Granomaly: A Framework for Anomaly Detection in 5G Core Network Control Plane Traffic with Temporal Graph Neural Networks
T. A. Fritz, Alexander Schwankner, Jan-Hendrik Wissing, Robin Buchta, Gabi Dreo Rodosek · 2025
The 3rd Generation Partnership Project (3GPP) introduced a service-based architecture in the 5G core network, enabling flexible communication through modular network functions and the separation of control and user planes. While the integration of machine learning (ML) and artificial intelligence (AI) via the Network Data Analytics Function (NWDAF) has enhanced capabilities like anomaly detection and resource optimization, challenges persist in identifying unknown attacks, particularly within encrypted traffic. Current ML methods often fail to leverage the temporal graph structure inherent in network traffic, limiting their effectiveness. This paper proposes a novel anomaly detection framework, Granomaly, leveraging Temporal Graph Neural Networks (TGNNs) to analyze control plane traffic in 5G core networks. The framework includes a simulated 5G core network, two benchmark datasets tailored for TGNN anomaly detection, and the application of two TGNN methods. Results demonstrate that TG NN s effectively detect subtle traffic anomalies” improving the robustness and security of 5G networks.