Developing Robust Federated Learning-Based Anomaly Detection Against Poisoning Attacks in 5G Networks

Abstract

The rapid expansion of fifth-generation 5G wireless networks has significantly increased the attack surface available to adversaries who seek to disrupt critical communication infrastructure. Traditional centralized intrusion detection systems expose raw user data to a central server, creating unacceptable privacy risks and bandwidth overhead incompatible with real-time 5G operations. This paper proposes a Privacy Preserving Federated Learning FL framework for real-time security anomaly detection in 5G networks that is simultaneously robust against model poisoning attacks. Distributed 5G edge nodes collaboratively train a global anomaly detection model by sharing only locally computed model weight updates rather than raw telemetry data. The aggregation server applies a multi-layered Byzantine-fault-tolerant pipeline comprising Multi-Krum selection, Isolation Forest outlier detection, and Z-Score norm filtering to identify and discard malicious gradient updates injected by compromised nodes. Differential Privacy noise is added before aggregation to provide formal mathematical privacy guarantees. The system is evaluated across nine attack scenarios involving gradient scaling, sign-flip, and random noise poisoning at adversarial node ratios of 10, 20, and 30 Percentage. Results demonstrate that the proposed system maintains detection accuracy above 90.5 Percentage even when 30 Percentage of participating nodes are adversarial, outperforming baseline FedAvg by up to 48.1 percentage points. A real-time dashboard built on FastAPI and WebSockets provides live visualization of model convergence and threat events. The proposed approach establishes a scalable, privacy preserving, and attack-resilient framework suitable for deployment in operational 5G network environments.