March 10, 2026 by University of Surrey
Collected at: https://techxplore.com/news/2026-03-ai-powered-defense-5g-cyber.html
An AI defense system has successfully detected and neutralized sophisticated 5G cyber-attacks in less than a tenth of a second, paving the way for more secure 5G and future 6G mobile networks, say researchers at the University of Surrey.
Digital twin approach to 5G security
While modern 5G networks are becoming more open and flexible, making them easier to upgrade and cheaper to build, that also creates more opportunities for hackers. The Surrey-developed defense framework, called TwinGuard, addresses this challenge using a real-time digital twin—a live virtual replica of a mobile network that updates every few milliseconds. The team paired TwinGuard with reinforcement learning AI that can anticipate suspicious behavior and shut down attacks before they cause disruption.
Traditional security systems usually rely on recognizing known attack patterns, which means that they can struggle to deal with new or rapidly changing threats. To test whether TwinGuard could respond more quickly, researchers used two realistic 5G environments. The first was a simulated multi-cell Open Radio Access Network (O-RAN) set-up, which mimics several mobile masts working together. The second was a fully virtual 5G core network built with open-source software (OpenAirInterface) and controlled through the real-time FlexRIC platform.
Real-world attack scenarios and results
Across both environments, TwinGuard detected and blocked attacks in under 100 milliseconds. These included a handover flooding attack (fake signals that try to overwhelm the system managing connections between masts) and an E2 subscription flooding attack, where a malicious app bombards the network controller with data requests to disrupt normal operation.
“Attackers rarely come through the front door anymore. They probe, adapt and escalate in ways that traditional defenses simply weren’t designed to handle. What TwinGuard demonstrates is that mobile networks can learn to recognize these behaviors as they unfold, and respond accordingly, rather than relying on pre-defined rules. That shift is essential if we want future 6G networked systems to be resilient and remain dependable in the face of increasingly agile threats,” says Dr. Sotiris Moschoyiannis, reader in complex systems.
Why behavior-based security is crucial
Unusual activity can be difficult to spot because today’s 5G networks are built from many different components working together. Hackers often hide their movements by mimicking normal traffic or escalating slowly over time. With 6G expected to arrive in the early 2030s, researchers say the next generation of mobile networks will need security systems that learn behavioral patterns rather than relying on fixed warning signs.
“Static, rule-based security systems simply cannot keep pace with the speed and complexity of attacks on modern 5G networks. Our defense framework lets the AI learn directly from a virtual copy of the live network, so it understands what ‘normal’ looks like and can spot trouble before any impact. The fact that it can shut down attacks in under a tenth of a second shows how important real-time, AI-driven defense will be for future 6G networks,” says Dr. Mohammad Shojafar, associate professor in network security.
“As the researcher and developer behind TwinGuard, I designed the framework to link real-time network data with an intelligent Digital Twin, enabling our reinforcement learning agent to anticipate and stop control-plane attacks in O-RAN networks in under 10 milliseconds,” says Neha Gupta, Researcher and Developer at Surrey’s 5G/6G Innovation Centre (6GIC), who is behind the TwinGuard framework.
The study was initially presented at the 2025 IEEE International Conference on Trust, Security and Privacy in Computing and Communications and published as a result. The research team now plans to expand the framework to larger, multi-cell environments, bringing it another step closer to deployment in future 6G systems.
More information
Neha Gupta et al, TwinGuard: A Proactive RL-Driven Defence Framework for Digital Twin-Enabled O-RAN Security, 2025 IEEE 24th International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom) (2025). DOI: 10.1109/trustcom66490.2025.00240
Leave a Reply