TY  - JOUR
AU  - Patnaik, Phalguni
AU  - Mishra, Susrita
AU  - Panda, Bandhan
AU  - Kar, Santosh Kumar
PY  - 2026
DA  - 2026/03/19
TI  - TinyML Driven Intrusion Detection for 5G Network Slices with Leakage-Free Validation
JO  - Next-Generation Computing Systems and Technologies
T2  - Next-Generation Computing Systems and Technologies
JF  - Next-Generation Computing Systems and Technologies
VL  - 2
IS  - 1
SP  - 10
EP  - 20
DO  - 10.62762/NGCST.2026.664893
UR  - https://www.icck.org/article/abs/NGCST.2026.664893
KW  - 5G network intrusion detection
KW  - edge-based ID
KW  - TinyML for network security
KW  - leakage-free IDS evaluation
KW  - feature-pruned machine learning
KW  - 5G network slicing security
AB  - The intrusion detection at the 5G network perimeter demands learning frameworks that are practically feasible and computationally efficient. This research proposes a lightweight, slice-sensitive intrusion detection approach designed for edge deployment, with a strong emphasis on minimizing information leakage while accounting for the resource constraints inherent in edge environments. A rigorous chronological and session-discontinuous experimental protocol ensures that training and test traffic remain temporally separated, faithfully replicating realistic deployment conditions. The proposed framework employs a classical Logistic Regression classifier using flow-based statistical features extracted from the 5G-NIDD dataset. To reduce model complexity while preserving detection performance, feature importance-based pruning is applied to retain only the most informative features, followed by post-training INT8 quantization. Rather than focusing on hardware-specific implementations, edge feasibility is assessed through software-based metrics, including model size, computational cost per inference, and CPU inference latency. Experimental results demonstrate that the optimized model exhibits stable intrusion detection performance under leakage-free conditions, achieving results largely comparable to—and in some cases slightly superior to—the full-feature baseline. Notable improvements in memory footprint and computational overhead are achieved, resulting in inference latencies of less than one millisecond in software simulations. Slice-wise analysis reveals predictable and interpretable behavior for both enhanced Mobile Broadband (eMBB) and massive Machine-Type Communications (mMTC) traffic, while conclusions regarding Ultra-Reliable Low-Latency Communications (URLLC) traffic are drawn cautiously due to insufficient representation in the dataset. These findings suggest that carefully constrained classical models, combined with feature-based optimization and strict evaluation protocols, provide a practical and transparent foundation for slice-aware intrusion detection at the 5G edge.
SN  - 3070-3328
PB  - Institute of Central Computation and Knowledge
LA  - English
ER  - 

@article{Patnaik2026TinyML,
  author = {Phalguni Patnaik and Susrita Mishra and Bandhan Panda and Santosh Kumar Kar},
  title = {TinyML Driven Intrusion Detection for 5G Network Slices with Leakage-Free Validation},
  journal = {Next-Generation Computing Systems and Technologies},
  year = {2026},
  volume = {2},
  number = {1},
  pages = {10-20},
  doi = {10.62762/NGCST.2026.664893},
  url = {https://www.icck.org/article/abs/NGCST.2026.664893},
  abstract = {The intrusion detection at the 5G network perimeter demands learning frameworks that are practically feasible and computationally efficient. This research proposes a lightweight, slice-sensitive intrusion detection approach designed for edge deployment, with a strong emphasis on minimizing information leakage while accounting for the resource constraints inherent in edge environments. A rigorous chronological and session-discontinuous experimental protocol ensures that training and test traffic remain temporally separated, faithfully replicating realistic deployment conditions. The proposed framework employs a classical Logistic Regression classifier using flow-based statistical features extracted from the 5G-NIDD dataset. To reduce model complexity while preserving detection performance, feature importance-based pruning is applied to retain only the most informative features, followed by post-training INT8 quantization. Rather than focusing on hardware-specific implementations, edge feasibility is assessed through software-based metrics, including model size, computational cost per inference, and CPU inference latency. Experimental results demonstrate that the optimized model exhibits stable intrusion detection performance under leakage-free conditions, achieving results largely comparable to—and in some cases slightly superior to—the full-feature baseline. Notable improvements in memory footprint and computational overhead are achieved, resulting in inference latencies of less than one millisecond in software simulations. Slice-wise analysis reveals predictable and interpretable behavior for both enhanced Mobile Broadband (eMBB) and massive Machine-Type Communications (mMTC) traffic, while conclusions regarding Ultra-Reliable Low-Latency Communications (URLLC) traffic are drawn cautiously due to insufficient representation in the dataset. These findings suggest that carefully constrained classical models, combined with feature-based optimization and strict evaluation protocols, provide a practical and transparent foundation for slice-aware intrusion detection at the 5G edge.},
  keywords = {5G network intrusion detection, edge-based ID, TinyML for network security, leakage-free IDS evaluation, feature-pruned machine learning, 5G network slicing security},
  issn = {3070-3328},
  publisher = {Institute of Central Computation and Knowledge}
}