In the upcoming era of 6G networks, data isn’t just traffic – it is also intelligence. Future networks will rely on advanced systems like the Network Data Analytics Function (NWDAF) to automatically optimize performance, manage resources and predict faults. These systems will be used to make critical decisions based on the data they ingest.
But what happens if the data lie?
This is the challenge addressed by Proof of Concept 6 (PoC#6), titled ” Security effects of tampered data ingestion by NWDAF”. The PoC will investigate the threat of analytics poisoning, where attackers feed malicious data into a network’s analytics engine to manipulate its decisions from the inside out.
The Danger: Poisoning the Well
Imagine a navigation app that directs you into traffic jams because someone secretly fed it fake location reports. A similar risk can also exist for 6G networks.
The NWDAF is a system which collects events and analytics from various network elements to understand the state of the system. An attacker – whether that is an insider or an external malicious entity, could inject “poisoned” data into this data stream. By subtly altering performance metrics or fabricating event logs, they can trick the analytics engine into falsely identifying problems that don’t exist or ignoring threats which are real! This intervention could force the network to make harmful automated decisions, such as cutting off legitimate users or opening security holes for further attacks.
How PoC#6 will filter the Poison
PoC#6 is building a Zero Touch Security Framework (ZTSF) designed to detect and filter out this corrupted data before it can do harm. The solution focuses on continuous verification of the analytics pipeline, ensuring that the “data fuel” entering the engine is pure and correct.
The defense strategy involves three key layers:
- Telemetry Anomaly Detection: The system analyzes the normalized data streams entering the analytics function. It looks for statistical irregularities – which are metrics that don’t add up or patterns that deviate from normal operations, and generates a relevant security alert.
- Defense Orchestration: The generated security alert is mapped to a specific predefined CACAO-compliant mitigation Playbook. A dedicated playbook interpreter processes this workflow and formulates standardized, OpenC2-compliant execution commands.
- Automated Mitigation: Guided by the predefined playbook workflow, the interpreter can gather additional threat context to autonomously determine the optimal mitigation strategy. The resulting mitigation decisions are then enacted by triggering specific endpoints on a Security Enhanced NWDAF, neutralizing the data poisoning threat without human intervention.
Ensuring Trustworthy Intelligence
As 6G networks become more autonomous, the integrity of their data is essential. If we cannot trust the data, we cannot trust the network’s decisions.
PoC#6 provides a critical safety mechanism for the AI-driven future of 6G. By proving that we can identify and reject manipulated analytics in real-time, MARE is ensuring that the network’s intelligence remains robust and accurate. This work guarantees that when 6G systems optimize your connection, they are acting on facts, not fiction – keeping the network efficient reliable, and secure.
