Towards NWDAF-enabled Analytics and Closed-Loop Automation in 5G Networks

TL;DR

The paper tackles the challenge of achieving zero-touch management in 5G by implementing a NWDAF-based closed-loop framework. It introduces a UPF Event Exposure Service for standardized real-time data collection, a ML Model Provisioning Service integrated with MLflow for end-to-end ML lifecycle management, and an SMF extension that acts on NWDAF analytics to terminate misbehaving sessions. The authors validate the approach using a bot-detection case study on Open5GS, showing low UPF overhead, scalable analytics, and responsive mitigation in a closed loop. The work demonstrates a practical path toward real-time analytics-driven security and policy enforcement in the 5G core, with public release of the code and extensions to standard NWDAF capabilities.

Abstract

The fifth generation of cellular technology (5G) delivers faster speeds, lower latency, and improved network service alongside support for a large number of users and a diverse range of verticals. This brings increased complexity to network control and management, making closed-loop automation essential. In response, the 3rd Generation Partnership Project (3GPP) introduced the Network Data Analytics Function (NWDAF) to streamline network monitoring by collecting, analyzing, and providing insights from network data. While prior research has focused mainly on isolated applications of machine learning within NWDAF, critical aspects such as standardized data collection, analytics integration in closed-loop automation, and end-to-end system evaluation have received limited attention. This work addresses existing gaps by presenting a practical implementation of NWDAF and its integration with leading open-source 5G core network solutions. We develop a 3GPP-compliant User Plane Function (UPF) event exposure service for real-time data collection and an ML model provisioning service integrated with MLflow to support end-to-end machine learning lifecycle management. Additionally, we enhance the Session Management Function (SMF) to consume NWDAF analytics and respond accordingly. Our evaluation demonstrates the solution's scalability, resource efficiency, and effectiveness in enabling closed-loop security management in 5G networks.

Figures (8)

• Figure 1: NWDAF-enabled closed loop network automation
• Figure 2: High-level overview of our NWDAF system for closed-loop management
• Figure 3: UPF Event Exposure Service
• Figure 4: ML model Provision Service
• Figure 5: Sequence diagram for closed-loop workflow