Author(s)

HuiYuan Ke

Affiliation(s)

School of Cyber Security, Beijing University of Posts and Telecommunications, Beijing 100876, China.

Corresponding Author

HuiYuan Ke

ABSTRACT

The rapid expansion of 5G infrastructure has intensified the need for robust security within the Service-Based Architecture (SBA). Critical signaling interfaces, specifically N2 (connecting the Radio Access Network to the Control Plane) and N4 (linking the Control and User Planes), are increasingly targeted by exploits such as signaling storms, session hijacking, and unauthorized access. Traditional security measures often fail to account for the complex, non-Euclidean relationships between decentralized Network Functions. This research addresses these vulnerabilities by proposing a multi-level anomaly detection framework grounded in Graph Neural Networks (GNN). By modeling the 5G core network as a dynamic graph, the proposed ST-GNAD model effectively aggregates spatial dependencies across N2 and N4 interfaces while capturing temporal signaling evolutions.The performance of this framework was rigorously evaluated through a series of experiments on a high-fidelity simulation platform utilizing Open5gs and UERANSIM. The experimental campaign involved simulating diverse attack vectors targeting the NGAP and PFCP protocols to reflect authentic network perturbations. Quantitative results demonstrate that the model excels in identifying multi-stage anomalies, achieving superior detection precision and lower false-alarm rates compared to traditional sequential models. This approach provides a scalable and resilient solution for securing the signaling backbone of modern 5G architectures.

KEYWORDS

5G core network; N2/N4 interfaces; Anomaly detection; Graph neural network; Spatial-temporal correlation; Signaling security

CITE THIS PAPER

HuiYuan Ke. ST-GNAD: multi-level anomaly detection for 5G core networks based on spatial-temporal graph neural network. Journal of Computer Science and Electrical Engineering. 2026, 8(1): 69-73. DOI: https://doi.org/10.61784/jcsee3120.

REFERENCES

[1] 3GPP. System architecture for the 5G System (5GS). 3rd Generation Partnership Project (3GPP), Technical Specification (TS) 23.501, 2019.

[2] Ahmad I, Kumar T, Liyanage M, et al. Overview of 5G security challenges and solutions. IEEE Communications Standards Magazine, 2018, 2(1): 36-43.

[3] 3GPP. Interface between the Control Plane and the User Plane nodes. 3rd Generation Partnership Project (3GPP), Technical Specification (TS) 29.244, 2020.

[4] Cao J, Ma M, Li H, et al. A survey on security aspects for 3GPP 5G core network. IEEE Communications Surveys & Tutorials, 2019, 22(1): 170-195.

[5] Zhou J, Cui G, Hu S, et al. Graph neural networks: A review of methods and applications. AI Open, 2020, 1: 57-81.

[6] Nguyen K K, Hoang D T, Niyato D, et al. Cyberattack detection in mobile cloud computing: A deep learning approach. IEEE Wireless Communications and Networking Conference (WCNC), 2018: 1-6.

[7] IMT-2020 (5G) Promotion Group. 5G Security Report. Beijing: China Academy of Information and Communications Technology, 2020.

[8] Hu X, Li Y, Zhang W, et al. Security vulnerabilities and attack mitigation in HTTP/2 based 5G core networks. IEEE Transactions on Network and Service Management, 2021.

[9] George M, Kumar S, Thomas R, et al. Simulating and detecting PFCP-based DDoS attacks in 5G network interfaces. Proceedings of the IEEE International Conference on Communications (ICC), 2022.

[10] Radivilova T, Kirichenko L, Ageiev D, et al. Experimental evaluation of anomaly traffic detection methodologies in 5G mobile networks. Computer Networks, 2021.

[11] Lorenzo P, Martinez J, Garcia L, et al. An adaptive deep learning-based anomaly detection system for 5G heterogeneous architectures. IEEE Internet of Things Journal, 2022.

[12] Robert J, Smith A, Brown L, et al. LSTM-based anomaly detection for PFCP signaling traffic in 5G environments. Security and Communication Networks, 2023.

[13] Pacherkar A, Reddy S, Sharma P, et al. A security framework featuring a traceable graph for malicious flow detection in 5G slices. IEEE Transactions on Information Forensics and Security, 2023.