Thesis Outline

The increasing use of cellular-connected drones (UAVs), especially for beyond-visual-line-of-sight applications, introduces significant challenges for airspace security, critical infrastructure protection, and regulatory compliance. Unlike traditional drones controlled via short-range radio, modern UAVs increasingly rely on 5G/6G networks for command, control, and video transmission. This shift opens up a novel opportunity: mobile network infrastructure itself can be leveraged as a large-scale sensor system for drone detection. The objective of this thesis is to investigate whether cellular-connected drones can be detected using mobile network data.

Work Items

The thesis is structured into several closely connected stages:

• comprehensive literature review that systematically surveys existing approaches to drone detection in mobile networks
• in-depth analysis of RAN and core network parameters at the MAC layer and above to identify metrics that may carry discriminative information
• generation and collection of representative data
• investigate different drone detection concepts based on the identified metrics

Depending on the type of thesis and the progress during the work, the scope may be adjusted, and not all work items need to be completed. For more details regarding the individual work items, do not hesitate to contact us.

Prerequisites

The idea is to implement attacks against the 5G SEPP and implement countermeasures into the Open5GS SEPP implementation. The effect of the attacks and countermeasures shall be evaluated.

This will be done on the already existing 5G Roaming Testbed at LKN, which is dockerized and can run on any two machines (VMs, PCs, ..).

The fifth generation of mobile networks (5G) is revolutionizing connectivity with its promise of ultra-low latency, high throughput, and massive device support. As users increasingly roam across national and international networks, ensuring secure and seamless roaming becomes a critical challenge.

While the control plane, responsible for signaling and session management, has been studied and fortified to an extend, the user plane, which carries actual user data (e.g., voice, video, internet traffic), remains a critical area for security enhancement. In roaming scenarios, user data traverses multiple operator networks, making it vulnerable to interception, manipulation, and privacy breaches.

This data is typically transported using the GPRS Tunneling Protocol for User Plane (GTP-U), a protocol originally designed for earlier generations of mobile networks. While GTP-U enables efficient tunneling of user data between network entities, it lacks built-in security features, making it susceptible to threats such as spoofing, tampering, and data leakage.

This master's thesis aims to implement, and evaluate security mechanisms for the 5G roaming user plane, focusing on GTP-U, encryption, integrity protection, and secure tunneling. The implementation will be done within Open5GS, and integrated into an existing dockerized roaming testbed.

Objectives

• StrongSwan Integration: Integrate and configure the StrongSwan IPsec application within the Open5GS UPF containers for the Home Routed (HR) roaming scenario.
• IKEv2 Configuration Evaluation: Implement and evaluate the impact of different Internet Key Exchange (IKEv2) settings (e.g., algorithms, key lifetimes) on the secure tunnel between the UPFs.
• Includes an investigation into using post-quantum key exchange certificates (PQKE) for IKEv2.
• IPsec Configuration Evaluation: Analyze the performance and security trade-offs of various IPsec settings, including different CIPHER suites (e.g., AES-GCM, ChaCha20-Poly1305) for integrity protection and encryption.
• Security Assessment: Man-in-the-Middle (MITM): Design and execute simulations of a Man-in-the-Middle (MITM) attack between the serving and home UPFs to assess the robustness of the implemented IPsec security measures.

Prerequisites

The 5G Service-Based Architecture (SBA) introduces new challenges and opportunities in the design of roaming interfaces between mobile network operators. Central to secure inter-operator communication are the Security Edge Protection Proxy (SEPP) and IP eXchange (IPX) network provider entities, which facilitate secure signaling across trust boundaries.

An existing Python-based simulation framework models a fixed 5G roaming topology with four entities: vSEPP, vIPX, hIPX, and hSEPP. While this setup is suitable for basic testing, it lacks scalability and flexibility for simulating realistic, multi-operator roaming scenarios.

This thesis aims to refactor and extend the SEPP and IPX implementations to support scalable, multi-connection environments, enabling dynamic routing and connection management across a larger simulated network. The SEPP must unify the roles of vSEPP and hSEPP, while the IPX must support parallel connections and enforce routing rules based on operator policies and network topology. To achieve realistic routing behavior, the thesis will incorporate the FRRouting (FRR) suite, an open-source routing stack supporting protocols such as BGP, OSPF, and IS-IS. FRR will be used to simulate routing decisions and path selection within the IPX network, enabling policy-based and topology-aware message forwarding.

Objectives

1. Unified SEPP Design: Develop a single SEPP module that combines both vSEPP and hSEPP functionalities, capable of handling multiple concurrent connections and maintaining session state.
2. Enhanced IPX Module: Extend the IPX implementation to support: Multiple parallel connections. Routing logic based on operator identifiers, trust relationships, and message types. Integrate with the FRRouting suite to simulate realistic routing behavior.
3. Scalability Framework: Design a flexible configuration system to instantiate multiple SEPP and IPX entities dynamically, simulating a larger roaming network.
4. Testing & Validation: Create test scenarios to validate connection handling, routing correctness, and protocol compliance.
5. Documentation & Thesis Writing: Produce comprehensive documentation and a formal thesis de-

tailing design decisions, implementation, and evaluation results.

Prerequisites

Mobile roaming enables users to seamlessly access internet and communication services across the globe. These services are facilitated by Mobile Network Operators (MNOs) through extensive roaming agreements with numerous international counterparts. As a result, roaming interfaces have evolved into highly complex interconnection points, supporting a wide array of protocols and multiple generations of mobile network technologies. Large-scale MNOs, serving millions of inbound and outbound roaming users, must efficiently manage high volumes of network traffic — often processing thousands of packets per second. Even when focusing solely on control plane messages, this traffic generates substantial data, all of which passes through firewalls and contributes to extensive logging activity. Beyond firewall logs, several other data sources — such as diameter routing agents, DNS servers, and passive monitoring systems — offer valuable insights and can be integrated into a comprehensive analysis.

The aim of this research internship is to explore selected data sources within a controlled environment to identify correlations, uncover trends, and propose innovative approaches for leveraging this data in operational network management. The investigation will focus on a 4G roaming scenario, analyzing and comparing two distinct one-hour timeframes: A high-traffic hour during an international event, characterized by elevated roaming activity, and a regular hour on a typical day with no special events. Through this comparative analysis, the student will gain hands-on experience in data interpretation, network behavior analysis, and the development of actionable insights for real-world mobile network operations.

Objectives

1. Work into different data sources.
a) Firewall logs.
b) Diameter Routing Agent logs.
c) DNS server logs.
d) Logs from passive monitoring.
2. Investigate trends and correlations between the data sources.
3. Investigate the possible detection special events.
4. Investigate differences between the two distinct data sets.
5. Evaluate results and draw conclusions on the applicability of the collected information.
6. What can be done in future work?

Prerequisites