ST-GNAD: MULTI-LEVEL ANOMALY DETECTION FOR 5G CORE NETWORKS BASED ON SPATIAL-TEMPORAL GRAPH NEURAL NETWORK

The rapid expansion of 5G infrastructure has intensified the need for robust security within the Service-Based Architecture (SBA). Critical signaling interfaces, specifically N2 (connecting the Radio Access Network to the Control Plane) and N4 (linking the Control and User Planes), are increasingly targeted by exploits such as signaling storms, session hijacking, and unauthorized access. Traditional security measures often fail to account for the complex, non-Euclidean relationships between decentralized Network Functions. This research addresses these vulnerabilities by proposing a multi-level anomaly detection framework grounded in Graph Neural Networks (GNN). By modeling the 5G core network as a dynamic graph, the proposed ST-GNAD model effectively aggregates spatial dependencies across N2 and N4 interfaces while capturing temporal signaling evolutions.The performance of this framework was rigorously evaluated through a series of experiments on a high-fidelity simulation platform utilizing Open5gs and UERANSIM. The experimental campaign involved simulating diverse attack vectors targeting the NGAP and PFCP protocols to reflect authentic network perturbations. Quantitative results demonstrate that the model excels in identifying multi-stage anomalies, achieving superior detection precision and lower false-alarm rates compared to traditional sequential models. This approach provides a scalable and resilient solution for securing the signaling backbone of modern 5G architectures.