AI-powered defence system stops 5G cyber-attacks in a fraction of a second

While modern 5G networks are becoming more open and flexible, making them easier to upgrade and cheaper to build, that also creates more opportunities for hackers. The Surrey-developed defence framework, called TwinGuard, addresses this challenge using a real-time digital twin – a live virtual replica of a mobile network that updates every few milliseconds. The team paired TwinGuard with reinforcement learning AI that can anticipate suspicious behaviour and shut down attacks before they cause disruption. 

Traditional security systems usually rely on recognising known attack patterns, which means that they can struggle to deal with new or rapidly changing threats. To test whether TwinGuard could respond more quickly, researchers used two realistic 5G environments. The first was a simulated multi-cell Open Radio Access Network (O-RAN) set-up, which mimics several mobile masts working together. The second was a fully virtual 5G core network built with open-source software (OpenAirInterface) and controlled through the real-time FlexRIC platform. 

Across both environments, TwinGuard detected and blocked attacks in under 100 milliseconds. These included a handover flooding attack (fake signals that try to overwhelm the system managing connections between masts) and an E2 subscription flooding attack, where a malicious app bombards the network controller with data requests to disrupt normal operation. 

The study was initially presented at the 2025 IEEE International Conference on Trust, Security and Privacy in Computing and Communications and published in IEEE Xplore. The research team now plans to expand the framework to larger, multi-cell environments, bringing it another step closer to deployment in future 6G systems 

###

Notes to editors