{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,5,9]],"date-time":"2026-05-09T16:48:00Z","timestamp":1778345280084,"version":"3.51.4"},"reference-count":36,"publisher":"MDPI AG","issue":"11","license":[{"start":{"date-parts":[[2025,10,22]],"date-time":"2025-10-22T00:00:00Z","timestamp":1761091200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"name":"European Commission Horizon Europe Programme","award":["101168438"],"award-info":[{"award-number":["101168438"]}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Future Internet"],"abstract":"<jats:p>The transition to 5G networks brings unprecedented speed, ultra-low latency, and massive connectivity. Nevertheless, it introduces complex traffic patterns and broader attack surfaces that render traditional intrusion detection systems (IDSs) ineffective. Existing rule-based methods and classical machine learning approaches struggle to capture the temporal and dynamic characteristics of 5G traffic, while many deep learning models lack interpretability, making them unsuitable for high-stakes security environments. To address these challenges, we propose Bidirectional Temporal Anomaly Detector (BiTAD), a deep temporal learning architecture for anomaly detection in 5G networks. BiTAD leverages dual-direction temporal sequence modelling with attention to encode both past and future dependencies while focusing on critical segments within network sequences. Like many deep models, BiTAD\u2019s faces interpretability challenges. To resolve its \u201cblack-box\u201d nature, a dual-perspective explainability module, coined TwinLens, is proposed. This module integrates SHAP and TimeSHAP to provide global feature attribution and temporal relevance, delivering dual-perspective interpretability. Evaluated on the public 5G-NIDD dataset, BiTAD demonstrates superior detection performance compared to existing models. TwinLens enables transparent insights by identifying which features and when they were most influential to anomaly predictions. By jointly addressing the limitations in temporal modelling and interpretability, our work contributes a practical IDS framework tailored to the demands of next-generation mobile networks.<\/jats:p>","DOI":"10.3390\/fi17110482","type":"journal-article","created":{"date-parts":[[2025,10,23]],"date-time":"2025-10-23T05:20:44Z","timestamp":1761196844000},"page":"482","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":1,"title":["BiTAD: An Interpretable Temporal Anomaly Detector for 5G Networks with TwinLens Explainability"],"prefix":"10.3390","volume":"17","author":[{"given":"Justin Li Ting","family":"Lau","sequence":"first","affiliation":[{"name":"Faculty of Information Science and Technology, Multimedia University, Jalan Ayer Keroh Lama, Melaka 75450, Malaysia"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Ying Han","family":"Pang","sequence":"additional","affiliation":[{"name":"Faculty of Information Science and Technology, Multimedia University, Jalan Ayer Keroh Lama, Melaka 75450, Malaysia"},{"name":"Centre for Advanced Analytics, CoE for Artificial Intelligence, Multimedia University, Jalan Ayer Keroh Lama, Melaka 75450, Malaysia"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Charilaos","family":"Zarakovitis","sequence":"additional","affiliation":[{"name":"ICT Department, Axon Logic IKE, 14122 Athens, Greece"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Heng Siong","family":"Lim","sequence":"additional","affiliation":[{"name":"ICT Department, Axon Logic IKE, 14122 Athens, Greece"},{"name":"Faculty of Engineering and Technology, Multimedia University, Jalan Ayer Keroh Lama, Melaka 75450, Malaysia"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Dionysis","family":"Skordoulis","sequence":"additional","affiliation":[{"name":"ICT Department, Axon Logic IKE, 14122 Athens, Greece"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-3024-1011","authenticated-orcid":false,"given":"Shih Yin","family":"Ooi","sequence":"additional","affiliation":[{"name":"Faculty of Information Science and Technology, Multimedia University, Jalan Ayer Keroh Lama, Melaka 75450, Malaysia"},{"name":"Centre for Advanced Analytics, CoE for Artificial Intelligence, Multimedia University, Jalan Ayer Keroh Lama, Melaka 75450, Malaysia"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-1076-5034","authenticated-orcid":false,"given":"Kah Yoong","family":"Chan","sequence":"additional","affiliation":[{"name":"Faculty of Artificial Intelligence and Engineering, Multimedia University, Persiaran Multimedia, Cyberjaya 63100, Malaysia"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-8407-5648","authenticated-orcid":false,"given":"Wai Leong","family":"Pang","sequence":"additional","affiliation":[{"name":"School of Engineering, Taylor\u2019s University, Subang Jaya 47500, Malaysia"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"1968","published-online":{"date-parts":[[2025,10,22]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","first-page":"39","DOI":"10.3390\/network3010003","article-title":"On Attacking Future 5G Networks with Adversarial Examples: Survey","volume":"3","author":"Zolotukhin","year":"2022","journal-title":"Network"},{"key":"ref_2","doi-asserted-by":"crossref","unstructured":"Mohale, V.Z., and Obagbuwa, I.C. (2025). Evaluating machine learning-based intrusion detection systems with explainable AI: Enhancing transparency and interpretability. Front. Comput. Sci., 7.","DOI":"10.3389\/fcomp.2025.1520741"},{"key":"ref_3","first-page":"733","article-title":"Hybrid Machine Learning Framework for Anomaly Detection in 5G Networks","volume":"10","author":"Pavani","year":"2025","journal-title":"J. Inf. Syst. Eng. Manag."},{"key":"ref_4","doi-asserted-by":"crossref","unstructured":"Rabih, R., Vahdat-Nejad, H., Mansoor, W., and Joloudari, J.H. (2025). Highly accurate anomaly based intrusion detection through integration of the local outlier factor and convolutional neural network. Sci. Rep., 15.","DOI":"10.1038\/s41598-025-08175-z"},{"key":"ref_5","doi-asserted-by":"crossref","unstructured":"Wang, Z., Fok, K.W., and Thing, V.L.L. (2024, January 2\u20134). Emerging Trends in 5G Malicious Traffic Analysis: Enhancing Incremental Learning Intrusion Detection Strategies. Proceedings of the 2024 IEEE International Conference on Cyber Security and Resilience, CSR, London, UK.","DOI":"10.1109\/CSR61664.2024.10679434"},{"key":"ref_6","first-page":"397","article-title":"Network Anomaly Detection in 5G Networks","volume":"9","author":"Rahman","year":"2022","journal-title":"Math. Model. Eng. Probl."},{"key":"ref_7","doi-asserted-by":"crossref","unstructured":"Noor, K., Imoize, A.L., Li, C.-T., and Weng, C.-Y. (2025). A Review of Machine Learning and Transfer Learning Strategies for Intrusion Detection Systems in 5G and Beyond. Mathematics, 13.","DOI":"10.3390\/math13071088"},{"key":"ref_8","doi-asserted-by":"crossref","unstructured":"Waghmode, P., Kanumuri, M., El-Ocla, H., and Boyle, T. (2025). Intrusion detection system based on machine learning using least square support vector machine. Sci. Rep., 15.","DOI":"10.1038\/s41598-025-95621-7"},{"key":"ref_9","doi-asserted-by":"crossref","unstructured":"Kurochkin, I.I., and Volkov, S.S. (2020, January 10\u201313). Using GRU based deep neural network for intrusion detection in software-defined networks. Proceedings of the IOP Conference Series: Materials Science and Engineering, Ulaanbaatar, Mongolia.","DOI":"10.1088\/1757-899X\/927\/1\/012035"},{"key":"ref_10","first-page":"141","article-title":"Intrusion Detection Systems Based on RNN and GRU Models using CSE-CIC-IDS2018 Dataset in AWS Cloud","volume":"16","author":"Kamel","year":"2024","journal-title":"J. Al-Qadisiyah Comput. Sci. Math."},{"key":"ref_11","first-page":"6","article-title":"Construction of a network intrusion detection system based on a convolutional neural network and a bidirectional gated recurrent unit with attention mechanism","volume":"3","author":"Nikitenko","year":"2024","journal-title":"East.-Eur. J. Enterp. Technol."},{"key":"ref_12","doi-asserted-by":"crossref","first-page":"8467","DOI":"10.1007\/s40747-024-01577-y","article-title":"SAGB: Self-attention with gate and BiGRU network for intrusion detection","volume":"10","author":"Hu","year":"2024","journal-title":"Complex Intell. Syst."},{"key":"ref_13","doi-asserted-by":"crossref","unstructured":"Zhang, J., Zhang, X., Liu, Z., Fu, F., Jiao, Y., and Xu, F. (2023). A Network Intrusion Detection Model Based on BiLSTM with Multi-Head Attention Mechanism. Electronics, 12.","DOI":"10.3390\/electronics12194170"},{"key":"ref_14","unstructured":"Samarakoon, S., Siriwardhana, Y., Porambage, P., Liyanage, M., Chang, S.-Y., Kim, J., and Ylianttila, M. (2022). 5G-NIDD: A Comprehensive Network Intrusion Detection Dataset Generated over 5G Wireless Network. arXiv."},{"key":"ref_15","doi-asserted-by":"crossref","first-page":"107927","DOI":"10.1016\/j.comcom.2024.107927","article-title":"DTL-5G: Deep transfer learning-based DDoS attack detection in 5G and beyond networks","volume":"228","author":"Farzaneh","year":"2024","journal-title":"Comput. Commun."},{"key":"ref_16","doi-asserted-by":"crossref","first-page":"104826","DOI":"10.1016\/j.rineng.2025.104826","article-title":"DeepTransIDS: Transformer-Based Deep learning Model for Detecting DDoS Attacks on 5G NIDD","volume":"26","author":"Harshdeep","year":"2025","journal-title":"Results Eng."},{"key":"ref_17","doi-asserted-by":"crossref","first-page":"109956","DOI":"10.1016\/j.compeleceng.2024.109956","article-title":"ResACAG: A graph neural network based intrusion detection","volume":"122","author":"Zhang","year":"2024","journal-title":"Comput. Electr. Eng."},{"key":"ref_18","doi-asserted-by":"crossref","unstructured":"Peterson, J.M., Leevy, J.L., and Khoshgoftaar, T.M. (2021, January 23\u201326). A Review and Analysis of the Bot-IoT Dataset. Proceedings of the 15th IEEE International Conference on Service-Oriented System Engineering, SOSE 2021, Online.","DOI":"10.1109\/SOSE52839.2021.00007"},{"key":"ref_19","doi-asserted-by":"crossref","first-page":"32464","DOI":"10.1109\/ACCESS.2020.2973730","article-title":"Network Intrusion Detection Combined Hybrid Sampling with Deep Hierarchical Network","volume":"8","author":"Jiang","year":"2020","journal-title":"IEEE Access"},{"key":"ref_20","doi-asserted-by":"crossref","unstructured":"Moustafa, N., and Slay, J. (2015, January 10\u201312). UNSW-NB15: A Comprehensive Data Set for Network Intrusion Detection Systems (UNSW-NB15 Network Data Set). Proceedings of the 2015 Military Communications and Information Systems Conference (MilCIS), Canberra, Australia.","DOI":"10.1109\/MilCIS.2015.7348942"},{"key":"ref_21","first-page":"479","article-title":"A detailed analysis of CICIDS2017 dataset for designing Intrusion Detection Systems","volume":"7","author":"Borah","year":"2018","journal-title":"Int. J. Eng. Technol."},{"key":"ref_22","doi-asserted-by":"crossref","unstructured":"Hermosilla, P., Berr\u00edos, S., and Allende-Cid, H. (2025). Explainable AI for Forensic Analysis: A Comparative Study of SHAP and LIME in Intrusion Detection Models. Appl. Sci., 15.","DOI":"10.3390\/app15137329"},{"key":"ref_23","unstructured":"Kumar, A., and Thing, V.L.L. (2025). Evaluating The Explainability of State-of-the-Art Deep Learning-based Network Intrusion Detection Systems. arXiv."},{"key":"ref_24","doi-asserted-by":"crossref","first-page":"119000","DOI":"10.1016\/j.ins.2023.119000","article-title":"An explainable deep learning-enabled intrusion detection framework in IoT networks","volume":"639","author":"Keshk","year":"2023","journal-title":"Inf. Sci."},{"key":"ref_25","unstructured":"Lundberg, S., and Lee, S.-I. (2017, January 4\u20139). A Unified Approach to Interpreting Model Predictions. Proceedings of the 31st International Conference on Neural Information Processing Systems (NIPS\u201917), Long Beach, CA, USA."},{"key":"ref_26","doi-asserted-by":"crossref","unstructured":"Ribeiro, M.T., Singh, S., and Guestrin, C. (2016, January 13\u201317). Why Should I Trust You? Explaining the predictions of any classifier. Proceedings of the 22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, San Francisco, CA, USA.","DOI":"10.1145\/2939672.2939778"},{"key":"ref_27","doi-asserted-by":"crossref","unstructured":"Radoglou-Grammatikis, P., Nakas, G., Amponis, G., Giannakidou, S., Lagkas, T., Argyriou, V., Goudos, S., and Sarigiannidis, P. (2023, January 4\u20138). 5GCIDS: An Intrusion Detection System for 5G Core with AI and Explainability Mechanisms. Proceedings of the 2023 IEEE Globecom Workshops, GC Wkshps 2023, Kuala Lumpur, Malaysia.","DOI":"10.1109\/GCWkshps58843.2023.10464667"},{"key":"ref_28","doi-asserted-by":"crossref","unstructured":"Bento, J., Saleiro, P., Cruz, A.F., Figueiredo, M.A., and Bizarro, P. (2021, January 14\u201318). TimeSHAP: Explaining Recurrent Models through Sequence Perturbations. Proceedings of the ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, Virtually.","DOI":"10.1145\/3447548.3467166"},{"key":"ref_29","unstructured":"Li, B. (2024). Unsupervised Temporal Anomaly Detection: Time Series, Data Stream, and Interpretability. [Ph.D. Thesis, Technische Universit\u00e4t Dortmund]."},{"key":"ref_30","doi-asserted-by":"crossref","unstructured":"Islam, A., Chang, S.-Y., Kim, J., and Kim, J. (2024, January 17\u201319). Anomaly Detection in 5G using Variational Autoencoders. Proceedings of the 2024 Silicon Valley Cybersecurity Conference, SVCC 2024, Seoul, Republic of Korea.","DOI":"10.1109\/SVCC61185.2024.10637312"},{"key":"ref_31","doi-asserted-by":"crossref","unstructured":"Corea, P.M., Liu, Y., Wang, J., Niu, S., and Song, H. (2024, January 8\u201311). Explainable AI for Comparative Analysis of Intrusion Detection Models. Proceedings of the 2024 IEEE International Mediterranean Conference on Communications and Networking (MeditCom), Madrid, Spain.","DOI":"10.1109\/MeditCom61057.2024.10621339"},{"key":"ref_32","doi-asserted-by":"crossref","first-page":"30164","DOI":"10.1109\/ACCESS.2024.3368377","article-title":"Explainable AI for Intrusion Detection Systems: LIME and SHAP Applicability on Multi-Layer Perceptron","volume":"12","author":"Gaspar","year":"2024","journal-title":"IEEE Access"},{"key":"ref_33","doi-asserted-by":"crossref","first-page":"167","DOI":"10.1109\/LNET.2022.3186589","article-title":"Robust Network Intrusion Detection Through Explainable Artificial Intelligence (XAI)","volume":"4","author":"Barnard","year":"2022","journal-title":"IEEE Netw. Lett."},{"key":"ref_34","doi-asserted-by":"crossref","unstructured":"Bocu, R., and Iavich, M. (2022). Real-Time Intrusion Detection and Prevention System for 5G and beyond Software-Defined Networks. Symmetry, 15.","DOI":"10.3390\/sym15010110"},{"key":"ref_35","doi-asserted-by":"crossref","unstructured":"Azkaei, B., Joshi, K.C., and Exarchakos, G. (2025). Machine Learning-Driven Anomaly Detection for 5G O-RAN Performance Metrics. arXiv.","DOI":"10.1109\/INFOCOMWKSHPS65812.2025.11152997"},{"key":"ref_36","first-page":"3805","article-title":"ScalaDetect-5G: Ultra High-Precision Highly Elastic Deep Intrusion Detection System for 5G Network","volume":"144","author":"Chang","year":"2025","journal-title":"CMES\u2014Comput. Model. Eng. Sci."}],"container-title":["Future Internet"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/1999-5903\/17\/11\/482\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,23]],"date-time":"2025-10-23T05:39:23Z","timestamp":1761197963000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/1999-5903\/17\/11\/482"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,10,22]]},"references-count":36,"journal-issue":{"issue":"11","published-online":{"date-parts":[[2025,11]]}},"alternative-id":["fi17110482"],"URL":"https:\/\/doi.org\/10.3390\/fi17110482","relation":{},"ISSN":["1999-5903"],"issn-type":[{"value":"1999-5903","type":"electronic"}],"subject":[],"published":{"date-parts":[[2025,10,22]]}}}