Scientists have demonstrated a real-time defense framework designed to protect modern mobile networks and future 6G infrastructure from evolving cyber threats.
Researchers at the University of Surrey have developed an artificial intelligence-based defense system that can identify and neutralize advanced cyber-attacks targeting 5G networks in less than 100 milliseconds.
The team says this approach has the potential to strengthen the security of next-generation mobile networks, including the future transition to 6G.
As communications infrastructure evolves, modern 5G systems are increasingly built on open, modular architectures.
These designs allow carriers to more easily upgrade and expand their networks, but also create new cybersecurity challenges. The increase in interconnected components and software-driven features creates additional points of entry for attackers.
To address these vulnerabilities, Surrey researchers have developed a security framework called TwinGuard that combines AI and a digital twin of the network.
A digital twin acts as a continuously updated virtual model of a live system, allowing AI to monitor activity and detect abnormal behavior in near real-time.
Digital twin approach enables quick response
Unlike traditional security tools that rely heavily on predefined attack signatures, the TwinGuard system focuses on recognizing behavioral patterns.
That digital twin replicates the state of a live 5G network and updates every few milliseconds, giving AI a detailed view of ongoing operations.
By analyzing this virtual environment, reinforcement learning algorithms can identify suspicious activity and take protective measures before service is disrupted.
Dr Sotiris Moshoyannis, Associate Professor in Complex Systems at the University of Surrey’s Center for Cyber Security, explained that it is becoming increasingly difficult to detect cyber attackers using traditional methods.
According to Moschoyiannis, many modern threats evolve dynamically, adjusting their tactics as they explore weaknesses in systems. Systems that rely on fixed rules or previously recorded attack signatures often struggle to recognize these adaptive strategies.
In contrast, the TwinGuard approach allows the network to learn over time what normal behavior looks like, making it easier to detect anomalies when they occur.
Testing in a realistic 5G environment
To assess the effectiveness of the system, the research team tested TwinGuard in two different 5G network environments designed to reflect real-world infrastructure.
The first experiment used a simulated multi-cell open radio access network (O-RAN), a modern architecture in which multiple radio base stations work together to manage connectivity across a mobile network.
The second environment included a virtualized 5G core network built using the open source OpenAirInterface platform and managed through the FlexRIC real-time control system.
In both environments, the framework detected and stopped the cyberattack within a tenth of a second.
Threats tested include handover flooding attacks, which overwhelm the mechanisms that transfer devices between cell towers, and E2 subscription flooding attacks, where a malicious application floods a network controller with requests and disrupts normal operations.
Future mobile network security challenges
Detecting malicious activity in mobile networks is especially difficult because modern 5G infrastructure consists of many interconnected software and hardware components.
To avoid detection, attackers can hide their actions by mimicking legitimate traffic patterns or escalating their activities over time.
Dr. Mohammad Shojafar, associate professor of network security at Surrey’s 5G/6G Innovation Center, says static security models have difficulty keeping up with the rapid changes in modern telecommunications systems.
He noted that AI systems trained using digital twins can learn directly from live network behavior, improving their ability to identify threats before they impact services.
Preparing for security for the arrival of 6G
The next generation of wireless technology, 6G, is expected to start appearing in the early 2030s. Researchers believe that as networks become more complex and software-driven, traditional rules-based cybersecurity systems will become increasingly inadequate.
The TwinGuard project highlights how AI-driven monitoring and digital twin technology can play a central role in securing future communications infrastructure.
Source link
