Security Monitoring of 5G Core Networks Using Elastic Stack: Architecture, Detection Rules, and CVE-Based Validation

Abstract

Applying general-purpose SIEM tools to 5G Standalone Core networks is hindered by the absence of protocol dissectors for NGAP, GTP-U, and PFCP in standard data collection agents. This paper addresses that gap with a security monitoring system for Open5GS integrating Elastic Stack with a custom tcpdump and tshark capture pipeline, NF-specific Kibana dashboards, and Kibana Security detection rules targeting denial-of-service, NF crash, and unauthorised access patterns. Validation against five unpatched CVEs in Open5GS v2.7.2 achieves 100% attack detection and zero false positives under legitimate traffic.