A Mobile Networks Digital Twin (MNDT) is a virtual replica of a mobile communication network that accurately models the devices, the communication links, the operating environment, and the applications that run on the physical network. By replicating different environments in a laboratory and running multiple scenarios, Digital Twins provide a cost-effective way to evaluate performance, predict the effects of network changes, optimize network management, and make appropriate decisions. This paper presents a methodology for automatically creating and using Network Digital Twins, along with a proposed architecture for performing this implementation. This work is framed in the context of the B5GEMINI project, whose goal is to develop an MNDT applied to a 5G core environment and its evolution towards 6G, being able to apply it to use cases in advanced scenarios such as cybersecurity or Industry 4.0. The proposed methodology covers the entire lifecycle of the MNDT, from the initial phases of data acquisition and modeling to the phases of use and bidirectional connection between physical and digital elements.

Security in IoT networks is currently mandatory, due to the high amount of data that has to be handled. These systems are vulnerable to several cybersecurity attacks, which are increasing in number and sophistication. Due to this reason, new intrusion detection techniques have to be developed, being as accurate as possible for these scenarios. Intrusion detection systems based on machine learning algorithms have already shown a high performance in terms of accuracy. This research proposes the study and evaluation of several preprocessing techniques based on traffic categorization for a machine learning neural network algorithm. This research uses for its evaluation two benchmark datasets, namely UGR16 and the UNSW-NB15, and one of the most used datasets, KDD99. The preprocessing techniques were evaluated in accordance with scalar and normalization functions. All of these preprocessing models were applied through different sets of characteristics based on a categorization composed by four groups of features: basic connection features, content characteristics, statistical characteristics and finally, a group which is composed by traffic-based features and connection direction-based traffic characteristics. The objective of this research is to evaluate this categorization by using various data preprocessing techniques to obtain the most accurate model. Our proposal shows that, by applying the categorization of network traffic and several preprocessing techniques, the accuracy can be enhanced by up to 45%. The preprocessing of a specific group of characteristics allows for greater accuracy, allowing the machine learning algorithm to correctly classify these parameters related to possible attacks.

Network Digital Twin (NDT) is a new technology that builds on the concept of Digital Twins (DT) to create a virtual representation of the physical objects of a telecommunications network. NDT bridges physical and virtual spaces to enable coordination and synchronization of physical parts while eliminating the need to directly interact with them. There is broad consensus that Artificial Intelligence (AI) and Machine Learning (ML) are among the key enablers to this technology. In this work, we present B5GEMINI, which is an NDT for 5G and beyond networks that makes an extensive use of AI and ML. First, we present the infrastructural and architectural components that support B5GEMINI. Next, we explore four paradigmatic applications where AI/ML can leverage B5GEMINI for building new AI-powered applications. In addition, we identify the main components of the AI ecosystem of B5GEMINI, outlining emerging research trends and identifying the open challenges that must be solved along the way. Finally, we present two relevant use cases in the application of NDTs with an extensive use of ML. The first use case lays in the cybersecurity domain and proposes the use of B5GEMINI to facilitate the design of ML-based attack detectors and the second addresses the design of energy efficient ML components and introduces the modular development of NDTs adopting the Digital Map concept as a novelty.

Estimating the number of people present in a given venue in real-time is extremely useful from a security, management, and resource optimization perspective. This article presents the architecture of a system based on the use of Wi-Fi sensor devices that allows estimating, almost in real-time, the number of people attending an event that is taking place in a venue. The estimate is based on the analysis of the “probe request” messages periodically transmitted by smartphones to determine the existence of Wi-Fi access points in the vicinity. The method considers the MAC address randomization mechanisms introduced in recent years in smartphones, which prevents the estimation of the number of devices by simply counting different MAC addresses. To solve this difficulty, our Wi-Fi sensors analyze other fields present in the header of the IEEE 802.11 frames, the information elements, to extract a unique fingerprint from each smartphone. The designed system was tested in a set of real scenarios, obtaining an estimate of attendance at different public events with an accuracy close to 95%.

Companies, institutions or governments process large amounts of data for the development of their activities. This knowledge usually comes from devices that collect data from various sources. Processing them in real time is essential to ensure the flow of information about the current state of infrastructure, as this knowledge is the basis for management and decision making in the event of an attack or anomalous situations. Therefore, this article exposes three unsupervised machine learning models based on clustering techniques and threshold definitions to detect anomalies from heterogeneous streaming cybersecurity data sources. After evaluation, this paper presents a case of heterogeneous cybersecurity devices, comparing WSSSE, Silhouette and training time metrics for all models, where K-Means was defined as the optimal algorithm for anomaly detection in streaming data processing. The anomaly detection’s accuracy achieved is also significantly high. A comparison with other research studies is also performed, against which the proposed method proved its strong points.

In the next 10 years, the telecommunications sector will be dominated by the deployment of pervasive networking available in a wide range of heterogeneous scenarios applying 5G (and beyond) technologies. SDN, NFV as well as Network Sliding Technologies used by 5G will provide a “softwarization” of the network functional elements, opening the ecosystem of network providers to a vast number of suppliers from traditional manufacturers to start-ups focusing on specialized functions. Due to the need to assert the expected interoperability of the introduction and evolution of this set of Network Functions, a set of validation tools is needed to explore traffic patterns according to different scenarios and thus allow the performance of the software modules to be evaluated. This research work presents the design of software tools that aim to provide a way for generating signaling and user traffic in 5G networks, enabling the definition of novel pure-software testing environments for 5G that includes real signaling and user traffic. The tools have been designed to support a set of testing signaling procedures that cover the basic main functioning of 5G networks and that allow for the transmission of user traffic over the network. The tools have been implemented and licensed as Open Source and have been validated through their deployment in a virtualized 5G environment that includes a 5G core network.