AI-Based Anomaly Detection for 5G Core and RAN Components

5G network proliferation has helped reshape the architecture and operational paradigms of modern telecommunications infrastructure, ushering in service-based architectures, network function virtualization (NFV), and even radio access component disaggregation. However, as these transformations enhance aspects such as scalability, flexibility, and performance, they simultaneously introduce an unprecedented level of complexity and dynamism. Hence, anomaly detection, a critical aspect of guaranteeing network reliability for performance optimization and efficient cyber-resilience, requires adaptive, intelligent functions that can operate in real-time in a complex and diverse environment. Since traffic patterns are evolving continuously and the slicing architectures of 5G Core (5GC) and RAN utilize software-defined components, traditional rule-based or statistical detection frameworks are often ineffective in generalizing these data. This paper proposes a holistic perspective on AI-driven anomaly detection, promoting intelligent decision-making to address the complex issues in 5G networks. This paper introduces a multi-level anomaly detection framework that leverages advanced machine learning and deep learning algorithms such as Long Short Term Memory (LSTM) networks, autoencoders, and clustering-based outlier detection models to identify anomalies in system logs, telemetry data, and performance metrics for the primary 5G core network functions like Access and Mobility Function (AMF), Session Management Function (SMF), User Plane Function (UPF), as well as RAN components, e.g., gNodeBs, CU-DU split architectures, and Open RAN interfaces. This includes a mix of both supervised and unsupervised learning techniques, as the training data is drawn from synthetic workload traces (limited labeled data) and real-time traffic flows (unlabeled). Real-time feature engineering across high-dimensional data sources is central to this framework, allowing for precise profiling of control and user plane activities. Adaptive thresholding and dynamic baseline are employed to account for the variation introduced by multi-tenancy, network slicing, and latency-sensitive service types, such as Ultra-Reliable Low-Latency Communications (URLLC) and Massive Machine-Type Communications (mMTC). The framework also includes edge-based inference to reduce detection latency and provide quick feedback to the self-organizing network (SON) controller for implicit healing. Through the formulation of a typical AI model architecture for anomaly detection use cases applicable both at 5GC and RAN layers, our approach leverages federated learning to address distributed inference over multi-site deployments; making sure that network operators have gain insights from monitoring logs containing readings on their in-house systems by integrating interpretability mechanisms based on SHAP (SHapley Additive exPlanations) values. Our models achieved dramatically higher testbed detection accuracy, precision, and recall than baseline statistical models when evaluated using simulations and open-source 5G core implementations (Open5GS, srsRAN). The results show improved false-positive rates in our predictions and faster anomaly localization, which could be used to enable proactive fault management and cyber-threat mitigation. The results of the new white paper provide incontrovertible evidence of a significant leap in another area, operational intelligence, as well as demonstrating AI’s ability to enhance intelligent network automation. The work addresses the scalability, interpretability, and integration that enable 6G core technologies for network resilience and autonomic management capabilities within telecom-grade environments, paving the way for the future development of resilient, self-healing 6G systems. On the technical side, this work lays a foundation for telecom operators, equipment vendors, and researchers to enhance the security of 5G infrastructures through AI-enabled monitoring and defense capabilities.