{"id":"https://openalex.org/W7127606803","doi":"https://doi.org/10.48550/arxiv.2602.03596","title":"SAGE-5GC: Security-Aware Guidelines for Evaluating Anomaly Detection in the 5G Core Network","display_name":"SAGE-5GC: Security-Aware Guidelines for Evaluating Anomaly Detection in the 5G Core Network","publication_year":2026,"publication_date":"2026-02-03","ids":{"openalex":"https://openalex.org/W7127606803","doi":"https://doi.org/10.48550/arxiv.2602.03596"},"language":null,"primary_location":{"id":"pmh:doi:10.48550/arxiv.2602.03596","is_oa":true,"landing_page_url":null,"pdf_url":null,"source":{"id":"https://openalex.org/S4406922384","display_name":"Open MIND","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Article"},"type":"article","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":null,"any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5064054982","display_name":"Cristian Manca","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Manca, Cristian","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5125011853","display_name":"Christian Scano","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Scano, Christian","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5060991055","display_name":"Giorgio Piras","orcid":"https://orcid.org/0000-0001-8225-6138"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Piras, Giorgio","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5085865626","display_name":"Fabio Brau","orcid":"https://orcid.org/0000-0002-9948-111X"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Brau, Fabio","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5115060116","display_name":"Maura Pintor","orcid":"https://orcid.org/0000-0003-3287-7352"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Pintor, Maura","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5008367647","display_name":"Battista Biggio","orcid":"https://orcid.org/0000-0001-7752-509X"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Biggio, Battista","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.14202677,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.3107999861240387,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.3107999861240387,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.25600001215934753,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10917","display_name":"Smart Grid Security and Resilience","score":0.10090000182390213,"subfield":{"id":"https://openalex.org/subfields/2207","display_name":"Control and Systems Engineering"},"field":{"id":"https://openalex.org/fields/22","display_name":"Engineering"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/anomaly-detection","display_name":"Anomaly detection","score":0.763700008392334},{"id":"https://openalex.org/keywords/software-deployment","display_name":"Software deployment","score":0.5817000269889832},{"id":"https://openalex.org/keywords/robustness","display_name":"Robustness (evolution)","score":0.559499979019165},{"id":"https://openalex.org/keywords/adversarial-system","display_name":"Adversarial system","score":0.5558000206947327},{"id":"https://openalex.org/keywords/set","display_name":"Set (abstract data type)","score":0.4945000112056732},{"id":"https://openalex.org/keywords/core","display_name":"Core (optical fiber)","score":0.48100000619888306},{"id":"https://openalex.org/keywords/baseline","display_name":"Baseline (sea)","score":0.39649999141693115},{"id":"https://openalex.org/keywords/sensitivity","display_name":"Sensitivity (control systems)","score":0.38670000433921814}],"concepts":[{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.763700008392334},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7110999822616577},{"id":"https://openalex.org/C105339364","wikidata":"https://www.wikidata.org/wiki/Q2297740","display_name":"Software deployment","level":2,"score":0.5817000269889832},{"id":"https://openalex.org/C63479239","wikidata":"https://www.wikidata.org/wiki/Q7353546","display_name":"Robustness (evolution)","level":3,"score":0.559499979019165},{"id":"https://openalex.org/C37736160","wikidata":"https://www.wikidata.org/wiki/Q1801315","display_name":"Adversarial system","level":2,"score":0.5558000206947327},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.5060999989509583},{"id":"https://openalex.org/C177264268","wikidata":"https://www.wikidata.org/wiki/Q1514741","display_name":"Set (abstract data type)","level":2,"score":0.4945000112056732},{"id":"https://openalex.org/C2164484","wikidata":"https://www.wikidata.org/wiki/Q5170150","display_name":"Core (optical fiber)","level":2,"score":0.48100000619888306},{"id":"https://openalex.org/C12725497","wikidata":"https://www.wikidata.org/wiki/Q810247","display_name":"Baseline (sea)","level":2,"score":0.39649999141693115},{"id":"https://openalex.org/C21200559","wikidata":"https://www.wikidata.org/wiki/Q7451068","display_name":"Sensitivity (control systems)","level":2,"score":0.38670000433921814},{"id":"https://openalex.org/C5038329","wikidata":"https://www.wikidata.org/wiki/Q1142907","display_name":"Core network","level":2,"score":0.382099986076355},{"id":"https://openalex.org/C94915269","wikidata":"https://www.wikidata.org/wiki/Q1834857","display_name":"Detector","level":2,"score":0.3698999881744385},{"id":"https://openalex.org/C120314980","wikidata":"https://www.wikidata.org/wiki/Q180634","display_name":"Distributed computing","level":1,"score":0.35989999771118164},{"id":"https://openalex.org/C12997251","wikidata":"https://www.wikidata.org/wiki/Q567560","display_name":"Anomaly (physics)","level":2,"score":0.35339999198913574},{"id":"https://openalex.org/C36503486","wikidata":"https://www.wikidata.org/wiki/Q11235244","display_name":"Domain (mathematical analysis)","level":2,"score":0.33809998631477356},{"id":"https://openalex.org/C145804949","wikidata":"https://www.wikidata.org/wiki/Q478123","display_name":"Situation awareness","level":2,"score":0.31189998984336853},{"id":"https://openalex.org/C31258907","wikidata":"https://www.wikidata.org/wiki/Q1301371","display_name":"Computer network","level":1,"score":0.30820000171661377},{"id":"https://openalex.org/C79403827","wikidata":"https://www.wikidata.org/wiki/Q3988","display_name":"Real-time computing","level":1,"score":0.3075999915599823},{"id":"https://openalex.org/C182590292","wikidata":"https://www.wikidata.org/wiki/Q989632","display_name":"Network security","level":2,"score":0.3068000078201294},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.29989999532699585},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.29739999771118164},{"id":"https://openalex.org/C2776973144","wikidata":"https://www.wikidata.org/wiki/Q6880649","display_name":"Misuse detection","level":4,"score":0.28619998693466187},{"id":"https://openalex.org/C2776036281","wikidata":"https://www.wikidata.org/wiki/Q48769818","display_name":"Constraint (computer-aided design)","level":2,"score":0.2831000089645386},{"id":"https://openalex.org/C147494362","wikidata":"https://www.wikidata.org/wiki/Q2078905","display_name":"Troubleshooting","level":2,"score":0.27970001101493835},{"id":"https://openalex.org/C207685749","wikidata":"https://www.wikidata.org/wiki/Q2088941","display_name":"Domain knowledge","level":2,"score":0.25290000438690186}],"mesh":[],"locations_count":2,"locations":[{"id":"pmh:doi:10.48550/arxiv.2602.03596","is_oa":true,"landing_page_url":null,"pdf_url":null,"source":{"id":"https://openalex.org/S4406922384","display_name":"Open MIND","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Article"},{"id":"doi:10.48550/arxiv.2602.03596","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2602.03596","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"pmh:doi:10.48550/arxiv.2602.03596","is_oa":true,"landing_page_url":null,"pdf_url":null,"source":{"id":"https://openalex.org/S4406922384","display_name":"Open MIND","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Article"},"sustainable_development_goals":[{"id":"https://metadata.un.org/sdg/16","score":0.46429339051246643,"display_name":"Peace, Justice and strong institutions"}],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Machine":[0],"learning-based":[1],"anomaly":[2,77,104,225],"detection":[3,201,214,226],"systems":[4],"are":[5,22],"increasingly":[6],"being":[7],"adopted":[8],"in":[9,30,60,79,227,231],"5G":[10,58,80,97,228],"Core":[11,81,98],"networks":[12,229],"to":[13,125,132,141],"monitor":[14],"complex,":[15],"high-volume":[16],"traffic.":[17],"However,":[18],"most":[19],"existing":[20],"approaches":[21],"evaluated":[23],"under":[24,144],"strong":[25],"assumptions":[26],"that":[27,147,186,207],"rarely":[28],"hold":[29],"operational":[31],"environments,":[32],"notably":[33],"the":[34,44,54,61,123,134,138,145,148,152,199,217,232],"availability":[35],"of":[36,46,56,72,90,137,151,162,198],"independent":[37],"and":[38,43,88,106,169,192],"identically":[39],"distributed":[40],"(IID)":[41],"data":[42],"absence":[45],"adaptive":[47],"attackers.":[48],"In":[49],"this":[50],"work,":[51],"we":[52,100,165,176],"study":[53],"problem":[55],"detecting":[57],"attacks":[59,210],"wild,":[62],"focusing":[63],"on":[64,183,189],"realistic":[65,96],"deployment":[66],"settings.":[67],"We":[68,120],"propose":[69],"a":[70,95,159,178],"set":[71,161],"Security-Aware":[73],"Guidelines":[74],"for":[75,219,224],"Evaluating":[76],"detectors":[78,105],"Network":[82],"(SAGE-5GC),":[83],"driven":[84],"by":[85],"domain":[86],"knowledge":[87,197],"consideration":[89],"potential":[91],"adversarial":[92,126,170],"threats.":[93],"Using":[94],"dataset,":[99],"first":[101],"train":[102],"several":[103],"assess":[107],"their":[108],"baseline":[109],"performance":[110],"against":[111],"standard":[112],"5GC":[113],"control-plane":[114],"cyberattacks":[115],"targeting":[116],"PFCP-based":[117],"network":[118,139],"services.":[119],"then":[121],"extend":[122],"evaluation":[124,222],"settings,":[127],"where":[128],"an":[129],"attacker":[130],"tries":[131],"manipulate":[133],"observable":[135],"features":[136,191],"traffic":[140,154],"evade":[142],"detection,":[143],"constraint":[146],"intended":[149],"functionality":[150],"malicious":[153],"is":[155],"preserved.":[156],"Starting":[157],"from":[158],"selected":[160],"controllable":[163],"features,":[164],"analyze":[166],"model":[167],"sensitivity":[168],"robustness":[171],"through":[172],"randomized":[173],"perturbations.":[174],"Finally,":[175],"introduce":[177],"practical":[179],"optimization":[180],"strategy":[181],"based":[182],"genetic":[184],"algorithms":[185],"operates":[187],"exclusively":[188],"attacker-controllable":[190],"does":[193],"not":[194],"require":[195],"prior":[196],"underlying":[200],"model.":[202],"Our":[203],"experimental":[204],"results":[205],"show":[206],"adversarially":[208],"crafted":[209],"can":[211],"substantially":[212],"degrade":[213],"performance,":[215],"underscoring":[216],"need":[218],"robust,":[220],"security-aware":[221],"methodologies":[223],"deployed":[230],"wild.":[233]},"counts_by_year":[],"updated_date":"2026-07-15T18:14:33.161393","created_date":"2026-02-06T00:00:00"}