SAMMF: A Self-Adaptive Multi-Model Fusion Framework for NWDAF Traffic Anomaly Detection

The Network Data Analytics Function (NWDAF) proposed by 3GPP provides a novel solution for anomaly traffic detection in 5G core networks (5GC). However, existing studies generally adopt single model, which struggle to effectively handle data from different network functions (NFs). To address this problem, this paper proposes a Self-Adaptive Multi-Model Fusion (SAMMF) framework for NWDAF, which can processes the different NFs data. The SAMMF framework consists of four core modules: the data collection module, which is responsible for data statistics and collection; the data preprocessing module, focusing on data cleaning and feature engineering; the self-adaptive multi-model training module, which selects high-performance models from the model library using an adaptive threshold algorithm; and the multi-model fusion module, which fuses the results of the selected models to derive the final result. We evaluated the SAMMF using two commonly used network anomaly detection datasets. Experimental results show that, compared to existing baseline methods, SAMMF demonstrates significant advantages in handling different NFs data, providing a superior solution for anomaly traffic detection in 5GC.