Hybrid Quantum–Classical Anomaly Detection for 5G Roaming Signalling with QKD/QSDC Support

Signalling traffic in 5G Interconnect and Roaming Networks (IRNs) over the IP eXchange (IPX) faces man-in-the-middle (MITM) interception on N32 and GTP-U, billing fraud, and “Harvest Now, Decrypt Later” (HNDL) adversaries. This paper develops and validates qSiP, a hybrid quantum–classical framework integrating Quantum Key Distribution (QKD, BB84 decoy-state protocol) and Quantum Secure Direct Communication (QSDC, DL04) at OSI Layers 1–2 with a classical-plus-quantum ML classifier for signalling anomaly and billing-fraud detection. Evaluation spans NS-3, Mininet, and MicroK8s on a dual-PLMN Open5GS testbed with PacketRusher NB-IoT traffic and STRIDE-L threat modelling. Cryptographically, qSiP holds BB84 QBER within decoy-state thresholds, sustains key rates matched to N32 timing, and under HNDL conditions bounds adversary exposure to one key-rotation interval; N32 captures confirm 3GPP message format and handshake semantics end-to-end. For detection, the Hybrid configuration reaches 98.5–99.5% accuracy across environments (vs. 89.4–96.0% classical), reduces undetected billing fraud over four roaming paths, and adds under 5 ms latency per signalling exchange. Statistical tests confirm hybrid > classical at p < 0.05 across eMBB, uRLLC, mMTC, and BCE. The work contributes an integrated framework with simulation-based empirical validation in a standards-aligned 5G SA testbed and a methodological commitment for future quantum-roaming research: quantum ML detects but does not encrypt, while QKD/QSDC encrypt does not classify; these are two complementary, non-interchangeable roles.