# Machine Learning based Anomaly Detection for 5G Networks

arXiv: https://arxiv.org/abs/2003.03474 · HTML: https://mlsanity.com/paper/2003.03474/

## Key facts

- Cited by 7 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 7 Mar 2020.

## Built on by (most cited first, 7 of 7)

- [IoT Security: Botnet detection in IoT using Machine learning](https://mlsanity.com/paper/2104.02231/) (2021)
- [Hybrid Deep Learning-Federated Learning Powered Intrusion Detection System for IoT/5G Advanced Edge Computing Network](https://mlsanity.com/paper/2509.15555/) (2025)
- [Multi-Scale Convolutional LSTM with Transfer Learning for Anomaly Detection in Cellular Networks](https://mlsanity.com/paper/2410.03732/) (2024)
- [Blockchain Meets Adaptive Honeypots: A Trust-Aware Approach to Next-Gen IoT Security](https://mlsanity.com/paper/2504.16226/) (2025)
- [Enhanced Real-Time Threat Detection in 5G Networks: A Self-Attention RNN Autoencoder Approach for Spectral Intrusion Analysis](https://mlsanity.com/paper/2411.03365/) (2024)
- [A Comparative Analysis of Machine Learning Models for DDoS Detection in IoT Networks](https://mlsanity.com/paper/2411.05890/) (2024)
- [SAGE-5GC: Security-Aware Guidelines for Evaluating Anomaly Detection in the 5G Core Network](https://mlsanity.com/paper/2602.03596/) (2026)

## Abstract (arXiv)

Protecting the networks of tomorrow is set to be a challenging domain due to increasing cyber security threats and widening attack surfaces created by the Internet of Things (IoT), increased network heterogeneity, increased use of virtualisation technologies and distributed architectures. This paper proposes SDS (Software Defined Security) as a means to provide an automated, flexible and scalable network defence system. SDS will harness current advances in machine learning to design a CNN (Convolutional Neural Network) using NAS (Neural Architecture Search) to detect anomalous network traffic. SDS can be applied to an intrusion detection system to create a more proactive and end-to-end defence for a 5G network. To test this assumption, normal and anomalous network flows from a simulated environment have been collected and analyzed with a CNN. The results from this method are promising as the model has identified benign traffic with a 100% accuracy rate and anomalous traffic with a 96.4% detection rate. This demonstrates the effectiveness of network flow analysis for a variety of common malicious attacks and also provides a viable option for detection of encrypted malicious network traffic.