The improved security testbed enables a multi-tenancy for the deployment of virtualized end-to-end network slices. It also allows researchers to conduct various security analyses, compare the accuracy of different machine learning approaches and defense mechanisms, and execute a simulated cyberattack. 2) Improve the accuracy of our original VAA [2]. The original VAA uses the TOPSIS (Technique for Order of Preference by Similarity to Ideal Solution) [3,4] as a multi-criteria decision making technique to find the attack graph path with the lowest attacker costs. This path indicates where the attack most probably will propagate. The improved approach (FuzVAA) integrates the original VAA with the Triangular Fuzzy Numbers (TFNs). The reason for integrating the TOPSIS with the TFNs is that the classical TOPSIS alone is found to have some vagueness and is not sufficient to arrive at a solution because of its higher dimensionality particularly when we used it with a large scale 5G network with a large number of UEs. The accuracy, scalability, and performance of the FuzVAA technique are tested and evaluated using the improved 5G security testbed.

DISCUSSION OF PROBLEM
The extensive use of machine learning and game-theoretic approaches in the military sector has changed the face of the battlefield and the nature of war. To the best of our knowledge, none of the current work introduces a real-time holistic framework that specifically works for 5G core networks and integrates the vulnerability analysis, risk assessment, and mitigation in the 5G systems. This is due to the lack of publicly available real-time 5G testbeds, datasets, and attack graphs.
Most of the current state of the art [15][16][17][18][19][20] focus on either the SDN or NFV security and do not consider the 5G core challenges such as (1) performance monitoring, (2) scalability, (3) orchestration and management, and (4) heterogeneous network support and integration of the SDN, NFV, and edge computing. Few works study the vulnerability analysis and risk assessment in 5G Networks. However, they are still at an early stage. Current traditional risk assessment and vulnerability analysis approaches that are based on ISO/IEC 2700 series [21] and NIST-SP800 [22] do not take into account the 5G core design principles. In [23], the authors introduced an intrusion prevention system that employed five layers of 5G systems to detect the flow table overloading attack. However, this work is more specific to a particular attack category and does not consider the rest of the 5G attack vectors. Furthermore, it lacks the vulnerability analysis of the 5G core components. In [24-38, 48, 49], we introduced a security framework that detects attacks in cloud-based systems. This framework integrates behavior-based and signature-based systems and uses machine learning and artificial intelligence techniques to develop self-defensive techniques for cloud systems.
Based on this survey, none of the current approaches considers the evaluation of the security risk for the underlying resources that the slices use nor offers a dynamic allocation scheme to re-allocate previously allocated slices to make more efficient use of available resources (or newly added resources).
In [2] we developed the VAA that dynamically assesses and analyzes the vulnerabilities in the 5G networks using the TOPSIS. Experiments that were recently conducted on large scale 5G testbed proved that the TOPSIS has some vagueness and is not sufficient to arrive at a solution because of its higher dimensionality that negatively impacts its accuracy and performance.
The use of ranking fuzzy numbers in soft computing plays an important role in converting the classical decision-making problem into a fuzzy decision-making one; therefore, improving the final efficiency and performance of the ranking of the decision alternatives. Section 3.2 discusses the new FuzVAA that integrates the ranking fuzzy numbers and the classical TOPSIS to address the vagueness issues of the classical TOPSIS.
An efficient security framework that works for the 5G core networks should address the following top security challenges that service providers need to tackle to make 5G services a successful business [44,45]: 1) Network slicing and virtualization bring new risks. Service providers need to consider how well the virtualization layers and network slices are isolated from each other. 2) Heterogeneity and complexity of a variant infrastructure that the 5G system includes.

3) Automated threat detection and mitigation. For previous generations, manual interventions
for mitigating threats may be fine. But with 5G now and the fact that the threat landscape continues to grow in volume, velocity, and sophistication particularly for the 5G core network, manual operations are not enough. 4) The coexistence of 4G and 5G requires scalable and higher performance security. 5G will evolve side by side with 4G. The increase in bandwidth from 4G eNodeB to 5G gNodeB will cause significant increases in performance and scale requirements that the current security infrastructure may not be able to handle. 5) Distributed edge clouds open up new attack surfaces. In the 5G architecture, IP connectivity will terminate at the edge of the operator if proper security mechanisms such as encryption and firewalls are not in place. 6) Threats to the availability and integrity of networks will become major security concerns: in addition to confidentiality and privacy threats, with 5G networks expected to become the backbone of many critical IT applications, the integrity, and availability of those networks will become major national security concerns.

The Security Testbed
In this section and following subsections, we highlight the security testbed, explain how the network slicing is implemented in the testbed using the Network Function Virtualization (NFV) features, discuss our security deployment model and the orchestrated security services, introduce the threat model and attack scenarios that are used in the experiments, and discuss a cybersecurity use case to validate the Testbed.
Our testbed leverages various open-source projects and tools that are used in deploying 5G networks and cybersecurity systems such as OpenStack [5], Open-Source MANO (OSM) [6], Open5GS [7], FlexRAN (Mosaic5G) [8], OSSIM [9], SNORT [10], and OSSEC [11]. The improved security testbed accommodates different aspects of the security analysis from SDN, NFV, intrusion detection to malware analysis, and the Radio Access Network (RAN). The 5G security testbed allows researchers to (1) conduct various security analyses, (2) build security datasets and 5G based attack graphs, (3) benchmark and compare the accuracy and performance of different machine learning approaches and defense mechanisms, and (4) execute simulated cyberattacks. The testbed aims to provide the following capabilities: (1) a programmable traffic generator that can be used to generate real-world traffic load.
(2) multi-vendor implementation by abstracting the underlying platforms and enabling the configuration of different vendor-specific platforms. (3) monitoring and management of both the access and core network resources. Fig. 1 shows a high-level overview of our 5G network security testbed where SDN and NFV are the foundation of the architecture. Our testbed uses OpenStack, Open-Source MANO (OSM), and Open5GS to deploy 5G core services and the service-based architecture. It also includes FlexRAN for the SDN-RAN controller and OAI eNB for achieving end-to-end network slicing. We briefly list the components of the 5G core testbed as depicted in Fig. 1.: Fig. 1 shows a high-level overview of our 5G network security testbed where SDN and NFV are the foundation of the architecture. Our testbed uses OpenStack, Open-Source MANO (OSM), and Open5GS to deploy 5G core services and the service-based architecture. It also includes FlexRAN for the SDN-RAN controller and OAI eNB for achieving end-to-end network slicing. We briefly list the components of the 5G core testbed as depicted in Fig. 1.: • OpenStack is an open-source hypervisor platform that uses pooled physical and virtual resources to deliver Infrastructure-as-a-service (IaaS). It supports cloud computing and OpenFlow to manage the orchestration of virtual and physical network devices, support the virtualization and control layers in the middle.

• The Open-Source Network Function Virtualization Management and Orchestration
(OSM) handles the management and orchestration of NFV layers. OSM enables the creation of network services with programmatic ease. It has two principal elements for building a network service: (1) VNF packages, which represent virtual network functions, and (2) NS packages, representing network services. Once a network service is modeled and defined, OSM can spin up and deploy an instance to one or more hypervisor platforms, such as OpenStack in our case, see Fig. 2.
• Open5GS integrates with 5G New Radio Stand-Alone (SA) base stations and user equipment enabling immediate demonstration of different features and applications and supporting the current need to have a flexible 5G Core Network in addition to the evolved EPC one (used for LTE and 5G NSA).
• FlexRan platform is made up of two main components: the FlexRAN Control Plane and FlexRAN Agent API. The FlexRAN, see Fig. 1. control plane follows a hierarchical design and is in turn composed of a Master Controller that is connected to several FlexRAN Agents, one for each base station (eNodeB in 4G LTE). The control and data plane separation are provided by the FlexRAN Agent API which acts as the southbound API with FlexRAN control plane on one side and eNodeB data plane on the other side. The FlexRAN protocol facilitates the communication between the master controller and the agents.

• Testbed Visibility
Network visibility is a granular awareness of all traffic and user activities on the network, driving observability and helping identify possible bad actors and malicious activity. Our testbed employs common observability strategies in the monitoring of distributed systems. Structured logging of packet and data flows, servers, services, and user equipment are all carried out with open-source monitoring and intrusion detection technology such as the Snort application, a Mobile Agent Intrusion Detection System (MA-IDS), Open source HIDS Security (OSSEC), and Open-Source Security Information Management (OSSIM).

• Programmable Traffic Generators
Our user equipment portion of the testbed contains a virtual cluster of mobile device images that run the Android system (BlueStack and Android Studio). This cluster is capable of spinning up virtual mobile devices to produce real-time load on the system. The virtualization hosts and guests run on a base image of Ubuntu Server 20.04 LTS and Windows 10 enabling users to programmatically script both attack and response scenarios in almost any Linux and Windows compatible programming language.

Network Slicing and Network Function Virtualization
To understand the proposed security deployment model, we highlight two main concepts, the Network Function Virtualization, and network slicing.
The NFV MANO covers the orchestration and lifecycle management of physical and/or software resources that support the infrastructure virtualization, and the lifecycle management of VNFs. NFV Management and Orchestration focus on all virtualization-specific management tasks necessary in the NFV framework. Network Function Virtualization leverages high-performance computing and enterprise virtualized environments to divorce network functions from the substrate hardware and implement those functions via software that runs on commercial off-the-shelf high-volume servers, storage, and switches. These are known as Virtual Network Functions (VNF). The architecture underpinning NFV MANO, shown in Figure

The Security Deployment Model
The proposed testbed uses OSM and OpenStack to deploy 5G service-based architecture. This different subset of the system can be focused to perform targeted security analysis. Fig.3 depicts our security deployment model. From the top, the network slices that service enhanced Mobile Broadband (eMBB) phones, tablets, and other user equipment (UE) will contain OSSEC Agents deployed as NVF / NS, and the UE will have MA-IDS installed. The massive Machine Type Communications (mMTC) that services IoT devices, which are less likely to have security or agent software, will also have OSSEC Agent deployed to its slices.
All OSSEC agents talk back through the radios using FlexRAN to the OSSEC server to analyze and make decisions about the severity of OSSEC alerts. The alerts fired by the OSSEC server, MA-IDS Agents, and any alerts from the adjacent SNORT that is sniffing the bidirectional traffic as it is passed to and from slices, and any risk assessments from OSSIM agents are forwarded to the OSSIM server at the CORE to normalize, correlate, and analyze them to compute the overall risk in the 5G testbed. OSSIM server is dedicated to processing security events and providing command and control back up the stack from CORE, to COMPUTE, to EDGE, and through UE, using OSM to orchestrate dynamic changes. At present, the stack is contained in the bottom system ("model3") in our testbed and it functions as CORE + COMPUTE + EDGE.

Threat Modeling and Attack Scenarios
SDN and NFV bring a lot of benefits that are crucial in realizing the 5G network but they also bring a lot of security risks. Some of the risks might include vulnerable software on VNF, DoS attack on MANO, hypervisor hijacking, exploiting SDN controller, etc. There are many variants of threats to 5G infrastructure, but they can be organized according to impact into three, broad categories:  Denial of Service: Attacks that cause service outages through either virtual or physical means. Examples include hardware vandalism, radio signal jamming, and traffic flooding.  Access Breach: Attacks that lead to unauthorized system access, manipulation, or a data breach. Examples include malicious changes to system configurations, exploiting software vulnerabilities, communications hijacking, and disclosure of sensitive data.  Integrity Compromise: Attacks that impact infrastructure integrity through hardware, software, communications, or operational tampering. Examples include implanting malicious hardware components in system devices, altering operating system code, modifying data, and circumventing organizational security policies.
Besides the abovementioned threats, there are three additional attack schemes (I, S, P) enabled by the integration of Mobile Edge Computing (MEC) and 5G networks that we focus on in our study, see Fig. 4, namely: (1) Insecure mobile backhaul network. Data exchanged between MEC nodes often traverse insecure shared backhaul that is vulnerable to MITM attacks, including eavesdropping and spoofing. Such attacks can also come from edge nodes connected to the public internet through the edge Firewall Interfaces (e.g., SGi/N6). (2) Shared infrastructure with third-party applications. MEC nodes can be opened to allow authorized participants to deploy applications/services to other users. However, poorly designed applications can create opportunities for attackers to invade the system and pose threats to the network applications running on the platform. (3) Privacy Leakage Illegitimate access to the Multi-access MEC system. In this case, an attacker can compromise the service infrastructure and the network hampering information privacy. An attacker's ability to access the information stored at the edge system's upper layers poses a serious concern for privacy leakage.

The FuzVAA
In the following three subsections, we introduce some preliminaries about the triangular fuzzy numbers then we highlight the previously developed VAA, finally we introduce the new FuzVAA approach.

Preliminaries
In this section, we will cover some basic definitions and preliminaries about the triangular fuzzy numbers that are used by the FuzVAA.

Definition 1:
A fuzzy number is a generalization of a regular, real number in the sense that it does not refer to one single value but rather to a connected set of possible values, where each possible value has its own weight between 0 and 1. This weight is called the membership function ( A ).

Definition 2:
A fuzzy number is a convex normalized fuzzy set of the real line R whose membership function is piecewise continuous.

The Original VAA.
Our original VAA [2] develops (1) a scalable attack Graph Generator (GG) model. (2) A new dynamic Vulnerability Analysis (VA) model that hierarchically analyzes the generated attack graphs using the TOPSIS [3,4] to model the multiple criteria decision-making problem in the 5G core dynamic environment. TOPSIS is based on the concept that the chosen alternative should have the shortest geometric distance from the positive ideal solution and the longest geometric distance from the negative ideal solution. Ideal solutions in the current context refer to the lowest attacker cost of actions that denotes the lowest attacker efforts to exploit a certain vulnerability. E.g., in Fig. 6, if the computed TOPSIS cost of exploitation of CVE2004-0417 is lower than CVE2002-0392 and CVE2004-0415, this means if the attacker started exploiting CVE2004-0417 rather than the other vulnerabilities this will be considered a positive ideal solution. The following steps summarize the VA approach. Step 1: Develop a scalable attack Graph Generator (GG) model. This model is based on the security attack vector that focuses on the attacks and threats that may harvest intelligence from the 5G network resources, states, and flows as a result of the integration of the NFV and SDN. The basic idea underlying this model is that the attacker action cost is under the constraint of certain vulnerability and network dynamic factors/indicators of the 5G network such as latency, accessibility, and other factors described in [39]. The vulnerability factors refer to the Common Vulnerability Scoring System (CVSS) factors/indicators namely Base, Temporal, and Environmental. Each of these factors is a composite of other several factors described in [40]. We model this problem as a multi-objective decision-making problem as follows.
(1) Create the GG three-layer hierarchical model based on the vulnerability and dynamic network factors, see Fig. 7. The attack graph is modeled based on these factors. An attack graph is defined as a tuple G = ( A, S, T), where A is a set of attack actions, S is a set of system states, T is a set of targets that the attacker tries to achieve. An attack graph GG consists of a set of nodes of four types, see Fig.  7: (1) attack-step nodes (circular-shaped AND-nodes). Each node in this set represents a single attack step that can be carried out when all the predecessors (preconditions to the attack which are either configuration settings or network privileges) are satisfied. (2) Privilege nodes (diamond-shaped nodes). Each node in this set represents a single network privilege. The privilege can be achieved through any one of its predecessor AND node which represents an attack step leading to the privilege. Each node in this set represents a fact about the current network configuration that contributes to one or more attack possibilities (subaction). (3) Configuration nodes (circular-shaped). Each node in this set represents an initial vulnerability, configuration settings, or network privileges that are known to be true and have no variance in probability. (4) Final step nodes (rectangular-shaped). Each node in this set represents a final exploit action against a certain vulnerability.
(2) Construct a pair-wise evaluation matrix M, see Fig. 8, based on the attack graph. After that, we compute the combinatorial weights (W i ) which refer to the weight of the impact of each layer's dynamic factors, in the GG three-layer model, on the attacker decision as given in Eq.1.
Where i is the GG hierarchical layer index ∈ {1,2,3}, j refers to the dynamic factors, and W L is the criteria layer combinational weight vector which is computed as given in Eq.2. W L = M*W (2) Where, W is the relevant normalized characteristic vector/eigenvector = * W, for all w = (w 1 , w 2 , w 3 ,….w n ).
is the largest eigenvalue of matrix M.
Step2: Develop the new dynamic Vulnerability Analysis (VA) model. To compute the attack cost of actions, we will apply the TOPSIS approach as follows.
Let's define the benefit criteria as B and the cost criteria as C. The value of E+ and E-can be calculated using Eq. 6 and 7 respectively.
(3) Calculate the cost of the attacker's actions. We use the L2-distance defined by the TOPSIS approach to calculate L2 i + , the distance between the target alternative i and the best condition E + as given in Eq. 8, and L2 i -, the distance between the target alternative i and the worst condition Eas given in Eq. 9.  Fig. 7, we give a simple demonstration for the decision matrix of attacker actions compared to the network indicators (the network components where the attacker may start its exploitation), see Table. 1. The full case study of this example is detailed in [2]. The computed attack graphs, actions, and the costs of these actions can be used by an intrusion response system to model the security reciprocal interaction between it and the attacker and can help in deploying the best countermeasures to mitigate the attacks in the 5G core networks.

The FuzVAA: the Hybrid TFN and TOPSIS Approach
The new proposed hybrid approach integrates the TOPSIS with the TFN. This approach uses the same attack Graph Generator (GG) and the three-layer hierarchical model that is based on the vulnerability and dynamic network factors described in Section 3.2.2. In the following, we describe the steps of the proposed approach.

Step1: Construct the fuzzy decision matrix M and Compute the Aggregated Fuzzy Ratings.
Let's say the decision pool has N members. If the fuzzy rating and importance weight of the N th decision maker (attacker decision) about the i th alternative on the j th criterion (the weight of the criterion refers to the weight of the impact of each layer's dynamic factors, in the GG three-layer  Fig. 7, on the attacker action/decision) are ~= ( ~,~,~, )and ~= ( ′ , ′ , ′ ) respectively, where i= 1, 2, 3, …………..,m and j= 1, 2, 3,………..,n then aggregated Fuzzy ratings x~i j of alternative i with respect to each criteria j are given by x~i j = (a ij , b ij , c ij ) where: In the same way, the aggregated Fuzzy weights of each criterion are calculated as w~j= ( ′ , ′ , ′ ) such that: The fuzzy decision matrix has each entry of the TFN as given below: Where ~ = ( 1,1 , 1,2 , … . 1, , 2,1 , ,1 , ,2 ……, x mn ), i= 1, 2, 3,..., m; j = 1, 2, 3,..., n, represents the number of alternatives attack actions and decision criteria, respectively and ~a nd ~a re triangular Fuzzy numbers representing linguistic variables.
Step2: Construct the normalized decision matrix M~ using M entries. Unlike the classical TOPSIS method described in Section 3.2.2, which uses the (the largest eigenvalue of matrix M) to compute the weight of the criterion, we use the linear scale transformation to simplify the transformation of various criteria scales into a comparable scale. Normalized fuzzy weights make it possible to model mathematically an uncertain division of a unit into n fractions. The normalized fuzzy weights preserve the property that the ranges of normalized triangular fuzzy numbers belong to (0, 1). Fig. 9 illustrates an example of normalized fuzzy weights that uses a linguistic scale that is depicted in Table 2. Each criterion and alternative are evaluated by the triangular numbers according to this linguistic scale. Where, The benefit criteria from the attacker perspective include high exploitability, high latency, low speed… etc. The cost criteria include long exploit time, low latency, low speed… etc.
The weighted normalized fuzzy decision matrix M w~ is computed by multiplying the weights (~) of evaluation criteria with the normalized fuzzy decision matrix F˜i j as given in Eq. 16. Step4: Determine the distance measures to ideal solutions, since the E˜+ and E˜-are still TFN, we calculate D i + , the distance between the target alternative i ( , )and the best condition in E˜+ from the attacker perspective as given in Eq. 20, and D i -, the distance between the target alternative i( , ) and the worst condition in E˜as given in Eq. 21.
And the similarity to the best condition as the benefit of the attacker's actions (Atcbenefit) as shown in Eq. 23.
Where i ∈ {1,2…,m} is the actions the attacker can choose from m possible actions.

RESULTS
To evaluate the new FuzVAA, we use the same 3GPP architecture that is deployed in our testbed, see Fig. 10, which we used to evaluate the original VAA with the same generated attack graph so that we can compare the two approaches to each other. This architecture is based on the concepts of control and user planes split, service base architecture, and network slicing. Their main network functionalities are the Network Slice Selection Function (NSSF), the Authentication Server Function (AUSF), the Unified Data Management (UDM), the Access and Mobility Management Function (AMF), the Session Management Function (SMF), the Policy Control Function (PCF), the Application Function (AF), the User Equipment (UE), the Radio Access Network (RAN), the User Plane Function (UPF), and the Data Network (DN). A two-level SDN controllers hierarchy bridges between the functions of the control and user planes, specifically, between the SMFs and the UPFs. The 5G core NFs are implemented as VNFs in an NFVI in which the SDN Controllers are virtualized and implemented. Fig. 11 shows the exploited assets in this case study. Using the Metasploit framework [43], we run some exploits based on the 5G core attack vector. These exploits target 6 vulnerabilities in the testbed namely, the CVE-2019-15083 ( allows for an XSS injection that leads to control what software is installed on the admin workstation), CVE-2013-0375(allows for remote injection of SQL code that leads to bypassing the AUSF), CVE-2019-16026 (leads to a denial of service (DoS) condition on the AMF), CVE-2004-0415 (allows for illegitimate access to portions of kernel memory that leads to illegitimate access to the SDN), CVE-2002-0392 (allows for remote execution of DoS attack that leads to disruption for the NFVI functionalities), CVE-2004-0417 (allows for an integer overflow in the CVS Apps that leads to illegitimate access to the RAN). Fig. 12 shows the attack graph that was created using the approach described in Section 3.2.2. The main target of the attacker is to access and control the RAN module using the aforementioned vulnerabilities that belong to the three attack categories described in section 3.1.3 (i.e., I, S, P).  Tables 3 shows an example of part of the linguistic rating variables matrix of the 5G criteria layer (for simplicity we show only 4 criterion of the CVE and the 5G dynamic factors) and the indicator layer (i.e, attacker actions, for simplicity we show only 4 actions). We set these linguistic rating variables based in the importance of the criteria and their impact on the attacker decision in the light of the information provided by the Common Vulnerability Scoring System (CVSS) described in [39] and the 5G dynamic factors described in [40].  Table 4 depicts the symmetric triangular fuzzy numbers that was calculated using table 2 and 3.   for each possible attacker  actions, see table 6. We then choose the lowest attacker efforts in the three attacking schemes (i.e., I, S, P). The underlying idea behind the VEA-bility metric [41] is that the security of a network is influenced by many factors, including the severity of existing vulnerabilities, distribution of services, connectivity of hosts, and possible attack paths. These factors are modeled into three network dimensions: Vulnerability, Exploitability, and Attackability. The overall VEA-bility score, a numeric value in the range [0,10], is a function of these three dimensions, where a lower value implies better security. The VEA-bility metric uses data from three sources: the 5G core testbed topology, attack graphs, and scores as assigned by the Common Vulnerability Scoring System (CVSS) [40]. To adjust the VEA-bility metric to validate the accuracy of the vulnerability assessment of the VAA and Nessus [42], we modify this metric by replacing the asset Attackability factor with the Atc Cost (i) value at Eq. 22 for each set of actions i. We let each vulnerability v, that corresponds to a set of actions i, have an impact score, exploitability score, and temporal score as defined by the CVSS. An impact and exploitability subscores are automatically generated for each common vulnerabilities identifier based on its CVE name defined by the CVSS, whereas the temporal score requires user input. We then define the severity, S, of a vulnerability to be the average of the impact and temporal scores, Eq. (24): The Vulnerability score (V) of a 5G core testbed asset, e.g., UE, MEC server, SDN, NFV, etc is an exponential average of the severity scores of the vulnerabilities on the 5G core asset, or 10, whichever is lower. The asset Exploitability score (E) is the exponential average of the exploitability score for all asset vulnerabilities multiplied by the ratio of network services on the asset. The asset Attackability score (A) refers to the toral CP values for all vulnerabilities at a certain asset. The Attackability score is multiplied by a factor of 10 to produce a number in the range [0,10], ensuring that all dimensions have the same range. For an asset, a, let v be an asset vulnerability. We then define the three asset dimensions as shown in Eq. 25, Eq. 26. and Eq.27: The overall VEA-bility equation for an asset a is then computed as in Eq. (28).

Compare the accuracy of the FuzVAA with the original VAA and the Nessus.
To compare the accuracy of the FuzVAA, original VAA and Nessus using the proposed VEAbility metric, we developed an extensive set of attacks scenarios and used the vulnerabilities observed by the Nessus scan [42], original VAA, and FuzVAA and results after running the attacks scenarios. Fig. 13 shows the overall average VEA-bility scores observed in our experiments for the 5G core testbed assets. A higher score indicates a more secure configuration, which we call more "VEA-ble". Fig. 13 shows that the FuzVAA, on average, is 5.37% and 34.97% more VEA-ble than the original VAA and Nessus respectively. To compare the performance of the FuzVAA, original VAA [2], and Nessus, we run the experiment based on the above-mentioned 6 vulnerabilities. Fig. 14 shows the performance of the FuzVAA, original VAA, and Nessus in milliseconds. The original VAA, on average, outperforms Nessus and FuzVAA by 27.14% and 6.58%, respectively. The original VAA takes 6151ms to compute the attack cost related to all possible paths of the 6 vulnerabilities while Nessus and the original VAA take 8445ms and 6556ms, respectively, to assess the same 6 vulnerabilities. The FuzVAA outperforms Nessus by 22.36%. This shows that our VAA introduces a more scalable and faster assessment.

CONCLUSION
The 5G system improves the bandwidth and capabilities of the current telecommunication infrastructure. However, it introduces new threats and attacks. In this paper, we introduced the FuzVAA , a scalable and accurate vulnerability analysis approach that was tested and evaluated using our new developed 5G core testbed. The experiment results depict that FuzVAA successfully analyzed the vulnerabilities with a low error rate. Experiment results show that, on average, it 5.37% and 34.97 more VEA-ble than the original VAA and Nessus respectively. The original VAA, on average, outperforms Nessus and FuzVAA by 27.14% and 6.58%, respectively. We also introduced our security deployment model which orchestrates the security services using network slices. This model connects all IDS agents through the radios using FlexRAN to the central security management server to analyze and make decisions about the severity of the IDS alerts. We run a case study to validate the security testbed. The experiment showed that the deployment model works very well and can be used to conduct various security experiments.
In future work, we will integrate the FuzVAA with an autonomous intrusion response system that considers the vulnerability assessment values of FuzVAA to deploy countermeasures against cyberattacks. Furthermore, we will compare the accuracy and performance of the FuzVAA against our previously developed VAA based Hexagonal fuzzy method [50].