Explainable Anomaly Detection in 5G Networks through Continuous Time Graphs

arXiv:2611.06225v1 [cs.CR] 4 Nov 2026

Explainable Anomaly Detection in 5G Networks through Continuous Time Graphs Thomas Hoger

Philippe Owezarski

LAAS - CNRS, Université de Toulouse Toulouse, France thomas.hoger@laas.fr

LAAS - CNRS, Université de Toulouse Toulouse, France owe@laas.fr

Abstract—5G networks increasingly resemble distributed systems in their design. It then becomes crucial to move beyond traditional network-based detection methods and to explore alternative approaches. In this work, we propose a formalization of 5G network exchanges as a dynamic graph, on which we apply techniques from the field of graph-based learning to detect anomalies effectively. This representation allows for fine-grained analysis of packet-level semantic content, while simultaneously capturing sequential and topological contexts, both of which are essential for identifying sophisticated and multi-stage attacks. To assess the effectiveness of this formalism, we evaluate it with the most popular dynamic graph models, demonstrating its potential for 5G anomaly detection. Index Terms—5G network, anomaly detection, explainability, graph neural network

I. I NTRODUCTION Beyond the improvements in service quality enabled by physical innovations, 5G also introduces a major paradigm shift for mobile network architectures. While the core network was traditionally deployed on specialized hardware and relied on dedicated protocol stacks, it is now virtualized and software-driven, with independent network functions interacting through standardized interfaces. This paradigm shift brings 5G architectures closer to distributed systems, while making the network more flexible and dynamic. Yet, these benefits also come at the cost of an increased attacking surface. Indeed, 5G remains vulnerable to attacks affecting traditional networks but also introduces novel attack vectors specific to its new ecosystem [1]–[4]. As these attacks rely on application-layer payloads, traditional IDSs based on quantitative flow analysis are no longer sufficient. This highlights the need for techniques that consider network traffic at the packet level. We identify three dimensions for characterizing these attacks. The semantic dimension captures the intrinsic content of packets. However, attacks can also manifest through anomalies in the surrounding context. This context can be sequential, when messages from the same entity are repeatedly exchanged, or topological, when the communication pattern between entities is abnormal, as in a Man-in-the-Middle (MITM) attack. These dimensions are complementary and should be considered jointly to detect novel 5G threats. Yet, their simultaneous consideration remains largely absent from the state of the art. For instance, AutoGuard, ADSeq, and 5GCGuard focus

exclusively on the sequential dimension, which they analyze using RNNs [5]–[7]. Similarly, Kale et al. [8] consider only the semantic dimension by analyzing packet content with CNNs. Other approaches, as Lam et al. [9], combine two dimensions by feeding the output of a CNN into an RNN, capturing both the semantic and sequential dimensions while overlooking the topological one. To the best of our knowledge, GSAD [10] is the only approach that jointly considers the three dimensions. It combines a CNN for semantics, an RNN for sequences, and a graph neural network (GNN) for interactions between entities. However, its semantic analysis remains limited by the CNN, which simply aggregates byte values without explicitly interpreting their meaning, potentially missing subtle value shifts. Furthermore, the sequential use of three separate models limits their ability to capture correlations across dimensions. These limitations motivate the use of a unified representation that can jointly capture these dimensions rather than processing them through separate models. These limitations call for a more integrated representation of network interactions. Dynamic graphs provide such a framework, naturally representing semantic, sequential, and topological information within the same structure. We therefore represent 5G communications as Continuous-Time Dynamic Graphs (CTDGs) and experimentally evaluate this approach using state-of-the-art machine learning models within a recent framework for benchmarking dynamic graph learning methods. Throughout this paper, we use the terms formalism to refer to the proposed graph representation and model exclusively to refer to the machine learning models applied to it. Beyond capturing the topological dimension, graph formalizations also offer a visual and interpretable view of network interactions. The proposed formalization therefore also provides a high degree of explainability, which is particularly valuable in operational settings, where anomalies may result from novel but legitimate behavior. The paper is organized as follows: Section II introduces the key contextual elements that define the scope of our problem. Section III reviews related work on graph neural networks. Section IV presents our formalization, while Section V describes our anomaly detection methodology. Section VI details the models and datasets used to validate our approach.

Fig. 1: Non-roaming 5G architecture and key protocols

Finally, Section VIII concludes the paper by summarizing our contributions and outlining future work. II. P RELIMINIARIES A. Scope of the study A 5G architecture consists of User Equipment (UE) connected to base stations (gNBs), which form the radio access network (RAN). This access network interacts with the 5G Core Network (CN), which is composed of independent network functions (NFs), each fulfilling a specific role and communicating through HTTP API calls. Among other functions, the CN uses the Packet Forwarding Control Protocol (PFCP) to establish data-plane tunnels between the gNBs and the Data Network (DN), which carry user traffic using the GTP-U protocol. The 5G CN is designed to be highly modular, allowing network operators to deploy different types of NFs depending on their requirements. It is therefore impractical to consider all possible network configurations. In this work, we focus on the set of NFs and application-layer protocols required for the basic operation of a 5G network, as illustrated in Figure 1. This scope provides a manageable setting for our proof of concept while remaining extensible. Indeed, additional NFs and protocols can be incorporated into our approach without requiring changes to the proposed method. B. Threat model The vast majority of state-of-the-art attacks require an entry point into the 5G network to be established beforehand, either by compromising an existing machine or by integrating a new hostile actor. However, there are many ways to achieve this. For example, an attacker can exploit vulnerabilities in slices [11] to pivot to machines on a network to which they previously had no access. Since network functions are virtualized, it is also possible to reach them via their host [12]. Finally, an attacker could take advantage of the proximity between gNB and users to physically access one of them and take control of it. We therefore make the preliminary assumption that an attacker has managed to break into the network by taking control of one or more UE, gNB, or CN functions. C. User Plane vs. Control Plane Traffic 5G networks carry two types of traffic: user traffic and control traffic. User traffic consists of data exchanged between

users and the Internet, and typically accounts for most of the network traffic volume. It represents the user actual use of the connectivity and is encrypted with TLS. From the network perspective, it consists simply of messages forwarded by the 5G core and does not exhibit any characteristics specific to 5G. On the other hand, control traffic consists of messages used to establish communication tunnels and operate the 5G network. Unlike user traffic, it relies on behaviors and protocols specific to 5G and mobile networks. These protocols and behaviors introduce specific attack vectors that are therefore of particular interest from a security perspective. Although encrypted, control traffic can be decrypted and inspected by the operator, who controls the network equipment and holds the necessary cryptographic secrets. This makes control traffic particularly relevant for security analysis. However, several works in the state of the art do not distinguish between these two types of traffic, considering either attacks [13] or benign traffic [4] from the user plane, despite its lack of characteristics specific to 5G. Thus, in this work, we focus exclusively on benign and anomalous traffic within the 5G control plane. III. R ELATED WORKS Graphs are inherently well suited to represent relationships, which is why they have been used in works such as GSAD [10] to capture the topological dimension. In this section, we review traditional GNNs as well as their temporal extensions, which enable them to represent the evolution of these relationships over time. GNNs perform neighborhood-based aggregation, enriching each node representation with information from its local context. Most modern GNNs follow the message passing paradigm introduced by Gilmer et al. [14], which consists of three steps: constructing messages from neighboring node representations, aggregating them, and updating the node representations. Several extensions have been proposed, including Graph Attention Networks (GATs) [15], which use attention to weight neighboring information, and GraphSAGE [16], which supports inductive learning on unseen nodes. However, these architectures are primarily designed for static graphs, whereas our data evolves continuously over time. We therefore consider dynamic graph models, which explicitly incorporate temporal information. These models can be broadly divided according to their temporal granularity. Discrete-Time Graph Networks (DTGNs), such as EvolveGCN [17] and GSAD [10], represent the graph as a sequence of discrete snapshots and combine standard GNN operations with recurrent models to capture temporal evolution. The second category consists of Continuous-Time Graph Networks (CTGNs), which operate at a finer temporal granularity than discrete-time approaches. Rather than representing the graph through fixed snapshots, they represent the graph as a sequence of events, such as node or edge additions, deletions, and updates. CTGNs can be further divided into two families.

The first family consists of temporal neighborhood methods, such as TGN [18], DyRep [19], and JODIE [20], which maintain a latent memory for each observed node, and update it as new events occur. The second family consists of temporal embedding methods, such as GraphMixer [21], CAWN [22], TCL [23], and DyGFormer [24]. In contrast to the first family, the second one do not explicitly store node states in the memory and instead derive temporal representations directly from the observed interactions. Memory-based approaches retain a condensed history of past interactions, providing richer contextual information, while memory-free approaches require less memory and computational resources. Each of these CTGNs differs in how it operates and in the advantages it offers, as demonstrated by the comparative benchmark of Feng et al. [25]. In this work, we evaluate several representative and widely used models on our problem to determine which is best suited to 5G anomaly detection. IV. P ROPOSED G RAPH F ORMALIZATION The main contribution of this work lies in the introduction of two complementary graph representations of the same underlying network activity. The static representation provides a highly interpretable view of the graph structure, while the dynamic representation enables the use of CTGNs to jointly capture the three dimensions during learning.

(a) GSAD [10]

(b) Proposed formalism

Fig. 2: Comparison between the GSAD formalism and our proposed formalism for a packet P1 exchanged between an UPF and an SMF A. Static Formalization As illustrated in Figure 2 (a), GSAD [10] represents a packet and its payload as a single edge P1 connecting two different network entities, namely the SMF and the UPF here. In this approach, every feature contained in the packet, such as IP addresses or URL paths are aggregated into the edge indiscriminately, which requires the use of methods such as CNNs to extract and process these features. In contrast, as proposed in Figure 2 (b), we decompose each packet into its constituent features. Each packet Px is represented by a central node, while each of its features is represented by an individual feature node. The central node is connected to each feature node through an edge labeled with the corresponding feature name, forming a subgraph that explicitly represents the packet and its content.

(a) Topological anomaly (MITM)

(b) Sequential anomaly (Flooding)

(c) Semantic anomaly (Fuzzing)

Fig. 3: Anomalies from the three dimensions represented as static graphs. Indicators of anomalous interactions are highlighted in red.

Importantly, feature nodes are shared across packet subgraphs. When a feature value already exists in the graph, we reuse the corresponding node rather than creating a new one. This mechanism naturally connects packets that share common features. Consequently, processing a packet always adds one new central node, while new feature nodes are created only for feature values that have not previously appeared in the graph. The number of newly added feature nodes corresponds to the number of features in the packet that are not already present in the graph. To capture temporal dependencies, we augment the graph with a directed connection between successive packets, represented as a dashed edge. This temporal connection explicitly represents the order in which packets occur and makes the temporal dependencies between them visible in the graph. This results in representations, such as the one shown in Figure 3, which illustrates examples of the three dimensions of anomalies. In each case, the anomalous dimension can be readily identified from the information highlighted in red. Figure (a) illustrates a topological attack involving a MITM redirection, where a legitimate packet P1 is copied into a new packet P2 and forwarded to another destination. Figure (b) illustrates a sequential anomaly, where the packets themselves are legitimate but their order of arrival is abnormal. Figure (c) illustrates a semantic anomaly in packet P3 , whose nf-type field contains an invalid value. By comparing P3 with similar requests, the model can detect that its content deviates from

the expected pattern, without requiring explicit knowledge of the nf-type field. Because of the packet decomposition, the proposed formalism enables attributes from different packets to be directly connected through shared characteristics, rather than relying solely on the identities of communicating entities, as in previous graph-based representations. This allows the model to capture richer relationships between packet features and leverage the GNN to capture the semantic dimension directly, without requiring a separate CNN to process these features. Moreover, by explicitly representing each feature in the graph, our approach makes it possible to identify the specific parameters contributing to anomalous behavior, providing an inherently interpretable representation.

Fig. 4: Packet represented as a sequence of events B. Dynamic Formalization The static formalism presented above is well suited for providing a visual representation of the data, making it particularly useful for human interpretation after inference. However, its use for learning would require a static GNN, which is less suited to capturing temporal dependencies. We therefore adopt a Continuous Time Graph (CTG) formalism that will be used for both learning and inference. In this formalism, each feature is represented as an event rather than a static edge. This event is defined by a central node, a feature node, and the corresponding feature name. Each packet therefore forms a set of events corresponding to its subgraph in the static representation, as illustrated in Figure 4, which presents the same packet content shown in Figure 2, this time represented as a sequence of events. Since all features of a given packet are observed simultaneously, their ordering within the set is not meaningful, as long as it remains consistent across all packets. Meaningful temporal patterns instead arise from the temporal ordering of sets generated by different packets in the sequence. Figure 5 summarizes and illustrates the two formalisms proposed in this work using a sequence of three packets sent by an attacker to an NRF. The three packets are first represented in their original order in Figure (a). In Figure (b), they are formalized into a static graph, where each packet generates its own central node and corresponding features, forming a subgraph interconnected with one another. Figure (c) shows the corresponding CTG, where the three packets form three sets of events, each containing one event per feature. Events within each set are ordered consistently across packets. This dynamic representation thus preserves the semantic and topological information captured by the static graph while explicitly encoding the temporal evolution of network activity.

It provides a unified representation of the three anomaly dimensions and forms the basis for applying temporal graph learning methods to their detection. V. A NOMALY D ETECTION M ETHODOLOGY This section presents the different stages of our pipeline, from data processing and feature extraction to model training and inference. Figure 6 illustrates the overall workflow of the proposed approach. Feature extraction : We process network packets from PCAP traces sequentially and use the Scapy library to extract the payloads of the application-layer protocols. For each packet, we store each of the extracted features in a structured JSON representation. Feature selection: To avoid introducing noise and hindering the model ability to learn, we empirically selected 41 features that we identified as characteristic of the attacks considered in our dataset. Data formalization : The resulting JSON packets are then transformed into a sequence of events following the formalization presented in Section IV. Each event contains a central and feature node ID, as well as the ID of the edge connecting them. For each of those 3 IDs, we maintain a corresponding vector xi . Edge vectors are initialized from the one-hot encoding of the associated feature name, while node vectors are initialized to zeros and progressively acquire meaningful representations through successive message-passing operations. In addition to these vectors, we maintain metadata for each event, including the packet ID and its ground-truth label. Model Training : We train state-of-the-art GNNs for supervised link prediction using the models implemented in the DyGLib library1 , which provides a standardized framework. The evaluated models are those presented in the related work, namely TGN [18], GraphMixer [21], DyGFormer [24], CAWN [22], TCL [23], JODIE [20], and DyRep [19], providing a representative selection of popular CTGNs. Using DyGLib as an unified framework ensures consistency across models and avoids implementation-related variability that could arise from using different sources. Anomaly detection : Once the model has been trained, it produces probability scores indicating the likelihood of an edge existing between a central node and a feature node, based on how closely the observed interaction resembles patterns previously encountered during training. This enables anomalies to be detected along one or multiple detection dimensions. The resulting probability scores can then be used to represent the detected anomalies as a static graph, as presented in Figure 3. VI. E XPERIMENTS A. Dataset To the best of our knowledge, only three papers from the state of the art present datasets specifically designed as 5G datasets for anomaly detection [4], [13], [26]. However, their 1 https://github.com/yule-BUAA/DyGLib

(a) Sequence of 3 packets

(b) Static Graph representation

(c) Continuous Time Graph representation

Fig. 5: Different representations of the same sequence of exchanges between an attacker and the NRF Attack name Applicative MiTM Applicative Scan [4] API Fuzzing Establishment Flood [1] Deletion Flood [1] SEID Fuzzing Modify Drop [1] Modify Duplicate [1] Uplink Spoofing [3] PFCP in GTP [2]

Semantic Sequential SBI (HTTP/2)

Topological ✖

✖ N4 (PFCP)

✖ ✖ ✖ N3 (GTP-U) ✖ ✖

✖ ✖ ✖ ✖ ✖ ✖ ✖ ✖

TABLE I: Mapping of labeled attacks to their detection dimensions Fig. 6: Overview of the proposed anomaly detection pipeline

benign traffic consists exclusively of user-plane traffic, which cannot provide an appropriate baseline for comparison with attacks targeting the 5G control plane. In the absence of a satisfactory public dataset, anomaly detection studies generally have to generate their own training data [6], [7], [10], [27]. However, the data generation process is rarely described in sufficient detail, and none of these works provides an analysis of dataset quality to identify potential biases or verify that the proposed attacks are comparable in nature to benign traffic. Among these works, 5GCGuard [7] is, to the best of our knowledge, the only one providing tools to reproduce the data generation process. However, only a preprocessed version of the generated dataset is publicly available, without access to the original raw captures, which limits reproducibility. Given the lack of a publicly available dataset that has reached a consensus within the community, we therefore constructed our own dataset using UERANSIM and free5GC, as in several of the aforementioned works. Particular attention was paid to avoiding potential biases identified in [28]. We explicitly defined our scope and the protocols considered in our study, namely HTTP/2, GTP-U, PFCP, and IP, to avoid highly dependent features. Although IP addresses are used to identify communicating entities, attacker identities are randomized to prevent the model from exploiting them as shortcuts for attack detection. We also avoid temporal biases by intertwining benign and attack traffic throughout the capture, with both generated in randomized order.This resulted in a four-hour traffic capture containing approximately

1,200,000 benign messages and 130,000 attack messages, which were subsequently labeled. Our objective is to demonstrate that our approach can detect complex attacks spanning multiple detection dimensions. We therefore implemented seven attacks from the literature, covering complementary detection dimensions as well as different attack surfaces and protocols. These include attacks targeting PFCP for session management, such as establishment, deletion, and modification floods [1]. We also consider spoofing and redirection attacks targeting the GTP-U protocol [2], [3], related to how traffic is encapsulated toward the UPF and subsequently handled by it. Finally, we include scanning attacks targeting the 5G network architecture through HTTP/2 API calls [4]. We additionally introduced three original attacks to further diversify the considered attack scenarios. First, we implemented a Man-in-the-Middle (MITM) attack, covering both its setup phase, which generates network discovery, NF additions, and NF removals, and its subsequent operation, which redirects traffic. We also introduced API fuzzing, which requires the model to learn from a diverse range of benign HTTP/2 traffic in order to identify anomalous messages. Finally, we implemented SEID fuzzing, which represents a more challenging variant of session modification attacks, as the modified messages remain semantically legitimate. For each attack, we identified the detection dimension or dimensions that need to be considered for its detection. These mappings are summarized in Table I. Although our attacks do not cover every existing 5G protocols and entities, we argue that they provide sufficient diversity in terms of attack surfaces and

✖ ✖ ✖ ✖ ✖ ✖ ✖ ✖ ✖ ✖ ✖ ✖ ✖ ✖ ✖ ✖ ✖ ✖

User Traffic

Remove NF

Add NF

Deregister UE

Restart Session

Downlink Wake

Uplink Wake

Register UE

Set UE Idle

Benign procedure Attack procedure Applicative MiTM Applicative Scan API Fuzzing Session Establishment Flood Session Deletion Flood SEID Fuzzing Session Modify Drop Session Modify Duplicate Uplink Spoofing PFCP in GTP

✖ ✖ ✖ ✖ ✖ ✖ ✖ ✖ ✖ ✖ ✖ ✖ ✖ ✖ ✖

TABLE II: Mapping of labeled attacks to the benign procedures that provide comparable traffic for their detection.

detection dimensions to serve as a proof of concept for the anomaly detection. For an attack to be reliably detected, it is essential to have benign traffic of comparable nature, so that the two can be discriminated based on the specific characteristics that make the attack anomalous. For instance, comparing PFCP attacks exclusively against benign HTTP/2 traffic would not provide a meaningful basis for detection. However, this aspect is not systematically considered in existing works. In our dataset, we explicitly associate each attack with benign procedures that generate comparable traffic, as summarized in Table II. Our benign traffic includes procedures commonly used in the state of the art, such as UE registration and deregistration, which generate a wide variety of session-management traffic relevant to PFCP attacks. Combined with procedures that modify UE states, they also generate a diverse range of HTTP/2 messages required to detect our fuzzing attacks. We also implemented benign procedures not considered in previous works. These include NF addition and removal, which generate legitimate traffic comparable to that produced during MITM and scanning attacks. Similarly, we also included user-plane message transmission, which generates legitimate GTP-U encapsulation and therefore provides benign traffic against which GTP-U attacks can be identified. Overall, our dataset contains nine types of benign procedures, whose correspondence with the considered attacks is summarized in Table II. We subsequently analyzed the dataset to verify that attacks were detectable only along their characterized dimensions. For semantic anomalies, we computed the Jaccard distance between the protocol fields of attack messages and comparable benign messages. A distance of zero indicates semantically identical messages. Figure 7 reports, for each attack, the proportion of benign messages of the same nature with zero distance to an attack message. Only PFCP in GTP and Session Modification have no identical benign counterpart. API fuzzing was analyzed separately by API call type, with 93% of its messages having no identical benign counterpart. For temporal anomalies, we analyzed message distributions

Fig. 7: Ratio of benign messages semantically identical to attack messages of the same nature

Fig. 8: Number of packets of different types per 30-second interval

over time. As described above, benign and attack traffic are interleaved and attack times are randomized, preventing simple temporal isolation. Figure 8 shows that repetitive attacks generally produce identifiable bursts. Scanning is an exception, as it requires relatively few packets, while API fuzzing is more dispersed because its execution takes longer. MITM also generates high message volumes due to relayed benign traffic. Overall, temporal patterns provide useful detection signals but are insufficient for some attacks. Finally, for topological anomalies, we searched the dataset for the specific patterns characterizing these attacks and verified that they occur exclusively in anomalous traffic. For MITM, we searched for a redirection pattern in which an NF forwards an API request to another NF and found approximately 4,500 occurrences due to the relayed benign traffic. For user spoofing, we searched for GTP-U requests with inconsistent external IP addresses between the request and response. This pattern occurred 72 times, compared with 92 attack executions, with the difference attributed to packet losses. Overall, this analysis demonstrates that the attacks in our dataset can only be detected according to the dimensions we defined for each of them, thereby demonstrating that our dataset is well suited for evaluating our formalism. Interested readers can refer to the detailed description of the attacks and benign procedures, as well as the data generation process and

dataset analysis, available here [29]. The implementation of our dataset generation algorithm is also publicly available on our GitHub repository2 , together with detailed documentation on how to reproduce the dataset generation process and adapt it to include additional attacks. Finally, the packet capture used in this paper is available here3 . B. Classification Metrics To evaluate the detection performance of our models, we use standard classification metrics. Our models output a probability score in [0, 1], where values close to 0 indicate benign behavior and values close to 1 indicate anomalous behavior. For a given classification threshold, the TPR (True Positive Rate) measures the proportion of correctly detected attacks, while the FPR (False Positive Rate) measures the proportion of benign instances incorrectly classified as anomalous: TPR =

TP TP + FN

FPR =

FP FP + TN

We aim to maximize TPR while minimizing FPR. To evaluate model discrimination independently of a specific threshold, we use the ROC curve, which plots TPR against FPR for all possible thresholds. We summarize the model’s performance using the AUC (Area Under the Curve), where an AUC of 0.5 corresponds to random classification, while an AUC of 1 indicates perfect discrimination. C. Results

Model JODIE DyRep CAWN DyGFormer TCL GraphMixer TGN

AUC 0.5321 0.5299 0.6187 0.6741 0.5788 0.7411 0.9517

Packet/s 90.63 41.20 138.43 855.73 151.64 76.23 22.79

TABLE III: Packets per second (Packets/s) and AUC for the different evaluated models.

the proposed formalism for supervised anomaly detection. While these results are promising, they should be interpreted cautiously in the context of attack detection. Indeed, even a low false-positive rate can generate a significant number of alerts when processing large volumes of traffic, while false negatives correspond to undetected attacks. Although the current performance is not yet sufficient for direct operational deployment, these results demonstrate the relevance of the proposed formalism for supervised anomaly detection. However, good detection performance alone is not sufficient when the objective is to perform real-time detection. Table III therefore compares the performance and execution time of the evaluated models to assess whether their throughput is sufficient for real-time processing. Despite achieving the best detection performance, TGN is also the slowest model, processing approximately 23 packets/s. During dataset generation, we observed an average traffic rate of 29 packets/s, meaning that TGN is not yet capable of real-time processing. However, this gap is relatively small, and the main cause of the limited throughput appears to be the DyGLib implementation, which is not optimized for execution efficiency and performs inefficient memory allocations. The execution time could therefore be significantly reduced either by optimizing the implementation or by simplifying the model. VII. I NTERPRETATION

Fig. 9: ROC curves for the different supervised link prediction models. After training the seven state-of-the-art models presented in Section V, we obtained the ROC curves for each evaluated model, which are presented in Figure 9. Among the different models, TGN achieves the best performance, with an AUC of 0.95, substantially outperforming the other. This result is particularly encouraging and demonstrates the potential of 2 https://github.com/thomas-hoger/CTD-5G 3 doi.org/10.5281/zenodo.15853959

As discussed, beyond supporting the three detection dimensions, our main contribution lies in the interpretability of the proposed formalism. In our approach, the model associates each graph edge with a probability reflecting its likelihood of being legitimate. These probabilities can then be directly projected onto the graph structure, highlighting the elements that contributed to the model decision. Figure 10 illustrates a static graph representation of a real scenario in which benign messages associated with a session restart procedure coexist with anomalies resulting from Session DoS and SEID Fuzzing attacks. Notably, attack-related edges are not all immediately classified as highly anomalous. For SEID Fuzzing, the first attack packets appear in orange, reflecting initially low suspicion based on their semantics. Subsequent packets introduce a temporal anomaly, increasing the model confidence in the attack. In contrast, Session DoS packets are immediately identified as highly anomalous due to their abnormal semantic characteristics.

R EFERENCES

Fig. 10: Static graph representation of anomaly predictions over observed packets. Red edges indicate a high anomaly probability, while green edges indicate a low anomaly probability. Benign central nodes are represented in blue and attacks by red nodes. The black nodes represent feature nodes, which are not inherently benign or anomalous.

VIII. C ONCLUSION AND F UTURE W ORK Most existing approaches to 5G anomaly detection focus primarily on the semantic content of individual messages, while overlooking the sequential and topological context in which interactions occur. This limits their ability to capture complex and multi-stage attacks. In this work, we proposed a graph-based formalism that jointly represents the semantic, sequential, and interaction dimensions of 5G control-plane traffic. By explicitly modeling both the internal structure of packets and the temporal interactions between network entities, our approach provides a more expressive representation of 5G exchanges. This work demonstrated the effectiveness of the proposed formalism in a supervised learning setting. Future work will investigate unsupervised approaches, which are more challenging to balance but may better address previously unseen threats. Regardless of the learning paradigm, the main advantage of our approach lies in its unified and highly interpretable representation, which can support the analysis of both known and novel anomalies. ACKNOWLEDGMENTS We would like to thank the PEPR program “Networks of the Future“ of the Agence Nationale de la Recherche (ANR) for supporting our work as part of the France 2030 investment plan. In particular, we would like to thank the NF-HiSec project, funded under reference ANR-22-PEFT-0009, which played a key role in the realization of this work.

[1] G. Amponis, P. Radoglou-Grammatikis et al., “Threatening the 5G core via PFCP DoS attacks: the case of blocking UAV communications,” EURASIP Journal on Wireless Communications and Networking, vol. 2022, no. 1, Dec. 2022. [2] S. Park, S. Kwon et al., “Session Management for Security Systems in 5G Standalone Network,” IEEE Access, vol. 10, 2022. [3] (2023, Jul.) A deep dive into the packet reflection vulnerability allowing attackers to plague private 5g networks. TrendMicro. [4] C. Coldwell, D. Conger et al., “Machine learning 5g attack detection in programmable logic,” in 2022 IEEE Globecom Workshops (GC Wkshps). [5] T. Madi, H. A. Alameddine et al., “AutoGuard: A Dual Intelligence Proactive Anomaly Detection at Application-Layer in 5G Networks,” in ESORICS. Springer International Publishing, 2021. [6] Z. Tian, R. Patil et al., “ADSeq-5gcn: Anomaly detection from network traffic sequences in 5g core network control plane,” in HPSR, 2023. [7] Y. Tan, J. Liu et al., “Deep learning based proactive anomaly detection for 5g core control plane network function interactions,” IEEE TCCN, 2025. [8] R. Kale, K. W. Fok et al., “Payload-based 5G Attack Detection,” in 9th ICC, Dec. 2023. [9] J. Lam and R. Abbas, “Machine Learning based Anomaly Detection for 5G Networks,” Mar. 2020, arXiv preprint. [10] M. Wang, P. Li et al., “Unsupervised graph-sequence anomaly detection for 5g core network control plane traffic,” in IEEE 29th ICPADS. [11] A. Kumar and V. L. Thing, “Malicious Lateral Movement in 5G Core With Network Slicing And Its Detection,” in 33rd IEEE ITNAC, Nov. 2023. [12] A. Tomar, D. Jeena et al., “Docker Security: A Threat Model, Attack Taxonomy and Real-Time Attack Scenario of DoS,” in 10th CONFLUENCE, Jan. 2020. [13] S. Samarakoon, Y. Siriwardhana et al., “5G-NIDD: A Comprehensive Network Intrusion Detection Dataset Generated over 5G Wireless Network,” arXiv preprint. [14] J. Gilmer, S. S. Schoenholz et al., “Neural message passing for Quantum chemistry,” in Proceedings of the 34th ICML. JMLR, Aug. 2017. [15] P. Veličković, G. Cucurull et al., “Graph attention networks,” 2018, arXiv preprint. [16] W. L. Hamilton, R. Ying et al., “Inductive representation learning on large graphs,” 2018, arXiv preprint. [17] A. Pareja, G. Domeniconi et al., “EvolveGCN: Evolving graph convolutional networks for dynamic graphs,” 2019, arXiv preprint. [18] E. Rossi, B. Chamberlain et al., “Temporal graph networks for deep learning on dynamic graphs,” 2020, arXiv preprint. [19] S. M. Kazemi, R. Goel et al., “Representation learning for dynamic graphs: a survey,” The Journal of Machine Learning Research, vol. 21, no. 1, Jan. 2020. [20] S. Kumar, X. Zhang et al., “Predicting Dynamic Embedding Trajectory in Temporal Interaction Networks,” Aug. 2019, arXiv preprint. [21] W. Cong, S. Zhang et al., “Do We Really Need Complicated Model Architectures For Temporal Networks?” Feb. 2023, arXiv preprint. [22] Y. Wang, Y.-Y. Chang et al., “Inductive Representation Learning in Temporal Networks via Causal Anonymous Walks,” Oct. 2022, arXiv preprint. [23] L. Wang, X. Chang et al., “TCL: Transformer-based Dynamic Graph Modelling via Contrastive Learning,” May 2021, arXiv preprint. [24] L. Yu, L. Sun, B. Du, and W. Lv, “Towards better dynamic graph learning: new architecture and unified library,” in Proceedings of the 37th NIPS. Curran Associates Inc., Dec. 2023. [25] Z. Feng, R. Wang et al., “A Comprehensive Survey of Dynamic Graph Neural Networks: Models, Frameworks, Benchmarks, Experiments and Challenges,” IEEE TKDE, vol. 38, no. 1, Jan. 2026. [26] G. Amponis, P. Radoglou-Grammatikis et al., “5G Core PFCP Intrusion Detection Dataset,” in 2023 12th MOCAST, Jun. 2023. [27] H. S. Pacherkar and G. Yan, “PROV5gc: Hardening 5g core network security with attack detection and attribution based on provenance graphs,” in Proceedings of the 17th ACM WiSec, ser. WiSec ’24. Association for Computing Machinery. [28] R. Flood, G. Engelen et al., “Bad Design Smells in Benchmark NIDS Datasets,” in 2024 IEEE 9th EuroS&P, Jul. 2024. [29] T. Hoger, P. Owezarski, and G. Durand-Nauze, “Control Traffic Dataset and Generation Framework for 5G Networks,” Feb. 2026, hal preprint.

Related documents

• Generalist Graph Anomaly Detection via Prototype-Based Distillation#792756
• Generalist Graph Anomaly Detection via Prototype-Based Distillation#788756
• Distance-based Device-To-Device outage reduction for 5G wireless systems.#285222
• AoI-driven Anomaly Detection Framework for Communication Networks#998961
• ARFU-IDS: Robust Federated Unlearning for Transformer-Based Intrusion Detection in IoT and Sensor Networks.#1091521