Operational lifecycle of interpretable multi-plane intrusion detection in 5G networks

Machine-learning-based intrusion detection systems for 5G networks achieve high classification accuracy on known attack categories, yet their operational lifecycle remains uncharacterized: how they degrade over time, how they respond to attacks not seen during training, and what maintenance they require on each protocol plane. This paper investigates that lifecycle for a multi-plane detection system built on an Explainable Boosting Machine, evaluated across five 5G protocol planes covering user-plane, control-plane, signaling, and service-based traffic. Three feature engineering modules (per-flow statistics, rolling temporal differentials, and chaos-theoretic descriptors) are available per plane, with the module that maximizes cross-validated F1 chosen during training. Six operational dimensions are stress-tested: white-box adversarial robustness, out-of-distribution detection, temporal concept drift with per-feature diagnosis, few-shot incremental update, cross-source transferability, and explanation stability. Interpretability emerges as a working tool for lifecycle management, not merely an audit property: shape function drift localizes concept drift to specific traffic features, an investigation that opaque classifiers cannot enable. At the same time, the exposed decision logic creates a measurable adversarial vulnerability, and one-class detectors outperform the supervised classifier as out-of-distribution gates on four of five planes. The labeled-attack budget for few-shot recovery varies by orders of magnitude across planes, a finding that informs deployment planning. These results are consolidated into a per-plane operational configuration guide.