{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/arxiv-2602-03596","title":"SAGE-5GC: Security-Aware Guidelines for Evaluating Anomaly Detection in the 5G Core Network","arxiv_id":"2602.03596","date":"2026-02-03","proceeding":null,"authors":["Cristian Manca","Christian Scano","Giorgio Piras","Fabio Brau","Maura Pintor","Battista Biggio"],"abstract":"Machine learning-based anomaly detection systems are increasingly being adopted in 5G Core networks to monitor complex, high-volume traffic. However, most existing approaches are evaluated under strong assumptions that rarely hold in operational environments, notably the availability of independent and identically distributed (IID) data and the absence of adaptive attackers. In this work, we study the problem of detecting 5G attacks in the wild, focusing on realistic deployment settings. We propose a set of Security-Aware Guidelines for Evaluating anomaly detectors in 5G Core Network (SAGE-5GC), driven by domain knowledge and consideration of potential adversarial threats. Using a realistic 5G Core dataset, we first train several anomaly detectors and assess their baseline performance against standard 5GC control-plane cyberattacks targeting PFCP-based network services. We then extend the evaluation to adversarial settings, where an attacker tries to manipulate the observable features of the network traffic to evade detection, under the constraint that the intended functionality of the malicious traffic is preserved. Starting from a selected set of controllable features, we analyze model sensitivity and adversarial robustness through randomized perturbations. Finally, we introduce a practical optimization strategy based on genetic algorithms that operates exclusively on attacker-controllable features and does not require prior knowledge of the underlying detection model. Our experimental results show that adversarially crafted attacks can substantially degrade detection performance, underscoring the need for robust, security-aware evaluation methodologies for anomaly detection in 5G networks deployed in the wild.","url_abs":"https://arxiv.org/abs/2602.03596","url_pdf":"https://arxiv.org/pdf/2602.03596","source":{"archive":null,"snapshot":"2025-07-28","note":"not in the Papers with Code archive (frozen at the snapshot)","row_kind":"graph","title_abstract_authors_date":"arXiv metadata, CC0 1.0 (https://info.arxiv.org/help/license)"},"code_links":[],"tasks":[],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"atlas_url":"https://app.syntology.ai/?focus=2602.03596","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2602.03596"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-24T18:15:14+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"mentioned_in_github":null,"is_official":null,"provenance":"deterministic:regex_extraction","mentioned_in_paper":null,"url":"https://github.com/pralab/sage-5gc","reach":null}],"summary":{"unverified":9},"by_repo_kind":{"found_in_text":{"samples":9,"ran":0,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":0,"samples":[{"code_sha256_prefix":"9d330e38e039c12d","entry":"build_heatmap_dataframe","repo":"pralab/sage-5gc","repo_kind":"found_in_text","path":"reproducibility/create_heatmap.py","file_url":"https://github.com/pralab/sage-5gc/blob/HEAD/reproducibility/create_heatmap.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"9d330e38e039c12d"}},{"code_sha256_prefix":"ab3baabc7a38d9a9","entry":"convert_to_numeric","repo":"pralab/sage-5gc","repo_kind":"found_in_text","path":"preprocessing/utils.py","file_url":"https://github.com/pralab/sage-5gc/blob/HEAD/preprocessing/utils.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"ab3baabc7a38d9a9"}},{"code_sha256_prefix":"3fdc17ab5114f26f","entry":"drop_constant_columns","repo":"pralab/sage-5gc","repo_kind":"found_in_text","path":"preprocessing/utils.py","file_url":"https://github.com/pralab/sage-5gc/blob/HEAD/preprocessing/utils.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"3fdc17ab5114f26f"}},{"code_sha256_prefix":"12cfd6e2ca3527ea","entry":"drop_tcp_and_icmp_packets","repo":"pralab/sage-5gc","repo_kind":"found_in_text","path":"reproducibility/create_datasets.py","file_url":"https://github.com/pralab/sage-5gc/blob/HEAD/reproducibility/create_datasets.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"12cfd6e2ca3527ea"}},{"code_sha256_prefix":"62f452eb567af7d7","entry":"drop_useless_columns","repo":"pralab/sage-5gc","repo_kind":"found_in_text","path":"preprocessing/utils.py","file_url":"https://github.com/pralab/sage-5gc/blob/HEAD/preprocessing/utils.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"62f452eb567af7d7"}},{"code_sha256_prefix":"bfd004c29cc65efa","entry":"load_model_results","repo":"pralab/sage-5gc","repo_kind":"found_in_text","path":"reproducibility/create_heatmap.py","file_url":"https://github.com/pralab/sage-5gc/blob/HEAD/reproducibility/create_heatmap.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"bfd004c29cc65efa"}},{"code_sha256_prefix":"9381852351e22692","entry":"rand_float","repo":"pralab/sage-5gc","repo_kind":"found_in_text","path":"attacks/random_attack.py","file_url":"https://github.com/pralab/sage-5gc/blob/HEAD/attacks/random_attack.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"9381852351e22692"}},{"code_sha256_prefix":"8be917f6b2719c4f","entry":"rand_hex","repo":"pralab/sage-5gc","repo_kind":"found_in_text","path":"attacks/random_attack.py","file_url":"https://github.com/pralab/sage-5gc/blob/HEAD/attacks/random_attack.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"8be917f6b2719c4f"}},{"code_sha256_prefix":"f2910b1dbc2ea747","entry":"rand_int","repo":"pralab/sage-5gc","repo_kind":"found_in_text","path":"attacks/random_attack.py","file_url":"https://github.com/pralab/sage-5gc/blob/HEAD/attacks/random_attack.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"f2910b1dbc2ea747"}}]},"arxiv_metadata":{"licence":"arXiv metadata, CC0 1.0 (https://info.arxiv.org/help/license)","fields":["title","abstract","authors","date"],"primary_category":"cs.LG","source":"arxiv_2026.jsonl"},"syntology_extracted_results":{"kind":"leaderboard_placements","source":"Syntology's leaderboard-shaped extractor over the paper's own arXiv-HTML tables: a model pointed at a cell, the number was read from that cell and checked against the board's metric, dataset, split and scale, and an independent check accepted the entry; not reviewed by the paper's authors or the archive's editors","extractor_model":"global.anthropic.claude-sonnet-4-5-20250929-v1:0","verifier_model":null,"prompt_sha":"fa63d4bb9d755694","coverage":{"sentence":"Syntology has checked 6,264 of the 9,581 papers on this site that are newer than the archive; results from the others appear after they are checked.","papers_newer_than_archive":9581,"papers_checked":6264},"entries":[],"not_placed":{"boards":0,"rejected_by_independent_check":0,"refused_by_a_rule":0,"check_did_not_answer":0,"proposed_without_a_cell":0,"declined_by_site":0}}}