{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,6,5]],"date-time":"2026-06-05T04:44:04Z","timestamp":1780634644383,"version":"3.54.1"},"reference-count":40,"publisher":"Frontiers Media SA","license":[{"start":{"date-parts":[[2026,1,5]],"date-time":"2026-01-05T00:00:00Z","timestamp":1767571200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"DOI":"10.13039\/100018693","name":"HORIZON EUROPE Framework Programme","doi-asserted-by":"publisher","id":[{"id":"10.13039\/100018693","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["frontiersin.org"],"crossmark-restriction":true},"short-container-title":["Front. Artif. Intell."],"abstract":"<jats:p>The advent of 6G\/NextG networks offers numerous benefits, including extreme capacity, reliability, and efficiency. To mitigate emerging security threats, 6G\/NextG networks incorporate advanced artificial intelligence algorithms. However, existing studies on intrusion detection predominantly rely on deep neural networks with static components that are not conditionally dependent on the input, thereby limiting their representational power and efficiency. To address these issues, we present the first study to integrate a Mixture of Experts (MoE) architecture for the identification of malicious traffic. Specifically, we use network traffic data and convert the 1D feature array into a 2D matrix. Next, we pass this matrix through a convolutional neural network (CNN) layer, followed by batch normalization and max pooling layers. Subsequently, a sparsely gated MoE layer is used. This layer consists of a set of expert networks (dense layers) and a router that assigns weights to each expert's output. Sparsity is achieved by selecting only the most relevant experts from the full set. Finally, we conduct a series of ablation experiments to demonstrate the effectiveness of our proposed model. Experiments are conducted on the 5G-NIDD dataset, a network intrusion detection dataset generated from a real 5G test network, and the NANCY dataset, which includes cyberattacks from the O-RAN 5G Testbed Dataset. The results show that our introduced approach achieves accuracies of up to 99.96% and 79.59% on the 5G-NIDD and NANCY datasets, respectively. The findings also show that our proposed model offers multiple advantages over state-of-the-art approaches.<\/jats:p>","DOI":"10.3389\/frai.2025.1708953","type":"journal-article","created":{"date-parts":[[2026,1,5]],"date-time":"2026-01-05T07:43:43Z","timestamp":1767599023000},"update-policy":"https:\/\/doi.org\/10.3389\/crossmark-policy","source":"Crossref","is-referenced-by-count":8,"title":["Convolutional neural networks and mixture of experts for intrusion detection in 5G networks and beyond"],"prefix":"10.3389","volume":"8","author":[{"given":"Loukas","family":"Ilias","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"George","family":"Doukas","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Vangelis","family":"Lamprou","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Christos","family":"Ntanos","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Dimitris","family":"Askounis","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"1965","published-online":{"date-parts":[[2026,1,5]]},"reference":[{"key":"B1","first-page":"193","article-title":"\u201cA deep learning-based malware traffic classifier for 5G networks employing protocol-agnostic and pcap-to-embeddings techniques,\u201d","volume-title":"Proceedings of the 2023 European Interdisciplinary Cybersecurity Conference, EICC '23","author":"Agrafiotis","year":"2023"},{"key":"B2","doi-asserted-by":"crossref","first-page":"7120","DOI":"10.1109\/CVPR.2017.753","article-title":"\u201cExpert gate: lifelong learning with a network of experts,\u201d","volume-title":"2017 IEEE Conference on Computer Vision and Pattern Recognition (CVPR)","author":"Aljundi","year":"2017"},{"key":"B3","doi-asserted-by":"publisher","first-page":"1625891","DOI":"10.3389\/frai.2025.1625891","article-title":"A deep learning\/machine learning approach for anomaly based network intrusion detection","volume":"8","author":"Almuhanna","year":"2025","journal-title":"Front. Artif. Intell"},{"key":"B4","doi-asserted-by":"publisher","first-page":"108","DOI":"10.1016\/j.future.2021.04.017","article-title":"Gan augmentation to deal with imbalance in imaging-based intrusion detection","volume":"123","author":"Andresini","year":"2021","journal-title":"Future Gener. Comput. Syst"},{"key":"B5","doi-asserted-by":"publisher","first-page":"7094","DOI":"10.1007\/s10489-021-02205-9","article-title":"Unsupervised deep learning approach for network intrusion detection combining convolutional autoencoder and one-class SVM","volume":"51","author":"Binbusayyis","year":"2021","journal-title":"Appl. Intell"},{"key":"B6","doi-asserted-by":"publisher","DOI":"10.36227\/techrxiv.172055626.64129172\/v1","article-title":"A survey on mixture of experts","author":"Cai","year":"2024","journal-title":"techrXiv [preprint]"},{"key":"B7","doi-asserted-by":"publisher","first-page":"7783","DOI":"10.1109\/TIFS.2024.3441862","article-title":"Early network intrusion detection enabled by attention mechanisms and RNNS","volume":"19","author":"Djaidja","year":"2024","journal-title":"IEEE Trans. Inf. Forensics Secur"},{"key":"B8","doi-asserted-by":"publisher","author":"Elsayed","year":"2020","DOI":"10.1109\/WoWMoM49955.2020.00072"},{"key":"B9","doi-asserted-by":"publisher","first-page":"107927","DOI":"10.1016\/j.comcom.2024.107927","article-title":"Dtl-5G: deep transfer learning-based ddos attack detection in 5G and beyond networks","volume":"228","author":"Farzaneh","year":"2024","journal-title":"Comput. Commun"},{"key":"B10","doi-asserted-by":"publisher","first-page":"124215","DOI":"10.1016\/j.eswa.2024.124215","article-title":"Real-time fusion multi-tier DNN-based collaborative idps with complementary features for secure UAV-enabled 6G networks","volume":"252","author":"Hadi","year":"2024","journal-title":"Expert Syst. Appl"},{"key":"B11","doi-asserted-by":"publisher","first-page":"7436","DOI":"10.1109\/TPAMI.2021.3117837","article-title":"Dynamic neural networks: a survey","volume":"44","author":"Han","year":"2022","journal-title":"IEEE Trans. Pattern Anal. Mach. Intell"},{"key":"B12","doi-asserted-by":"publisher","first-page":"79","DOI":"10.1162\/neco.1991.3.1.79","article-title":"Adaptive mixtures of local experts","volume":"3","author":"Jacobs","year":"1991","journal-title":"Neural Comput"},{"key":"B13","doi-asserted-by":"publisher","first-page":"334","DOI":"10.1109\/OJCOMS.2021.3057679","article-title":"The road towards 6G: a comprehensive survey","volume":"2","author":"Jiang","year":"2021","journal-title":"IEEE Open J. Commun. Soc"},{"key":"B14","doi-asserted-by":"publisher","first-page":"105","DOI":"10.1186\/s40537-020-00379-6","article-title":"Performance analysis of intrusion detection systems using a feature selection method on the unsw-nb15 dataset","volume":"7","author":"Kasongo","year":"2020","journal-title":"J. Big Data"},{"key":"B15","doi-asserted-by":"publisher","DOI":"10.21227\/32k1-dr12","article-title":"\u201cDOS\/DDOS attack dataset of 5G network slicing,\u201d","author":"Khan","year":"2023","journal-title":"IEEE Dataport"},{"key":"B16","author":"Liatifis","year":"2024","journal-title":"Nancy SNS JU Project"},{"key":"B17","doi-asserted-by":"publisher","first-page":"103560","DOI":"10.1016\/j.cose.2023.103560","article-title":"A cognitive security framework for detecting intrusions in IOT and 5G utilizing deep learning","volume":"136","author":"Lilhore","year":"2024","journal-title":"Comput. Secur"},{"key":"B18","doi-asserted-by":"publisher","first-page":"3920","DOI":"10.1109\/OJCOMS.2024.3416808","article-title":"From 5G to 6G networks: a survey on AI-based jamming and interference detection and mitigation","volume":"5","author":"Lohan","year":"2024","journal-title":"IEEE Open J. Commun. Soc"},{"key":"B19","doi-asserted-by":"publisher","DOI":"10.48550\/arXiv.1802.09089","article-title":"Kitsune: an ensemble of autoencoders for online network intrusion detection","author":"Mirsky","year":"2018","journal-title":"arXiv [preprint]"},{"key":"B20","doi-asserted-by":"publisher","first-page":"1520741","DOI":"10.3389\/fcomp.2025.1520741","article-title":"Evaluating machine learning-based intrusion detection systems with explainable ai: enhancing transparency and interpretability","volume":"7","author":"Mohale","year":"2025","journal-title":"Front. Comput. Sci"},{"key":"B21","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1109\/MilCIS.2015.7348942","article-title":"\u201cUNSW-NB15: a comprehensive data set for network intrusion detection systems (UNSW-NB15 network data set),\u201d","volume-title":"2015 Military Communications and Information Systems Conference (MilCIS)","author":"Moustafa","year":"2015"},{"key":"B22","unstructured":"A detailed analysis of cicids2017 dataset for designing intrusion detection systems\n          \n          479\n          482\n          \n            \n              Panigrahi\n              R.\n            \n            \n              Borah\n              S.\n            \n          \n          Int. J. Eng. Technol\n          7\n          2018"},{"key":"B23","doi-asserted-by":"publisher","first-page":"115827","DOI":"10.1109\/ACCESS.2023.3325721","article-title":"Real-time clustering based on deep embeddings for threat detection in 6G networks","volume":"11","author":"Paolini","year":"2023","journal-title":"IEEE Access"},{"key":"B24","doi-asserted-by":"publisher","first-page":"1155","DOI":"10.1109\/OJCOMS.2024.3363082","article-title":"Real-time network packet classification exploiting computer vision architectures","volume":"5","author":"Paolini","year":"2024","journal-title":"IEEE Open J. Commun. Soc"},{"key":"B25","volume-title":"PyTorch: An Imperative Style, High-Performance Deep Learning Library","author":"Paszke","year":"2019"},{"key":"B26","doi-asserted-by":"publisher","first-page":"1094","DOI":"10.1109\/OJCOMS.2021.3078081","article-title":"The roadmap to 6G security and privacy","volume":"2","author":"Porambage","year":"2021","journal-title":"IEEE Open J. Commun. Soc"},{"key":"B27","doi-asserted-by":"publisher","first-page":"7125","DOI":"10.1109\/OJCOMS.2025.3594284","article-title":"Jamming intrusions in extreme bandwidth communication: a comprehensive overview","volume":"6","author":"Priyadarshani","year":"2025","journal-title":"IEEE Open J. Commun. Soc"},{"key":"B28","doi-asserted-by":"crossref","DOI":"10.5121\/csit.2024.141408","article-title":"\u201cSecurity, trust and privacy challenges in ai-driven 6G networks,\u201d","volume-title":"Computer Science, Engineering and Information Technology, CSEIT","author":"Rif\u00e0-Pous","year":"2024"},{"key":"B29","doi-asserted-by":"publisher","first-page":"134","DOI":"10.1109\/MNET.001.1900287","article-title":"A vision of 6G wireless systems: applications, trends, technologies, and open research problems","volume":"34","author":"Saad","year":"2020","journal-title":"IEEE Netw"},{"key":"B30","doi-asserted-by":"publisher","first-page":"1243","DOI":"10.1007\/s13042-024-02332-y","article-title":"5G-SIID: an intelligent hybrid DDoS intrusion detector for 5G IOT networks","volume":"16","author":"Sadhwani","year":"2024","journal-title":"Int. J. Mach. Learn. Cybern"},{"key":"B31","doi-asserted-by":"publisher","DOI":"10.48550\/arXiv.2212.01298","article-title":"5G-NIDD: a comprehensive network intrusion detection dataset generated over 5G wireless network","author":"Samarakoon","year":"2022","journal-title":"arXiv [preprint]"},{"key":"B32","doi-asserted-by":"publisher","first-page":"108","DOI":"10.5220\/0006639801080116","article-title":"Toward generating a new intrusion detection dataset and intrusion traffic characterization","volume":"1","author":"Sharafaldin","year":"2018","journal-title":"ICISSP"},{"key":"B33","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1109\/CCST.2019.8888419","article-title":"\u201cDeveloping realistic distributed denial of service (DDoS) attack dataset and taxonomy,\u201d","volume-title":"2019 International Carnahan Conference on Security Technology (ICCST)","author":"Sharafaldin","year":"2019"},{"key":"B34","article-title":"\u201cOutrageously large neural networks: the sparsely-gated mixture-of-experts layer,\u201d","volume-title":"International Conference on Learning Representations","author":"Shazeer","year":"2017"},{"key":"B35","doi-asserted-by":"publisher","first-page":"4816","DOI":"10.1109\/TNSM.2024.3385385","article-title":"Evaluating federated learning-based intrusion detection scheme for next generation networks","volume":"21","author":"Singh","year":"2024","journal-title":"IEEE Trans. Netw. Serv. Manag"},{"key":"B36","doi-asserted-by":"publisher","first-page":"616","DOI":"10.1109\/EuCNC\/6GSummit51104.2021.9482503","article-title":"\u201cAI and 6G security: opportunities and challenges,\u201d","author":"Siriwardhana","year":"2021","journal-title":"2021 Joint European Conference on Networks and Communications"},{"key":"B37","doi-asserted-by":"publisher","first-page":"353","DOI":"10.1016\/j.inffus.2022.09.026","article-title":"Fusion of statistical importance for feature selection in deep neural network-based intrusion detection system","volume":"90","author":"Thakkar","year":"2023","journal-title":"Inf. Fusion"},{"key":"B38","first-page":"5689","article-title":"\u201cGAIN: missing data imputation using generative adversarial nets,\u201d","author":"Yoon","year":"2018","journal-title":"Proceedings of the 35th International Conference on Machine Learning, Volume 80 of Proceedings of Machine Learning Research (PMLR)"},{"key":"B39","doi-asserted-by":"publisher","first-page":"4705","DOI":"10.1109\/ICASSP48485.2024.10447814","article-title":"\u201cManticore: an unsupervised intrusion detection system based on contrastive learning in 5G networks,\u201d","author":"Yuan","year":"2024","journal-title":"ICASSP 2024"},{"key":"B40","doi-asserted-by":"publisher","first-page":"107315","DOI":"10.1016\/j.comnet.2020.107315","article-title":"An effective convolutional neural network based on smote and gaussian mixture model for intrusion detection in imbalanced dataset","volume":"177","author":"Zhang","year":"2020","journal-title":"Comput. Netw"}],"container-title":["Frontiers in Artificial Intelligence"],"original-title":[],"link":[{"URL":"https:\/\/www.frontiersin.org\/articles\/10.3389\/frai.2025.1708953\/full","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,1,5]],"date-time":"2026-01-05T07:43:46Z","timestamp":1767599026000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.frontiersin.org\/articles\/10.3389\/frai.2025.1708953\/full"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,1,5]]},"references-count":40,"alternative-id":["10.3389\/frai.2025.1708953"],"URL":"https:\/\/doi.org\/10.3389\/frai.2025.1708953","relation":{},"ISSN":["2624-8212"],"issn-type":[{"value":"2624-8212","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,1,5]]},"article-number":"1708953"}}