GTP-AEGIS: A Selective Heterogeneous Ensemble for GTP Intrusion Detection Under Data Scarcity

Mobile networks have become targets of sophisticated cyber attacks. Critical vulnerabilities persist in the General Packet Radio Service Tunneling Protocol (GTP). Signature-based Intrusion Detection Systems (IDS) are inadequate against zero day exploits and novel attack patterns, necessitating more adaptive approaches. We propose GTP-AEGIS (Adaptive Ensemble with Gated Input Selection), a hybrid IDS that integrates signature-based detection with a CatBoost gradient boosting classifier via a Selective Heterogeneous Ensemble (SHE) framework. An Input-Dependent Confidence Gate (IDCG) applies a per-sample priority rule over CatBoost, a NearestCentroid Rule Engine (NCRE), and a signature pathway. A real Suricata engine detects attacks with 100% precision but only 69.2% binary recall when run standalone; within the ensemble, the signature role is played by an idealized Signature-Detection Surrogate (SDS), so the reported ensemble gains are upper bounds. On the evaluated GTP-U dataset, GTP-AEGIS reaches accuracy above 90% with 10% of the training data and raises recall for the rare invalid-TEID class from 48.9% to 64.4%; this improvement comes from the signature pathway rather than the NCRE, and the aggregate accuracy gain is not statistically significant after correction for multiple comparisons. All accuracies are obtained under a packet-level split, which a group-aware comparison shows to be optimistic by approximately 19 percentage points. The model flags 81 to 100% of packets from unseen attack families as non-normal, although this does not constitute unknown-class recognition. We report the limits of signature-only detection and of packet-level evaluation alongside the gains.