Rapid Response: AI’s Defense Against 5G Cyber-Attacks

Innovative Defence Framework Developed to Safeguard Mobile Networks and Future 6G Infrastructure

A groundbreaking real-time defence system has been showcased by scientists to protect modern mobile networks and upcoming 6G infrastructure from evolving cyber threats.

Artificial intelligence-based defence technology created by researchers at the University of Surrey has the ability to swiftly identify and neutralise complex cyber-attacks targeting 5G networks in less than 100 milliseconds.

This cutting-edge approach could enhance the security of next-generation mobile networks, including the anticipated transition to 6G.

As telecommunications infrastructure progresses, contemporary 5G systems are increasingly constructed on open, modular architectures.

While these designs enable operators to easily upgrade and expand networks, they also introduce new cybersecurity challenges due to more interconnected components and software-driven functions, creating additional vulnerabilities for attackers.

To combat these weaknesses, the team at Surrey devised a security framework known as TwinGuard, which integrates AI with a digital twin of the network.

Swift Response Enabled by Digital Twin Approach

Unlike traditional security tools reliant on predefined attack signatures, the TwinGuard system focuses on detecting behavioural patterns.

Its digital twin mirrors the live 5G network state and updates every few milliseconds, providing the AI with a comprehensive view of ongoing operations.

By analyzing this virtual environment, the reinforcement learning algorithm can pinpoint suspicious activity and initiate defensive measures before services are disrupted.

Dr Sotiris Moschoyiannis, associate professor in complex systems at the University of Surrey’s Centre for Cyber Security, emphasized the evolving difficulty in detecting cyber attackers using conventional methods.

Moschoyiannis highlighted that many modern threats adapt dynamically, adjusting tactics while probing systems for vulnerabilities, making it challenging for systems relying on fixed rules or recorded attack signatures to identify these adaptive strategies.

In contrast, the TwinGuard approach allows the network to learn typical behavior over time, simplifying the detection of anomalies as they arise.

Testing TwinGuard in Realistic 5G Environments

To assess the system’s efficacy, the research team tested TwinGuard in two diverse 5G network environments designed to replicate real-world infrastructure.

The first experiment involved a simulated multi-cell Open Radio Access Network (O-RAN), a contemporary architecture where multiple radio base stations collaborate to manage connections across a mobile network.

The second environment comprised a virtualized 5G core network constructed using the open-source OpenAirInterface platform and managed through the FlexRIC real-time control system.

Across both environments, the framework successfully detected and thwarted cyber-attacks in under a tenth of a second.

Various threats were tested, including handover flooding attacks and E2 subscription flooding attacks, demonstrating TwinGuard’s efficiency in combating diverse cyber threats.

Security Challenges for Future Mobile Networks

Detecting malicious activity in mobile networks poses challenges due to the interconnected software and hardware components in modern 5G infrastructure.

Attackers can camouflage their actions by mimicking legitimate traffic patterns or gradually escalating activity to avoid detection.

Dr Mohammad Shojafar, associate professor in network security at Surrey’s 5G/6G Innovation Centre, highlighted the limitations of static security models in keeping pace with the rapid changes in contemporary telecommunications systems.

He emphasized that AI systems trained using a digital twin can learn directly from live network behavior, enhancing their ability to identify threats proactively.

Preparing for 6G Security Challenges

The impending arrival of 6G wireless technology in the early 2030s is anticipated to bring increased network complexity and software-driven operations.

Researchers believe that traditional rule-based cybersecurity systems will become inadequate, underscoring the importance of AI-driven monitoring and digital twin technology in safeguarding future communications infrastructure.