<p>Advanced Metering Infrastructure (AMI) increasingly relies on 5G fog-based communication. However, flood-style availability attacks can quickly overpower edge links and disrupt meter reporting. We develop an end-to-end pipeline that builds a realistic 5G-enabled AMI dataset (SmartGridDDoS). Then, it trains a multi-agent self-healing controller that responds to availability attacks under a strict precision budget. We begin by designing an ns-3 simulation of a dual-fog 5G/mmWave topology. The simulation includes smart meters that generate TCP, UDP, and ICMP traffic under both benign and DDoS regimes. Text traces (.tr files) are converted into per-packet tables. After that, the traffic is documented in 100-ms, UE-level windows. The SmartGridDDoS dataset is engineered with a feature set that captures packet and byte rates, inter-arrival statistics, and heartbeat-driven exponential moving averages. After that, we formulate self-healing as a constrained Markov decision process over fog-level aggregates and train a Proximal Policy Optimization (PPO) controller. A heartbeat-aware setting (HB-ON) is compared against a heartbeat-agnostic baseline (HB-OFF) and a non-sliced, protocol-agnostic configuration. Experimental results show that protocol-aware slicing with HB-ON achieves approximately 87% average attack-byte suppression with an average benign intervention rate of 0% and low delay. Meanwhile, non-sliced HB-ON achieves about 90.2% suppression with 0% collateral interventions. Basic machine learning classifiers such as random forest achieved excellent results ranging between 88 and 98% for precision measures. Surrogate trees and SHAP attributions indicate that heartbeat-smoothed packet-rate and tail inter-arrival features dominate the controller’s decisions, and that the learned policy can operate with fewer effective decision features than standard machine-learning baselines.</p>