{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,9,3]],"date-time":"2026-09-03T07:15:46Z","timestamp":1788419746741,"version":"build-2803163510"},"reference-count":46,"publisher":"Frontiers Media SA","license":[{"start":{"date-parts":[[2026,9,3]],"date-time":"2026-09-03T00:00:00Z","timestamp":1788393600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":["frontiersin.org"],"crossmark-restriction":true},"short-container-title":["Front. Artif. Intell."],"abstract":"<jats:sec>\n                    <jats:title>Introduction<\/jats:title>\n                    <jats:p>The integration of 5G and Software-Defined Networking (SDN) has introduced new security challenges due to limited processing capabilities, inefficient resource allocation, frequent user mobility, and the rapid growth of Internet of Things (IoT) devices. These dynamic network conditions increase the likelihood of malicious activities, highlighting the need for robust and intelligent intrusion detection techniques.<\/jats:p>\n                  <\/jats:sec>\n                  <jats:sec>\n                    <jats:title>Methods<\/jats:title>\n                    <jats:p>This research introduces a hybrid intrusion detection framework, termed APCHC-DDST-IV-CLSTM-ICWO, which integrates Affinity Propagated Cohesive Hierarchical Clustering, Deep Dual Stream SpaTemp Info-Varcoder, Dense Convolutional Long Short-Term Memory (CLSTM), and Improved Chaotic Walrus Optimization. The clustering module identifies attack patterns, while the dual-stream Info-Varcoder extracts representative spatial and temporal features. The Dense CLSTM captures sequential dependencies in network traffic to improve attack classification, and the Improved Chaotic Walrus Optimisation algorithm optimises the model parameters to enhance predictive performance. The proposed approach was validated using a 5G-SDN dataset generated with the MATLAB SDN Toolbox, with network traffic and attack scenarios simulated through the NS-3 network simulator.<\/jats:p>\n                  <\/jats:sec>\n                  <jats:sec>\n                    <jats:title>Results<\/jats:title>\n                    <jats:p>The model showed a superior classification performance with a high average accuracy of 0.985\u00b10.002, precision of 0.984\u00b10.003, and F1 score of 0.985\u00b10.003. The model\u2019s low log-loss of 0.411 allows for the accurate separation of attack categories, including unknown attacks. This method improves the security and performance of 5G-SDN by increasing the throughput to 3218 samples\/second and the detection time to 1.74 seconds.<\/jats:p>\n                  <\/jats:sec>\n                  <jats:sec>\n                    <jats:title>Discussion<\/jats:title>\n                    <jats:p>The results of the experiment demonstrate that the proposed APCHC-DDST-IV-CLSTM-ICWO framework offers a feasible method to secure 5G-SDN networks. The system provides high detection accuracy, effective processing, and reliable identification of emerging cyber threats by combining hierarchical clustering, deep feature learning, sequence modeling, and optimization algorithms. These findings indicate that it is appropriate for improving the operational effectiveness and security of next-generation 5G-SDN configurations.<\/jats:p>\n                  <\/jats:sec>","DOI":"10.3389\/frai.2026.1832131","type":"journal-article","created":{"date-parts":[[2026,9,3]],"date-time":"2026-09-03T06:40:02Z","timestamp":1788417602000},"update-policy":"https:\/\/doi.org\/10.3389\/crossmark-policy","source":"Crossref","is-referenced-by-count":0,"title":["Advanced security framework for 5G-SDN attack detection and mitigation using Affinity Cohesive Clustering and Improved Chaotic Walrus-Optimized Convolutional LSTM with Deep Dual Info-Varcoder"],"prefix":"10.3389","volume":"9","author":[{"given":"Shameli","family":"R.","sequence":"first","affiliation":[{"name":"School of Electronics Engineering, Vellore Institute of Technology","place":["Vellore, Tamil Nadu, India"]}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Sujatha","family":"Rajkumar","sequence":"additional","affiliation":[{"name":"School of Electronics Engineering, Vellore Institute of Technology","place":["Vellore, Tamil Nadu, India"]}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"1965","published-online":{"date-parts":[[2026,9,3]]},"reference":[{"key":"ref1","first-page":"207","volume-title":"In Software-Defined Network Frameworks, Security Issues and Use Cases","author":"Aanandaram","year":"2024"},{"key":"ref2","doi-asserted-by":"publisher","first-page":"10179","DOI":"10.1109\/ACCESS.2021.3049945","article-title":"Modelling and evaluation of software defined networking based 5G core network architecture","volume":"9","author":"Abdulghaffar","year":"2021","journal-title":"IEEE Access"},{"key":"ref3","doi-asserted-by":"publisher","first-page":"107364","DOI":"10.1016\/j.comnet.2020.107364","article-title":"Multi-layered intrusion detection and prevention in the SDN\/NFV enabled cloud of 5G networks using AI-based defense mechanisms","volume":"179","author":"Abdulqadder","year":"2020","journal-title":"Comput. Netw."},{"key":"ref4","doi-asserted-by":"publisher","first-page":"339","DOI":"10.1016\/j.future.2022.11.008","article-title":"The DAG blockchain: a secure edge-assisted honeypot for attack detection and multi-controller based load balancing in SDN 5G","volume":"141","author":"Abdulqadder","year":"2023","journal-title":"Futur. Gener. Comput. Syst."},{"key":"ref5","doi-asserted-by":"publisher","first-page":"1627","DOI":"10.1007\/s41870-023-01469-3","article-title":"ML assisted snort and Zeek in detecting DDoS attacks in software-defined networking","volume":"16","author":"AbdulRaheem","year":"2024","journal-title":"Int. J. Inf. Technol."},{"key":"ref6","first-page":"1","author":"Afroj","year":"2024"},{"key":"ref7","first-page":"1","author":"Aguayo","year":"2023"},{"key":"ref8","doi-asserted-by":"publisher","first-page":"53015","DOI":"10.1109\/ACCESS.2022.3172304","article-title":"Cyber threats detection in smart environments using SDN-enabled DNN-LSTM hybrid framework","volume":"10","author":"Al Razib","year":"2022","journal-title":"IEEE Access"},{"key":"ref9","doi-asserted-by":"publisher","first-page":"7085","DOI":"10.1109\/ACCESS.2023.3237851","article-title":"A2T-boost: an adaptive cell selection approach for 5G\/SDN-based vehicular networks","volume":"11","author":"AlAblani","year":"2023","journal-title":"IEEE Access"},{"key":"ref10","doi-asserted-by":"publisher","first-page":"9","DOI":"10.5120\/ijca2021921027","article-title":"ML for securing SDN based 5G network","volume":"174","author":"Alamri","year":"2021","journal-title":"Int. J. Comput. Appl."},{"key":"ref11","doi-asserted-by":"publisher","first-page":"100316","DOI":"10.1016\/j.array.2023.100316","article-title":"Capturing low-rate DDos attack based on MQTT protocol in software defined-IoT environment","volume":"19","author":"Al-Fayoumi","year":"2023","journal-title":"Array"},{"key":"ref12","doi-asserted-by":"publisher","first-page":"254","DOI":"10.1016\/j.procs.2021.07.032","article-title":"DL algorithms for detecting denial of service attacks in software-defined networks","volume":"191","author":"Alshra\u2019a","year":"2021","journal-title":"Procedia Comput. Sci."},{"key":"ref13","doi-asserted-by":"publisher","first-page":"100870","DOI":"10.1016\/j.iot.2023.100870","article-title":"An intelligent fuzzy-based system for handover decision in 5G-IoT networks considering network slicing and SDN technologies","volume":"23","author":"Ampririt","year":"2023","journal-title":"Internet Things"},{"key":"ref14","first-page":"1","author":"Andrade","year":"2024"},{"key":"ref15","doi-asserted-by":"publisher","first-page":"1","DOI":"10.32604\/cmc.2026.074930","article-title":"Graph neural networks with multi-head attention and SHAP-based explainability for robust, interpretable, and high-throughput intrusion detection in 5G-enabled software defined networks","volume":"87","author":"Azeez","year":"2026","journal-title":"Comput. Mater. Contin."},{"key":"ref16","first-page":"185","author":"Bakar","year":"2024"},{"key":"ref17","doi-asserted-by":"publisher","first-page":"100580","DOI":"10.1016\/j.measen.2022.100580","article-title":"Network intrusion detection in software defined networking with self-organized constraint-based intelligent learning framework","volume":"24","author":"Bhardwaj","year":"2022","journal-title":"Meas.: Sens."},{"key":"ref18","volume-title":"CICIDS 2017 Dataset","year":"2017"},{"key":"ref19","author":"Chatzimiltis","year":"2024"},{"key":"ref20","first-page":"816","author":"Cui","year":"2020"},{"key":"ref21","doi-asserted-by":"publisher","first-page":"165263","DOI":"10.1109\/ACCESS.2020.3022633","article-title":"InSDN: A novel SDN intrusion dataset","volume":"8","author":"Elsayed","year":"2020","journal-title":"IEEE Access"},{"key":"ref22","doi-asserted-by":"publisher","first-page":"107927","DOI":"10.1016\/j.comcom.2024.107927","article-title":"DTL-5G: deep transfer learning-based DDoS attack detection in 5G and beyond networks","volume":"228","author":"Farzaneh","year":"2024","journal-title":"Comput. Commun."},{"key":"ref23","doi-asserted-by":"crossref","first-page":"622","DOI":"10.1109\/FNWF55208.2022.00114","volume-title":"2022 IEEE Future Networks World Forum (FNWF)","author":"Fern\u00e1ndez-Carrasco","year":"2022"},{"key":"ref24","doi-asserted-by":"publisher","first-page":"501","DOI":"10.3390\/biomimetics9080501","article-title":"An improved binary walrus optimizer with golden sine disturbance and population regeneration mechanism to solve feature selection problems","volume":"9","author":"Geng","year":"2024","journal-title":"Biomimetics"},{"key":"ref25","doi-asserted-by":"publisher","first-page":"53972","DOI":"10.1109\/ACCESS.2020.2976908","article-title":"A deep CNN ensemble framework for efficient DDoS attack detection in software defined networks","volume":"8","author":"Haider","year":"2020","journal-title":"IEEE Access"},{"key":"ref26","doi-asserted-by":"publisher","first-page":"4344","DOI":"10.3390\/s24134344","article-title":"Traffic feature selection and distributed denial of service attack detection in software-defined networks based on ML","volume":"24","author":"Han","year":"2024","journal-title":"Sensors"},{"key":"ref27","doi-asserted-by":"publisher","first-page":"104826","DOI":"10.1016\/j.rineng.2025.104826","article-title":"DeepTransIDS: transformer-based DL model for detecting DDoS attacks on 5G NIDD","volume":"26","author":"Harshdeep","year":"2025","journal-title":"Results Eng."},{"key":"ref28","doi-asserted-by":"publisher","first-page":"23013","DOI":"10.1109\/ACCESS.2025.3535943","article-title":"Comprehensive analysis of DDoS anomaly detection in software-defined networks","volume":"13","author":"Hirsi","year":"2025","journal-title":"IEEE Access"},{"key":"ref29","doi-asserted-by":"publisher","first-page":"514","DOI":"10.14569\/IJACSA.2024.0150551","article-title":"Enhancing SDN anomaly detection: a hybrid DL model with SCA-TSO optimization","volume":"15","author":"Jaber Alhilo","year":"2024","journal-title":"Int. J. Adv. Comput. Sci. Appl."},{"key":"ref30","doi-asserted-by":"publisher","first-page":"2753","DOI":"10.1007\/s11277-023-10402-7","article-title":"Survey on joint paradigm of 5G and SDN emerging mobile technologies: architecture, security, challenges and research directions","volume":"130","author":"Kazmi","year":"2023","journal-title":"Wirel. Pers. Commun."},{"key":"ref31","doi-asserted-by":"publisher","first-page":"28934","DOI":"10.1109\/ACCESS.2023.3260256","article-title":"FMDADM: a multi-layer DDoS attack detection and mitigation framework using ML for stateful SDN-based IoT networks","volume":"11","author":"Khedr","year":"2023","journal-title":"IEEE Access"},{"key":"ref32","doi-asserted-by":"publisher","first-page":"9436","DOI":"10.1109\/TIFS.2024.3472477","article-title":"rDefender: a lightweight and robust defense against flow table overflow attacks in SDN","volume":"19","author":"Kong","year":"2024","journal-title":"IEEE Trans. Inf. Forensics Secur."},{"key":"ref33","doi-asserted-by":"publisher","first-page":"8368","DOI":"10.1007\/s11227-022-05008-y","article-title":"A survey on software-defined vehicular networks (SDVNs): a security perspective","volume":"79","author":"Kumar","year":"2023","journal-title":"J. Supercomput."},{"key":"ref34","first-page":"79","author":"Liu","year":"2024"},{"key":"ref35","doi-asserted-by":"publisher","first-page":"331","DOI":"10.3390\/fi16090331","article-title":"A complete EDA and DL pipeline for Softwarized 5G network intrusion detection","volume":"16","author":"Moubayed","year":"2024","journal-title":"Future Internet"},{"key":"ref36","doi-asserted-by":"publisher","first-page":"112100","DOI":"10.1016\/j.comnet.2026.112100","article-title":"Design and evaluation of a robust and explainable intrusion detection framework for 5G\/B5G networks","volume":"278","author":"Nezhadsistani","year":"2026","journal-title":"Comput. Netw."},{"key":"ref37","doi-asserted-by":"publisher","first-page":"154","DOI":"10.1109\/MNET.021.1900599","article-title":"Enhancing 5G SDN\/NFV edge with P4 data plane programmability","volume":"35","author":"Paolucci","year":"2021","journal-title":"IEEE Netw."},{"key":"ref38","doi-asserted-by":"publisher","first-page":"1836","DOI":"10.3390\/electronics13101836","article-title":"Adaptive multi-criteria selection for efficient resource allocation in frugal heterogeneous Hadoop clusters","volume":"13","author":"Qureshi","year":"2024","journal-title":"Electronics"},{"key":"ref39","doi-asserted-by":"publisher","first-page":"e271","DOI":"10.1002\/spy2.271","article-title":"Security in 5G and beyond recent advances and future challenges","volume":"6","author":"Salahdine","year":"2023","journal-title":"Secur. Priv."},{"key":"ref40","doi-asserted-by":"publisher","first-page":"565","DOI":"10.1109\/TLA.2023.10128928","article-title":"Fine-grained traffic classification based on improved residual convolutional network in software defined networks","volume":"21","author":"Su","year":"2023","journal-title":"IEEE Lat. Am. Trans."},{"key":"ref41","doi-asserted-by":"publisher","first-page":"97058","DOI":"10.1109\/ACCESS.2025.3575494","article-title":"A survey on data plane security in software-defined networks: toward adaptive security of data planes","volume":"13","author":"Tankovic","year":"2025","journal-title":"IEEE Access"},{"key":"ref42","first-page":"1","author":"Tavallaee","year":"2009"},{"key":"ref43","doi-asserted-by":"publisher","first-page":"77518","DOI":"10.1109\/ACCESS.2023.3296311","article-title":"5G aviation networks using novel AI approach for DDoS detection","volume":"11","author":"Whitworth","year":"2023","journal-title":"IEEE Access"},{"key":"ref44","doi-asserted-by":"publisher","first-page":"135535","DOI":"10.1109\/ACCESS.2024.3464529","article-title":"PSO-GA hyperparameter optimized ResNet-BiGRU-based intrusion detection method","volume":"12","author":"Xia","year":"2024","journal-title":"IEEE Access"},{"key":"ref45","doi-asserted-by":"publisher","first-page":"29175","DOI":"10.1109\/ACCESS.2024.3369613","article-title":"Formal-guided fuzz testing: targeting security assurance from specification to implementation for 5g and beyond","volume":"12","author":"Yang","year":"2024","journal-title":"IEEE Access"},{"key":"ref46","doi-asserted-by":"publisher","first-page":"108495","DOI":"10.1109\/ACCESS.2021.3101650","article-title":"SDN-based architecture for transport and application layer DDoS attack detection by using machine and DL","volume":"9","author":"Yungaicela-Naula","year":"2021","journal-title":"IEEE Access"}],"container-title":["Frontiers in Artificial Intelligence"],"original-title":[],"link":[{"URL":"https:\/\/www.frontiersin.org\/articles\/10.3389\/frai.2026.1832131\/full","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,9,3]],"date-time":"2026-09-03T06:40:04Z","timestamp":1788417604000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.frontiersin.org\/articles\/10.3389\/frai.2026.1832131\/full"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,9,3]]},"references-count":46,"alternative-id":["10.3389\/frai.2026.1832131"],"URL":"https:\/\/doi.org\/10.3389\/frai.2026.1832131","relation":{},"ISSN":["2624-8212"],"issn-type":[{"value":"2624-8212","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,9,3]]},"article-number":"1832131"}}