AI-Driven Threat Detection for 5G/6G Mobile Edge Computing: Fusing SDN Telemetry and Security Logs for Intelligent Network Defence

Software-Defined Networking (SDN) exposes fine-grained flow- and port-level telemetry that is attractive for machine learning detection of Distributed Denial-of-Service (DDoS) attacks in the programmable edge networks envisioned for 5G and 6G. A recurring difficulty is that the labels used to train such detectors are themselves produced by a signature-based Intrusion Detection System (IDS) whose coverage is uneven across attack types, so it is unclear how much of a detector’s quality is limited by the labels rather than the telemetry. We investigate this question within a virtualised 5G mobile edge testbed based on Open5GS and UERANSIM, incorporating a new Security Module integrating Open vSwitch (OVS), the Ryu controller, and the Snort IDS. We generate benign traffic and four DDoS attacks—TCP SYN, UDP and ICMP volumetric floods and the application-layer GoldenEye HTTP keep-alive exhaustion—with a scheduler that balances the number of occurrences per attack type, and we label every one-second sample twice: once from Snort alerts and once from the simulator’s ground truth. Because a quarter of the sixty-seven telemetry features are ten-second rolling means or first differences and attacks span many consecutive seconds, a sample-level split leaks temporal structure between training and test; we therefore evaluate with a window-grouped protocol that holds out entire attack occurrences, and we use a fourth campaign, collected independently and held out in full, as the principal test. Four classifiers—logistic regression, a support vector machine with a radial-basis kernel, a random forest, and XGBoost (gradient-boosted trees)—are compared. Under window-grouped cross-validation on the three development campaigns, XGBoost reaches a macro-averaged F1 of 0.92: the volumetric attacks are detected almost perfectly, while GoldenEye is markedly harder (F1 around 0.66) because at the flow level its telemetry overlaps benign traffic. Training on ground-truth rather than IDS-derived labels improves macro-F1 for every classifier on a common within-pool test set and raises GoldenEye F1 by up to 0.55, largest precisely where the IDS is blind, as Snort’s second-level coverage of GoldenEye is an order of magnitude below that of the volumetric floods; a window-level paired bootstrap over held-out attack occurrences places the macro-F1 and GoldenEye-F1 gains above zero with 95% confidence for the random forest and XGBoost detectors, a per-sample McNemar test being reported only as a complement. A detector trained on three campaigns largely transfers this performance to an independently collected fourth campaign of the same testbed, with macro-F1 slightly lower (0.90 versus 0.92) and a clear drop for GoldenEye (F1 0.56 versus 0.66), so the result reflects robustness across independent runs of one testbed rather than broad generalisation. The findings indicate that, in this setting, IDS-derived label quality is a first-order determinant of SDN-telemetry DDoS detection for the application-layer GoldenEye attack; for the volumetric floods, whose IDS coverage is near-complete (91–99.6%), the label regime matters little, and that grouped, cross-campaign evaluation is necessary to measure their real-world behaviour.