AI-Driven Real-Time Security for 5G/6G Network Slices using Adaptive SDN

Securing dynamic and heterogeneous 5G/6G network slices presents significant challenges due to evolving traffic patterns, diverse service requirements, and an increasing number of cyber threats. To address these issues, this paper introduces SAFESlice, an AI-driven adaptive framework built on Software-Defined Networking (SDN). SAFESlice provides real-time flowbased security enforcement customized to softwarized networks. Our framework integrates a trained threat detection model based on XGBoost into a customizable Ryu SDN controller, enabling live traffic classification and rapid mitigation through programmable flow rules. Experiments on a Mininet-based SDN testbed using the UNSW-NB15 data set demonstrate high detection accuracy in nine types of attacks. Although the architecture supports logical flow classification by service type, the current implementation applies uniform policies across flows; slices are logically abstracted as service flows (e.g., HTTP, VoIP), with full 3GPP-aligned slice-aware enforcement left for future work.