Supervised Machine Learning-Based Intrusion Detection for 5G Networks: Evaluation on the 5G-NIDD Dataset

The evolution of 5G networks has introduced new challenges in securing mobile infrastructures against increasingly sophisticated cyber threats. Intrusion detection in such environments has been widely studied using traditional datasets such as the Canadian Institute for Cybersecurity Intrusion Detection Systems CICIDS2017, the University of New South Wales-Network Behavior UNSW-NB15, and The Network Security Laboratory-Knowledge Discovery in Databases NSL-KDD; however, these benchmarks lack the architectural complexity and protocol diversity inherent to 5G networks. More recent research has adopted the 5G-NIDD dataset (5G Network Intrusion Detection Dataset), which provides realistic traffic generated from a live 5G testbed, including various attack scenarios targeting MEC servers and core network components. Nevertheless, existing works using 5G-NIDD often focus on limited subsets of attacks, rely on unsupervised or federated learning approaches, and lack comprehensive evaluations of supervised learning models. In contrast, this study leverages the entire 5G-NIDD dataset, encompassing all available attack scenarios, and conducts a systematic comparison of multiple supervised learning algorithms. A systematic evaluation of supervised learning algorithms is conducted using key performance metrics such as accuracy, precision, recall and F1-score to identify the most effective model for intrusion detection in 5G environments. Specifically, this study focuses on four supervised learning algorithms, K-Nearest Neighbors (KNNs), Support Vector Machines (SVMs), Logistic Regression (LR), and Naive Bayes (NB), to determine not only which achieves the highest detection accuracy but also which offers the best balance between predictive performance and computational efficiency in realistic 5G environments. To assess robustness and adaptability, the proposed models are further validated on two widely used benchmark datasets, namely CICIDS2017 and UNSW-NB15, as part of an extended analysis. This cross-dataset evaluation highlights each algorithm’s strengths and limitations under diverse network traffic conditions and attack scenarios. The results aim to validate the applicability of supervised learning approaches to intrusion detection in next-generation network infrastructures, while also emphasizing the importance of balancing predictive accuracy with computational efficiency for real-world deployment.