3GPP Release 16 Standardizes NWDAF Network Analytics (TS 23.288) Including Abnormal UE Behaviour Detection
With the Release 16 freeze on 3 July 2020, 3GPP completed its Enablers for Network Automation (eNA) work, defining the 5G Core Network Data Analytics Function (NWDAF) in TS 23.288 — including abnormal UE behaviour analytics that operators can feed into policy and security decisions.
02Deep-Dive Technical Analysis
NWDAF collects data from 5G Core network functions (such as the AMF, SMF and PCF), application functions and OAM, and exposes analytics through the Nnwdaf service-based interfaces (TS 29.520). Release 16 defined UE-related analytics for mobility, communication patterns and abnormal behaviour (for example unexpected UE location or unexpectedly long-lived or high-rate flows), which a consumer such as the PCF can subscribe to and act on by restricting QoS or service area. Release 17 (frozen 2022) split NWDAF into a Model Training Logical Function (MTLF) and an Analytics Logical Function (AnLF) and added multi-NWDAF deployments; later releases extended analytics toward signalling-storm prevention. Fully autonomous, ML-driven signalling firewalls that rewrite SEPP filtering rules without human review remain vendor proposals rather than standardized behaviour.
03Vulnerability & Exploit Flow
Targets abnormal UE behaviour, signalling storms and suspected DDoS on 5G Core service-based interfaces, detected through NWDAF analytics subscriptions.
04Recommended Defense & Mitigation Protocol
Deploy NWDAF analytics alongside SEPP filtering and dedicated signalling firewalls, with human-supervised policy updates and validated ML models.
05Security Impact & Geopolitical Consequence
Gave operators a standardized way to bring machine-learning analytics into the 5G Core control plane and laid the groundwork for automated anomaly detection; real-world security value still depends on vendor implementations and operator integration.
06Authoritative Standards & External References
- 013GPP — TS 23.288 Architecture enhancements for 5G System (5GS) to support network data analytics services (NWDAF)
- 02ETSI — TS 123 288 V16.4.0 (2020-07) 5G; Architecture enhancements for 5GS to support network data analytics services
- 03Tech-invite — Inside TS 23.288: Network Data Analytics Functional Description
07Related Topic Cluster Records
Master 5G Core, SS7 Defense & Subsea Cable Auditing
Ready to turn your historical knowledge into certified hands-on expertise? Register free on TelcoSec Academy to access interactive lab challenges, or consult our enterprise team for carrier-grade signaling assessments and portable BTS hardware.