A Reactive VNF Orchestrator with Explainable AI-Based Intrusion Detection in 5G Networks

Network Functions Virtualization (NFV) enables flexibility and scalability in 5 G networks but also introduces security challenges due to its dynamic nature. Static defenses cannot cope with the transient behavior of Virtual Network Functions (VNFs) or the scale of modern traffic. This paper proposes a closed-loop framework for intelligent threat detection and mitigation in NFV environments. The system integrates an Xtreme Gradient Boosting (XGBoost)-based intrusion detection module trained on UNSW-NB15 dataset, with the explainable AI tool, Shapley Additive exPlanations (SHAP)- based explainability to enhance interpretability by quantifying the features' contributions to model decisions. Detected threats are validated through Mininet scenarios with iperf3 benchmarking. Threat detection triggers a policy-driven VNF Manager that performs real-time VNF scaling, computing resources monitoring, and port-level traffic control, to enable rapid threat mitigation. Continuous monitoring is performed via Prometheus/Grafana dashboards. Experimental results demonstrate a 63% reduction in end-to-end mitigation time compared to a static baseline. These results confirm that the proposed framework achieves rapid, explainable, and resource-aware responses, across diverse attack scenarios, making it a practical solution for NFV security.