Convolutional Neural Networks and Mixture of Experts for Intrusion Detection in 5G Networks and beyond
Loukas Ilias, George Doukas, Vangelis Lamprou, Christos Ntanos, Dimitris Askounis
TL;DR
The paper tackles intrusion detection in 5G/6G networks by addressing limitations of shallow classifiers and static DNNs. It introduces a novel architecture that combines CNN-based feature extraction with a sparsely gated Mixture of Experts, enabling input-conditioned computation to boost both efficiency and accuracy. Evaluations on the 5G-NIDD and NANCY datasets show state-of-the-art or competitive results, including near-perfect F1 scores on several classes and strong overall accuracy, with ablation studies validating the contribution of each component. The work highlights the practical impact of conditional computation for scalable, robust NextG security and outlines future directions for improved missing-value handling and self-supervised MoE integration.
Abstract
The advent of 6G/NextG networks comes along with a series of benefits, including extreme capacity, reliability, and efficiency. However, these networks may become vulnerable to new security threats. Therefore, 6G/NextG networks must be equipped with advanced Artificial Intelligence algorithms, in order to evade these attacks. Existing studies on the intrusion detection task rely on the train of shallow machine learning classifiers, including Logistic Regression, Decision Trees, and so on, yielding suboptimal performance. Others are based on deep neural networks consisting of static components, which are not conditional on the input. This limits their representation power and efficiency. To resolve these issues, we present the first study integrating Mixture of Experts (MoE) for identifying malicious traffic. Specifically, we use network traffic data and convert the 1D array of features into a 2D matrix. Next, we pass this matrix through convolutional neural network (CNN) layers followed by batch normalization and max pooling layers. After obtaining the representation vector via the CNN layers, a sparsely gated MoE layer is used. This layer consists of a set of experts (dense layers) and a router, where the router assigns weights to the output of each expert. Sparsity is achieved by choosing the most relevant experts of the total ones. Finally, we perform a series of ablation experiments to prove the effectiveness of our proposed model. Experiments are conducted on the 5G-NIDD dataset, a network intrusion detection dataset generated from a real 5G test network. Results show that our introduced approach reaches weighted F1-score up to 99.95% achieving comparable performance to existing approaches. Findings also show that our proposed model achieves multiple advantages over state-of-the-art approaches.