Intelligent Security for 5G Networks and Beyond: Enablers of Customized Active Defenses for Mobile Communication Applications

The evolution of security in mobile communication networks is driven by vulnerabilities in previous generations, the need to address insider threats, diverse requirements from different user sectors, as well as opportunities and challenges arising from the emerging technologies. For new users, such as industry and public safety authorities, transitions from own dedicated network infrastructures to commercial networks and 3GPP-based technologies mean large changes also from the security perspective. The transition enables cost-efficiency and new user applications but changes the threat landscape and increases the risks of disturbances and information leaking due to adversaries who are sharing the infrastructure. To manage the growing complexity and threat landscape, intelligent and active defense solutions are needed. Intelligent security means the capability to achieve security goals in different situations with the optimal use of resources. Active defense means the capability to make attacks harder with dynamic network and security measures. Intelligent security requires solutions to collect and share information, analyze the security situation and react accordingly. The tools for intelligent security include artificial intelligence and machine learning, which provide rapid means to react against previously unseen threats but which may also open up new vulnerabilities. This dissertation explores requirements and solutions for customizing network security for different applications and for enabling active defenses. The dissertation includes articles, which analyze selected concepts and enablers for intelligent security. Literature analyses focus on special challenges in communications for public safety authorities as well as new threats arising from the use of machine learning. The enablers include micro-segmentation, which is a method for creating fine-grained logical network slices on top of a shared infrastructure. A designed intelligent security approach for micro-segmentation is based on software networks and continuous learning. Adaptive pseudonymization is an example of the use of real-time threat analysis to adapt active security and privacy defenses. Tactical bubbles are rapidly deployable networks, which are targeted for public safety users and which can be isolated from the commercial infrastructure by logical and physical solutions. The explored use cases provide examples of how the security of mobile communication networks can be adapted to fulfill the needs of different applications and how security resources can be focused on security-critical communications.