DDoS Amplification Attack Mitigation in 5G/6G Networks: A Taxonomy, Evaluation, and Defense Framework

Abstract

The evolution of 5G and emerging 6G networks has introduced unprecedented opportunities for connectivity, but also expanded the attack ‎surface for Distributed Denial of Service (DDoS) amplification attacks. Service-Based Architecture (SBA), network slicing, and massive ‎IoT (mMTC) environments create new vectors for reflection and amplification, making conventional defenses inadequate. This paper proposes a novel layered defense framework that integrates edge filtering, AI-driven anomaly detection, slice isolation, cloud scrubbing, and quantum-safe cryptography to mitigate DDoS amplification attacks in 5G/6G environments.‎ The framework is theoretically modeled through equations for amplification, mitigation efficiency, resilience, and defense cost, and evaluated experimentally using simulated signaling floods, IoT-driven amplification, slice-targeted floods, and hybrid attacks. Performance was ‎measured using detection rate, false alarm rate, service availability, resilience score, and resource overhead. Two algorithms—‎pseudonymous authentication with zero-knowledge proof (ZKP) and layered mitigation orchestration—were implemented to operationalize ‎the defense strategy.‎ The results demonstrate that the proposed framework achieves a detection accuracy of 95–97%, reduces false positives to 2%, and maintains ‎a service availability of over 85% under prolonged amplification attacks. It scales efficiently in scenarios with up to 10,000 simulated IoT ‎devices, retaining 70–80% throughput, and maintains URLLC latency below 10 ms, outperforming baseline defenses (firewalls, scrubbing, ‎and AI-only) and state-of-the-art defenses from the literature. These findings validate the framework as a scalable, efficient, and future-ready ‎solution for mitigating amplification attacks in 5G/6G networks, with strong alignment with 3GPP, GSMA, and NIST post-quantum standards‎.