{"id":"https://openalex.org/W7225204801","doi":"https://doi.org/10.3390/electronics15215087","title":"AI-Driven Threat Detection for 5G/6G Mobile Edge Computing: Fusing SDN Telemetry and Security Logs for Intelligent Network Defence","display_name":"AI-Driven Threat Detection for 5G/6G Mobile Edge Computing: Fusing SDN Telemetry and Security Logs for Intelligent Network Defence","publication_year":2026,"publication_date":"2026-11-02","ids":{"openalex":"https://openalex.org/W7225204801","doi":"https://doi.org/10.3390/electronics15215087"},"language":"en","primary_location":{"id":"doi:10.3390/electronics15215087","doi":"https://doi.org/10.3390/electronics15215087","is_oa":true,"landing_page_url":"https://doi.org/10.3390/electronics15215087","pdf_url":null,"source":{"id":"https://openalex.org/S4210202905","display_name":"Electronics","issn_l":"2079-9292","issn":["2079-9292"],"is_oa":true,"is_in_doaj":false,"is_core":true,"listed_in":["anvur-scientific","cwts-core","norway-1","poland-100","russia-white-list-2","vabb-shw"],"host_organization":"https://openalex.org/P4310310987","host_organization_name":"Multidisciplinary Digital Publishing Institute","host_organization_lineage":["https://openalex.org/P4310310987"],"host_organization_lineage_names":["Multidisciplinary Digital Publishing Institute"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Electronics","raw_type":"journal-article"},"volume":null,"type":"article","is_traditional":true,"indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://doi.org/10.3390/electronics15215087","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5160433288","display_name":"Antoni Lenart","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I686019","display_name":"AGH University of Krakow","ror":"https://ror.org/00bas1c41","country_code":"PL","type":"education","lineage":["https://openalex.org/I686019"]}],"countries":["PL"],"is_corresponding":false,"raw_author_name":"Antoni Lenart","raw_affiliation_strings":["Institute of Telecommunications and Cybersecurity, AGH University of Krakow, Al. Mickiewicza 30, 30-059 Krak\u00f3w, Poland"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Institute of Telecommunications and Cybersecurity, AGH University of Krakow, Al. Mickiewicza 30, 30-059 Krak\u00f3w, Poland","institution_ids":["https://openalex.org/I686019"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5075406062","display_name":"Grzegorz Rzym","orcid":"https://orcid.org/0000-0002-9521-4284","observed_orcids":["https://orcid.org/0000-0002-9521-4284"]},"institutions":[{"id":"https://openalex.org/I686019","display_name":"AGH University of Krakow","ror":"https://ror.org/00bas1c41","country_code":"PL","type":"education","lineage":["https://openalex.org/I686019"]}],"countries":["PL"],"is_corresponding":true,"raw_author_name":"Grzegorz Rzym","raw_affiliation_strings":["Institute of Telecommunications and Cybersecurity, AGH University of Krakow, Al. Mickiewicza 30, 30-059 Krak\u00f3w, Poland"],"raw_orcid":"https://orcid.org/0000-0002-9521-4284","affiliations":[{"raw_affiliation_string":"Institute of Telecommunications and Cybersecurity, AGH University of Krakow, Al. Mickiewicza 30, 30-059 Krak\u00f3w, Poland","institution_ids":["https://openalex.org/I686019"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":["https://openalex.org/A5075406062"],"corresponding_institution_ids":["https://openalex.org/I686019"],"apc_list":{"value":2400,"currency":"CHF","value_usd":2896},"apc_paid":{"value":2400,"currency":"CHF","value_usd":2896},"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.85163368,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":"15","issue":"21","first_page":"5087","last_page":"5087"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9970999956130981,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9970999956130981,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10714","display_name":"Software-Defined Networks and 5G","score":0.001500000013038516,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12326","display_name":"Network Packet Processing and Optimization","score":0.00039999998989515007,"subfield":{"id":"https://openalex.org/subfields/1708","display_name":"Hardware and Architecture"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/ddos-detection","display_name":"DDoS attack detection","score":0.9369999766349792},{"id":"https://openalex.org/keywords/6g-networks","display_name":"6G","score":0.7879999876022339},{"id":"https://openalex.org/keywords/software-defined-networking","display_name":"software-defined networking","score":0.8190000057220459},{"id":"https://openalex.org/keywords/security-logs","display_name":"security logs","score":0.7699999809265137},{"id":"https://openalex.org/keywords/label-quality","display_name":"label quality","score":0.5099999904632568},{"id":"https://openalex.org/keywords/tcp-syn-flood","display_name":"TCP SYN flood","score":0.5699999928474426},{"id":"https://openalex.org/keywords/udp-flood","display_name":"UDP flood","score":0.6019999980926514},{"id":"https://openalex.org/keywords/icmp-flood","display_name":"ICMP flood","score":0.9649999737739563},{"id":"https://openalex.org/keywords/xgboost","display_name":"XGBoost","score":0.6420000195503235},{"id":"https://openalex.org/keywords/mcnemar-test","display_name":"McNemar test","score":0.8489999771118164},{"id":"https://openalex.org/keywords/open5gs","display_name":"Open5GS","score":0.4819999933242798},{"id":"https://openalex.org/keywords/ueransim","display_name":"UERANSIM","score":0.9559999704360962}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7523999810218811},{"id":"https://openalex.org/C31395832","wikidata":"https://www.wikidata.org/wiki/Q1318674","display_name":"Testbed","level":2,"score":0.7511000037193298},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.7059000134468079},{"id":"https://openalex.org/C183121708","wikidata":"https://www.wikidata.org/wiki/Q209867","display_name":"Telemetry","level":2,"score":0.6771000027656555},{"id":"https://openalex.org/C38822068","wikidata":"https://www.wikidata.org/wiki/Q131406","display_name":"Denial-of-service attack","level":3,"score":0.6437000036239624},{"id":"https://openalex.org/C162307627","wikidata":"https://www.wikidata.org/wiki/Q204833","display_name":"Enhanced Data Rates for GSM Evolution","level":2,"score":0.5928000211715698},{"id":"https://openalex.org/C195219913","wikidata":"https://www.wikidata.org/wiki/Q13162","display_name":"Internet Control Message Protocol","level":3,"score":0.5115000009536743},{"id":"https://openalex.org/C31258907","wikidata":"https://www.wikidata.org/wiki/Q1301371","display_name":"Computer network","level":1,"score":0.3952000141143799},{"id":"https://openalex.org/C79403827","wikidata":"https://www.wikidata.org/wiki/Q3988","display_name":"Real-time computing","level":1,"score":0.3790000081062317},{"id":"https://openalex.org/C158251709","wikidata":"https://www.wikidata.org/wiki/Q354025","display_name":"Intrusion","level":2,"score":0.3393999934196472},{"id":"https://openalex.org/C2780385302","wikidata":"https://www.wikidata.org/wiki/Q367158","display_name":"Protocol (science)","level":3,"score":0.31779998540878296},{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.28790000081062317},{"id":"https://openalex.org/C138236772","wikidata":"https://www.wikidata.org/wiki/Q25098575","display_name":"Edge device","level":3,"score":0.28380000591278076},{"id":"https://openalex.org/C2778456923","wikidata":"https://www.wikidata.org/wiki/Q5337692","display_name":"Edge computing","level":3,"score":0.2809000015258789},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.28060001134872437},{"id":"https://openalex.org/C182590292","wikidata":"https://www.wikidata.org/wiki/Q989632","display_name":"Network security","level":2,"score":0.27950000762939453},{"id":"https://openalex.org/C12269588","wikidata":"https://www.wikidata.org/wiki/Q132364","display_name":"Communications protocol","level":2,"score":0.2718999981880188},{"id":"https://openalex.org/C2780719617","wikidata":"https://www.wikidata.org/wiki/Q1030752","display_name":"Salient","level":2,"score":0.2619999945163727},{"id":"https://openalex.org/C144559511","wikidata":"https://www.wikidata.org/wiki/Q2986279","display_name":"Principal (computer security)","level":2,"score":0.260699987411499},{"id":"https://openalex.org/C149635348","wikidata":"https://www.wikidata.org/wiki/Q193040","display_name":"Embedded system","level":1,"score":0.25859999656677246},{"id":"https://openalex.org/C68649174","wikidata":"https://www.wikidata.org/wiki/Q1379116","display_name":"Base station","level":2,"score":0.2558000087738037},{"id":"https://openalex.org/C2778751112","wikidata":"https://www.wikidata.org/wiki/Q835016","display_name":"Window (computing)","level":2,"score":0.251800000667572}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.3390/electronics15215087","doi":"https://doi.org/10.3390/electronics15215087","is_oa":true,"landing_page_url":"https://doi.org/10.3390/electronics15215087","pdf_url":null,"source":{"id":"https://openalex.org/S4210202905","display_name":"Electronics","issn_l":"2079-9292","issn":["2079-9292"],"is_oa":true,"is_in_doaj":false,"is_core":true,"listed_in":["anvur-scientific","cwts-core","norway-1","poland-100","russia-white-list-2","vabb-shw"],"host_organization":"https://openalex.org/P4310310987","host_organization_name":"Multidisciplinary Digital Publishing Institute","host_organization_lineage":["https://openalex.org/P4310310987"],"host_organization_lineage_names":["Multidisciplinary Digital Publishing Institute"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Electronics","raw_type":"journal-article"}],"best_oa_location":{"id":"doi:10.3390/electronics15215087","doi":"https://doi.org/10.3390/electronics15215087","is_oa":true,"landing_page_url":"https://doi.org/10.3390/electronics15215087","pdf_url":null,"source":{"id":"https://openalex.org/S4210202905","display_name":"Electronics","issn_l":"2079-9292","issn":["2079-9292"],"is_oa":true,"is_in_doaj":false,"is_core":true,"listed_in":["anvur-scientific","cwts-core","norway-1","poland-100","russia-white-list-2","vabb-shw"],"host_organization":"https://openalex.org/P4310310987","host_organization_name":"Multidisciplinary Digital Publishing Institute","host_organization_lineage":["https://openalex.org/P4310310987"],"host_organization_lineage_names":["Multidisciplinary Digital Publishing Institute"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Electronics","raw_type":"journal-article"},"sustainable_development_goals":[{"display_name":"Industry, innovation and infrastructure","score":0.5378999710083008,"id":"https://metadata.un.org/sdg/9"}],"study_designs":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":["https://openalex.org/W4408626564","https://openalex.org/W3176826583","https://openalex.org/W4366959064","https://openalex.org/W3191493850","https://openalex.org/W7218114110","https://openalex.org/W7132843146","https://openalex.org/W4400323954","https://openalex.org/W7125903019","https://openalex.org/W4416381394","https://openalex.org/W4213053925"],"abstract_inverted_index":{"Software-Defined":[0],"Networking":[1],"(SDN)":[2],"exposes":[3],"fine-grained":[4],"flow-":[5],"and":[6,29,93,107,115,121,125,143,154,176,190,205,213,236,299,342,354,394,457],"port-level":[7],"telemetry":[8,167,277],"that":[9,35,134,199,326,458],"is":[10,34,55,62,70,265,312,320,429,449,462],"attractive":[11],"for":[12,27,290,350,398,437,442],"machine":[13,228],"learning":[14],"detection":[15,436],"of":[16,66,138,164,254,318,323,327,383,412,433],"Distributed":[17],"Denial-of-Service":[18],"(DDoS)":[19],"attacks":[20,177,258],"in":[21,216,423],"the":[22,36,73,77,104,108,126,136,157,165,219,245,256,273,310,328,340,351,384,405,438,443,452],"programmable":[23],"edge":[24,88],"networks":[25],"envisioned":[26],"5G":[28,86],"6G.":[30],"A":[31,367],"recurring":[32],"difficulty":[33],"labels":[37,74,287],"used":[38],"to":[39,305,377,464],"train":[40],"such":[41],"detectors":[42],"are":[43,169,259],"themselves":[44],"produced":[45],"by":[46,72,303],"a":[47,67,84,96,132,162,182,196,208,225,230,233,251,294,331,357,365,395,430],"signature-based":[48],"Intrusion":[49],"Detection":[50],"System":[51],"(IDS)":[52],"whose":[53,446],"coverage":[54,317,448],"uneven":[56],"across":[57,409],"attack":[58,141,203,337],"types,":[59],"so":[60,404],"it":[61],"unclear":[63],"how":[64],"much":[65],"detector\u2019s":[68],"quality":[69,428],"limited":[71],"rather":[75,284,415],"than":[76,285,416],"telemetry.":[78],"We":[79,111],"investigate":[80],"this":[81,375,424],"question":[82],"within":[83],"virtualised":[85],"mobile":[87],"testbed":[89,414],"based":[90],"on":[91,244,282,293,370],"Open5GS":[92],"UERANSIM,":[94],"incorporating":[95],"new":[97],"Security":[98],"Module":[99],"integrating":[100],"Open":[101],"vSwitch":[102],"(OVS),":[103],"Ryu":[105],"controller,":[106],"Snort":[109,152],"IDS.":[110],"generate":[112],"benign":[113,279],"traffic":[114],"four":[116],"DDoS":[117,435],"attacks\u2014TCP":[118],"SYN,":[119],"UDP":[120],"ICMP":[122],"volumetric":[123,257,329,444],"floods":[124],"application-layer":[127,439],"GoldenEye":[128,264,301,319,399,440],"HTTP":[129],"keep-alive":[130],"exhaustion\u2014with":[131],"scheduler":[133],"balances":[135],"number":[137],"occurrences":[139,338],"per":[140],"type,":[142],"we":[144,192,206],"label":[145,427,453],"every":[146,291],"one-second":[147],"sample":[148],"twice:":[149],"once":[150,155],"from":[151,156],"alerts":[153],"simulator\u2019s":[158],"ground":[159],"truth.":[160],"Because":[161],"quarter":[163],"sixty-seven":[166],"features":[168],"ten-second":[170],"rolling":[171],"means":[172],"or":[173],"first":[174],"differences":[175],"span":[178],"many":[179],"consecutive":[180],"seconds,":[181],"sample-level":[183],"split":[184],"leaks":[185],"temporal":[186],"structure":[187],"between":[188],"training":[189],"test;":[191],"therefore":[193],"evaluate":[194],"with":[195,229,347,387],"window-grouped":[197,242],"protocol":[198],"holds":[200],"out":[201,215],"entire":[202],"occurrences,":[204],"use":[207],"fourth":[209,381],"campaign,":[210],"collected":[211,380],"independently":[212,379],"held":[214],"full,":[217],"as":[218,314,364],"principal":[220],"test.":[221],"Four":[222],"classifiers\u2014logistic":[223],"regression,":[224],"support":[226],"vector":[227],"radial-basis":[231],"kernel,":[232],"random":[234,352],"forest,":[235],"XGBoost":[237,249,355],"(gradient-boosted":[238],"trees)\u2014are":[239],"compared.":[240],"Under":[241],"cross-validation":[243],"three":[246,371],"development":[247],"campaigns,":[248],"reaches":[250],"macro-averaged":[252],"F1":[253,302],"0.92:":[255],"detected":[260],"almost":[261],"perfectly,":[262],"while":[263],"markedly":[266],"harder":[267],"(F1":[268,400],"around":[269],"0.66)":[270],"because":[271],"at":[272],"flow":[274],"level":[275],"its":[276],"overlaps":[278],"traffic.":[280],"Training":[281],"ground-truth":[283],"IDS-derived":[286,426],"improves":[288],"macro-F1":[289,341,388],"classifier":[292],"common":[295],"within-pool":[296],"test":[297,360],"set":[298],"raises":[300],"up":[304],"0.55,":[306],"largest":[307],"precisely":[308],"where":[309],"IDS":[311,447],"blind,":[313],"Snort\u2019s":[315],"second-level":[316],"an":[321,378],"order":[322],"magnitude":[324],"below":[325],"floods;":[330],"window-level":[332],"paired":[333],"bootstrap":[334],"over":[335],"held-out":[336],"places":[339],"GoldenEye-F1":[343],"gains":[344],"above":[345],"zero":[346],"95%":[348],"confidence":[349],"forest":[353],"detectors,":[356],"per-sample":[358],"McNemar":[359],"being":[361],"reported":[362],"only":[363],"complement.":[366],"detector":[368],"trained":[369],"campaigns":[372],"largely":[373],"transfers":[374],"performance":[376],"campaign":[382],"same":[385],"testbed,":[386],"slightly":[389],"lower":[390],"(0.90":[391],"versus":[392,402],"0.92)":[393],"clear":[396],"drop":[397],"0.56":[401],"0.66),":[403],"result":[406],"reflects":[407],"robustness":[408],"independent":[410],"runs":[411],"one":[413],"broad":[417],"generalisation.":[418],"The":[419],"findings":[420],"indicate":[421],"that,":[422],"setting,":[425],"first-order":[431],"determinant":[432],"SDN-telemetry":[434],"attack;":[441],"floods,":[445],"near-complete":[450],"(91\u201399.6%),":[451],"regime":[454],"matters":[455],"little,":[456],"grouped,":[459],"cross-campaign":[460],"evaluation":[461],"necessary":[463],"measure":[465],"their":[466],"real-world":[467],"behaviour.":[468]},"counts_by_year":[],"updated_date":"2026-11-05T12:25:35.769452","created_date":"2026-11-04T00:00:00"}