Dual-Branch Transformer for Anomaly-Based Intrusion Detection from Multivariate KPIs in the 5G User Plane

The advent of 5G network slicing, enabled by Software-Defined Networking (SDN), has transformed service delivery by allowing the deployment of isolated, virtualized networks tailored to specific application needs. However, this increased flexibility also expands the attack surface, particu-1arly within the distributed, edge-facing user plane. Traditional anomaly detection approaches based on univariate Key Per-formance Indicators (KPIs) often fail to capture the complex, context-dependent behavior embedded in multivariate telemetry. To address this challenge, we propose a Transformer encoder-based framework for anomaly-based intrusion detection in the SDN-enabled 5G user plane. Our approach employs a dual-branch structure to jointly learn sequential dependencies and inter-metric correlations from temporal and variate perspectives. A directional cross-attention fusion mechanism, combined with patch-wise masking, enables robust reconstruction under partial observability. Integrated with SDN for continuous telemetry, it enables fine-grained, slice-aware detection across virtualized over-lay paths. Experiments on real-world network traffic demonstrate that our approach is effective and robust in detecting diverse user-plane anomalies, offering a robust and scalable solution for securing programmable 5G infrastructures.