SAGE-5GC: a security-aware guideline for 5G core network anomaly detection evaluation

SAGE-5GC is a security-aware guideline for 5G core network anomaly detection evaluation, addressing the IID data assumption and the absence of adaptive attackers in real deployments. The study trains multiple anomaly detectors on a 5G core network dataset close to real deployment and evaluates their baseline performance against standard 5GC control-plane attacks targeting the PFCP network service. In the adversarial setting, the attacker perturbs only controllable features while preserving the functionality of malicious traffic, and a genetic-algorithm-based strategy can markedly weaken detection performance without knowledge of the detection model.