SAGE-5GC: Security-Aware Guidelines for Evaluating Anomaly Detection in the 5G Core Network

2026-02-03

AI Summary

This work addresses the limitations of existing anomaly detection methods for 5G core networks, which often rely on unrealistic assumptions—such as independently and identically distributed (IID) data or the absence of adaptive adversaries—rendering their robustness in real-world adversarial settings difficult to assess. To bridge this gap, we propose SAGE-5GC, the first security-aware evaluation framework specifically designed for 5G core network anomaly detection. By integrating domain knowledge with black-box adversarial attack strategies, SAGE-5GC leverages a genetic algorithm to generate functionality-preserving adversarial examples that simulate evasion behaviors, using only attacker-controllable features and without requiring prior knowledge of the target model. Experimental results demonstrate that our approach substantially degrades the performance of state-of-the-art detectors, exposing critical shortcomings in conventional evaluation practices and offering actionable guidelines for robust security assessment in practical deployments.

Technology Category

• Machine Learning: Adversarial Learning & Robustness
• Computer Vision: Adversarial Attacks & Robustness
• Game Theory and Economic Paradigms: Adversarial Learning

Application Category

• Search and Retrieval-Augmented AI: Web evaluation methodologies and metrics
• Security and Privacy: Large-scale security measurements
• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems

Abstract

Machine learning-based anomaly detection systems are increasingly being adopted in 5G Core networks to monitor complex, high-volume traffic. However, most existing approaches are evaluated under strong assumptions that rarely hold in operational environments, notably the availability of independent and identically distributed (IID) data and the absence of adaptive attackers.In this work, we study the problem of detecting 5G attacks \textit{in the wild}, focusing on realistic deployment settings. We propose a set of Security-Aware Guidelines for Evaluating anomaly detectors in 5G Core Network (SAGE-5GC), driven by domain knowledge and consideration of potential adversarial threats. Using a realistic 5G Core dataset, we first train several anomaly detectors and assess their baseline performance against standard 5GC control-plane cyberattacks targeting PFCP-based network services.We then extend the evaluation to adversarial settings, where an attacker tries to manipulate the observable features of the network traffic to evade detection, under the constraint that the intended functionality of the malicious traffic is preserved. Starting from a selected set of controllable features, we analyze model sensitivity and adversarial robustness through randomized perturbations. Finally, we introduce a practical optimization strategy based on genetic algorithms that operates exclusively on attacker-controllable features and does not require prior knowledge of the underlying detection model. Our experimental results show that adversarially crafted attacks can substantially degrade detection performance, underscoring the need for robust, security-aware evaluation methodologies for anomaly detection in 5G networks deployed in the wild.

Problem

• anomaly detection
• 5G Core Network
• adversarial attacks
• security evaluation
• realistic deployment

Innovation

• adversarial robustness
• 5G Core security
• anomaly detection evaluation
• genetic algorithm
• security-aware guidelines