Slice-Aware Spoofing Detection in 5G Networks Using Lightweight Machine Learning

• URL: http://arxiv.org/abs/2511.09610v1
• Date: Fri, 14 Nov 2025 01:01:29 GMT
• Title: Slice-Aware Spoofing Detection in 5G Networks Using Lightweight Machine Learning
• Abstract summary: This study presents a slice-aware lightweight machine-learning framework for detecting spoofing attacks within 5G network slices.<n>The framework was implemented on a reproducible Open5GS and srsRAN testbed.<n>Results show that aligning security intelligence with slice boundaries enhances detection reliability and preserves operational isolation.
• Score: 0.0
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: The increasing virtualization of fifth generation (5G) networks expands the attack surface of the user plane, making spoofing a persistent threat to slice integrity and service reliability. This study presents a slice-aware lightweight machine-learning framework for detecting spoofing attacks within 5G network slices. The framework was implemented on a reproducible Open5GS and srsRAN testbed emulating three service classes such as enhanced Mobile Broadband (eMBB), Ultra-Reliable Low-Latency Communication (URLLC), and massive Machine-Type Communication (mMTC) under controlled benign and adversarial traffic. Two efficient classifiers, Logistic Regression and Random Forest, were trained independently for each slice using statistical flow features derived from mirrored user-plane traffic. Slice-aware training improved detection accuracy by up to 5% and achieved F1-scores between 0.93 and 0.96 while maintaining real-time operation on commodity edge hardware. The results demonstrate that aligning security intelligence with slice boundaries enhances detection reliability and preserves operational isolation, enabling practical deployment in 5G network-security environments. Conceptually, the work bridges network-security architecture and adaptive machine learning by showing that isolation-aware intelligence can achieve scalable, privacy-preserving spoofing defense without high computational cost.

Related papers

• A Comparative Analysis of Machine Learning Models for Intrusion Detection in Intelligent Transport Systems [0.0]
  AI at the edge computing nodes plays a crucial role in protecting against sophisticated threats.<n>This research applies edge computing to improve latency, bandwidth efficiency, and service responsiveness.<n>It also expands the cyberattack surface because edge nodes are distributed, heterogeneous, and often resource-constrained.
  arXiv  Detail & Related papers  (2026-04-30T22:41:34Z)
• Client-Verifiable and Efficient Federated Unlearning in Low-Altitude Wireless Networks [46.684199927214486]
  In low-altitude wireless networks (LAWN), federated learning (FL) enables collaborative intelligence among unmanned aerial vehicles (UAVs) and integrated sensing and communication (ISAC) devices.<n>Due to the "right to be forgotten" requirements and the high mobility of ISAC devices, the influence of departing devices must be removed from trained models.<n>We propose VerFU, a privacy-preserving and client-verifiable federated unlearning framework designed for LAWN.
  arXiv  Detail & Related papers  (2026-03-31T12:45:40Z)
• MI$^2$DAS: A Multi-Layer Intrusion Detection Framework with Incremental Learning for Securing Industrial IoT Networks [47.386868423451595]
  MI$2$DAS is a multi-layer intrusion detection framework that integrates anomaly-based hierarchical traffic pooling and open-set recognition.<n>Experiments conducted on the Edge-IIoTset dataset demonstrate strong performance across all layers.<n>These results showcase MI$2$DAS as an effective, scalable and adaptive framework for enhancing IIoT security.
  arXiv  Detail & Related papers  (2026-02-27T09:37:05Z)
• A Lightweight Defense Mechanism against Next Generation of Phishing Emails using Distilled Attention-Augmented BiLSTM [34.0814379994364]
  The MobileBERT teacher receives fine-tuning before its transformation into a BiLSTM model with multi-head attention.<n>The system demonstrates excellent performance in terms of accuracy and latency while maintaining a compact size.<n>The paper examines system performance under high traffic conditions and security measures for privacy protection and implementation methods for operational deployment.
  arXiv  Detail & Related papers  (2026-02-24T20:06:45Z)
• ASA: Training-Free Representation Engineering for Tool-Calling Agents [27.41214164139876]
  Activation Steering Adapter (ASA) is a training-free, inference-time controller that performs a single-shot mid-layer intervention and targets tool domains.<n>On MTU-Bench with Qwen2.5-1.5B, ASA improves strict tool-use F1 from 0.18 to 0.50 while reducing the false positive rate from 0.15 to 0.05, using only about 20KB of portable assets and no weight updates.
  arXiv  Detail & Related papers  (2026-02-04T14:20:02Z)
• SAGE-5GC: Security-Aware Guidelines for Evaluating Anomaly Detection in the 5G Core Network [10.75690780447407]
  We study the problem of detecting 5G attacks textitin the wild, focusing on realistic deployment settings.<n>We propose a set of Security-Aware Guidelines for evaluating anomaly detectors in 5G Core Network (SAGE-5GC)<n>Using a realistic 5G Core dataset, we first train several anomaly detectors and assess their baseline performance against standard 5GC control-plane cyberattacks.<n>We then extend the evaluation to adversarial settings, where an attacker tries to manipulate the observable features of the network traffic to evade detection.
  arXiv  Detail & Related papers  (2026-02-03T14:50:19Z)
• Toward an Intrusion Detection System for a Virtualization Framework in Edge Computing [0.0]
  This work explores the deployment of the Lightweight Deep Anomaly Detection for Network Traffic (LDPI) integrated as an isolated service within a virtualization framework.<n>LDPI, adopting a Deep Learning approach, achieved strong training performance, reaching AUC 0.999 (5-fold mean) across the evaluated packet-window settings.<n>We deploy LDPI on a laptop-class edge node and evaluate its overhead and performance in two scenarios.
  arXiv  Detail & Related papers  (2025-11-12T07:43:28Z)
• PUL-Inter-slice Defender: An Anomaly Detection Solution for Distributed Slice Mobility Attacks [11.124385969043644]
  A vulnerability in Inter-Slice Switching (ISS) can be exploited to launch Distributed Slice Mobility (DSM) attacks.<n>We present PUL-Inter-Slice Defender, an anomaly detection solution that leverages Positive Unlabeled Learning (PUL) and incorporates a combination of Long Short-Term Memory Autoencoders and K-Means clustering.
  arXiv  Detail & Related papers  (2025-10-02T17:24:17Z)
• AI/ML Life Cycle Management for Interoperable AI Native RAN [50.61227317567369]
  Artificial intelligence (AI) and machine learning (ML) models are rapidly permeating the 5G Radio Access Network (RAN)<n>These developments lay the foundation for AI-native transceivers as a key enabler for 6G.
  arXiv  Detail & Related papers  (2025-07-24T16:04:59Z)
• A Two-Stage CAE-Based Federated Learning Framework for Efficient Jamming Detection in 5G Networks [5.715528540446773]
  jamming attacks pose a significant risk to heterogeneous network (HetNet) architectures.<n>This paper proposes a decentralized two-stage federated learning (FL) framework for jamming detection in 5G femtocells.<n>Our framework achieves a precision of 0.94, recall of 0.90, F1-score of 0.92, and an accuracy of 0.92, while minimizing communication rounds to 30 and achieving robust convergence in detecting jammed signals with an optimal client count of 6.
  arXiv  Detail & Related papers  (2025-01-25T17:57:45Z)
• Federated Learning for Zero-Day Attack Detection in 5G and Beyond V2X Networks [9.86830550255822]
  Connected and Automated Vehicles (CAVs) on top of 5G and Beyond networks (5GB) make them vulnerable to increasing vectors of security and privacy attacks. We propose in this paper a novel detection mechanism that leverages the ability of the deep auto-encoder method to detect attacks relying only on the benign network traffic pattern. Using federated learning, the proposed intrusion detection system can be trained with large and diverse benign network traffic, while preserving the CAVs privacy, and minimizing the communication overhead.
  arXiv  Detail & Related papers  (2024-07-03T12:42:31Z)
• Artificial Intelligence Empowered Multiple Access for Ultra Reliable and Low Latency THz Wireless Networks [76.89730672544216]
  Terahertz (THz) wireless networks are expected to catalyze the beyond fifth generation (B5G) era. To satisfy the ultra-reliability and low-latency demands of several B5G applications, novel mobility management approaches are required. This article presents a holistic MAC layer approach that enables intelligent user association and resource allocation, as well as flexible and adaptive mobility management.
  arXiv  Detail & Related papers  (2022-08-17T03:00:24Z)
• RelaxLoss: Defending Membership Inference Attacks without Losing Utility [68.48117818874155]
  We propose a novel training framework based on a relaxed loss with a more achievable learning target. RelaxLoss is applicable to any classification model with added benefits of easy implementation and negligible overhead. Our approach consistently outperforms state-of-the-art defense mechanisms in terms of resilience against MIAs.
  arXiv  Detail & Related papers  (2022-07-12T19:34:47Z)
• Federated Dynamic Sparse Training: Computing Less, Communicating Less, Yet Learning Better [88.28293442298015]
  Federated learning (FL) enables distribution of machine learning workloads from the cloud to resource-limited edge devices. We develop, implement, and experimentally validate a novel FL framework termed Federated Dynamic Sparse Training (FedDST) FedDST is a dynamic process that extracts and trains sparse sub-networks from the target full network.
  arXiv  Detail & Related papers  (2021-12-18T02:26:38Z)
• Enabling certification of verification-agnostic networks via memory-efficient semidefinite programming [97.40955121478716]
  We propose a first-order dual SDP algorithm that requires memory only linear in the total number of network activations. We significantly improve L-inf verified robust accuracy from 1% to 88% and 6% to 40% respectively. We also demonstrate tight verification of a quadratic stability specification for the decoder of a variational autoencoder.
  arXiv  Detail & Related papers  (2020-10-22T12:32:29Z)
• Multi-stage Jamming Attacks Detection using Deep Learning Combined with Kernelized Support Vector Machine in 5G Cloud Radio Access Networks [17.2528983535773]
  This research focuses on deploying a multi-stage machine learning-based intrusion detection (ML-IDS) in 5G C-RAN. It can detect and classify four types of jamming attacks: constant jamming, random jamming, jamming, and reactive jamming. The final classification accuracy of attacks is 94.51% with a 7.84% false negative rate.
  arXiv  Detail & Related papers  (2020-04-13T17:21:45Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.