As we build the architecture for 6G networks, we often focus on defending against external cyberattacks – such as hackers trying to break in from the outside. However, some of the most dangerous threats come from within. Legitimate users, such as employees, contractors, or administrators with authorized access, can intentionally or accidentally cause significant damage.
This is the focus of Proof of Concept 3 (PoC#3) within the MARE project, titled “Full Plane Threat Detection.” It explores how to identify and neutralize insider threats targeting the critical control elements of a network before they can disrupt operations.
Why Insider Threats are a Silent Danger
In complex telecommunications environments, certain users need high-level access to manage the network, configure systems and ensure everything runs smoothly. These “trusted” insiders hold the keys to the network kingdom.
The challenge is that traditional security tools often trust these users by default. If a legitimate administrator uses their valid credentials to plant malicious code, steal sensitive data, or misconfigure a critical system, a standard firewall might not notice anything wrong happening. This makes insider attacks highly difficult to detect and potentially devastating, as they bypass the perimeter defenses that keep external attackers out.
What PoC#3 Investigates
PoC#3 addresses this risk by implementing an Earlier Insider Threat Detection system. Instead of simply looking for unauthorized access, this PoC focuses on behavioural analysis – monitoring what users are actually doing with their access.
The system works by establishing a “baseline” of normal behavior for every entity in the network – from system administrators to automated processes. It asks questions like:
- Does this user typically access these files at 3 AM?
- Is this configuration change consistent with their usual tasks?
- Why is this account trying to access a critical control function it has never used before?
By simulating scenarios like High-Privilege Insider Sabotage, where a trusted user attempts to corrupt network configurations, MARE researchers can test how well the system spots these subtle anomalies.
Detecting the “Wolf in Sheep’s Clothing”
A key innovation in PoC#3 is its multi-layered detection approach. It doesn’t rely on a single signal but correlates data from multiple sources – including physical access logs, digital activity and operational commands, to create a comprehensive view of what is happening.
The system employs intelligent pattern analyzers and Machine Learning (ML) to distinguish between a harmless mistake and a malicious action. When the system detects a deviation from the established baseline – such as an unexpected surge in data exports or unauthorized resource manipulation, it generates actionable security intelligence.
This allows the network to react proactively. Rather than waiting for a system to crash, the security framework can flag the suspicious behavior early, allowing operators to intervene, revoke access, or isolate the affected segment before damage occurs.
