Cross-Layer Intrusion Detection Model Integrating PFCP Signaling and TCP/IP Traffic for 5G Network

To address the growing 5G network security challenges, intrusion detection systems (IDS) based on machine learning (ML) and deep learning (DL) have been widely studied. However, most methods suffer from high computational latency or limited multi-class attack classification. For these issues, this paper proposes a novel cross-layer hierarchical IDS framework that integrates packet forwarding control protocol (PFCP) features and TCP/IP features. The model employs a two-stage classification process: a lightweight XGBoost classifier first performs initial filtering using low-dimensional PFCP features to ensure timeliness, followed by a Random Forest classifier that conducts fine-grained classification on suspicious traffic using more complex TCP/IP features to ensure accuracy. Experimental evaluation on the 5GC PFCP intrusion detection dataset demonstrates that our model achieves superior performance, attaining an accuracy of 94.69% for multi-class attack identification, outperforming various benchmark models. Ablation studies confirm the complementarity of fusing cross-layer features. These results show that the proposed model successfully balances the critical demands of high detection accuracy and low operational latency.