Jul 2026· 2026 6th International Conference on Intelligent Communications and Computing (ICICC)· pp. 160-163· 0 citations· 11 references
Abstract
Advanced Air Mobility (AAM) platforms rely on heterogeneous command and control (C2) links-LTE and SAT-COM-yet current frameworks prioritize connectivity over integrity, leaving them critically vulnerable to coordinated jamming, spoofing, and replay attacks. As AAM operations scale toward dense urban airspace, the absence of trust-aware link management introduces systemic risks that SNR-based switching policies are fundamentally ill-equipped to address. We propose a cognitive cyber-resilient C2 link management framework that elevates link trust above raw uptime by integrating multi-layered threat intelligence with adaptive decision-making. A hybrid BiLSTM+TCN anomaly detector achieves 89.69% accuracy with perfect recall $(\text{AUC} =1.000)$ across jamming and replay attack classes, enabling early and reliable threat identification under realistic channel conditions. Guided by dynamic threat probability estimates, RF fingerprint authentication, and a Watchdog safety layer, a Dueling Deep Q-Network (Dueling-DQN) agent selects defensive link-switching actions that preserve mission continuity without sacrificing security posture. The framework is implemented and validated in OMNeT++ 6.3 under five independent random seeds, demonstrating complete elimination of C2 hijack events across all single-vector attack scenarios. In contrast, the SNR-threshold baseline averaged two hijack events per scenario, confirming the inadequacy of reactive, signal-qualityonly approaches. These results establish a strong foundation for trust-centric, AI-driven C2 link resilience in next-generation AAM deployments.
Vehicular Ad-Hoc Networks (VANETs) enable realtime communication for safety-critical applications including collision avoidance and traffic control. Their decentralized, dynamic architecture, however, makes them vulnerable to multiple attack classes, including Sybil, spoofing, Denial-of-Service (DoS), and other cyber threats. Existing defenses typically address cyber and physical layers independently, limiting their ability to capture the interplay between mobility patterns and attack propagation. This paper presents a cyber-physical simulation framework integrating vehicular mobility with the CybORG environment for multi-class attack mitigation. A Road Side Unit (RSU) acts as the infrastructure-based defender, monitoring vehicle behavior, maintaining trust scores, and executing defense actions via a Dueling Double Deep Q-Network with Prioritized Experience Replay (D3QN-PER). The agent learns optimal policies through environment interaction rather than static labeled data. Evaluation against two unsupervised baselines, Exponentially Weighted Moving Average (EWMA) and Trust-Gated Isolation Forest, demonstrates perfect detection performance (Recall = 100%, $\mathbf{F} \mathbf{1} \boldsymbol{=} \mathbf{1. 0 0 0 0})$ with zero false positives and zero false negatives, compared to 95.12% recall (EWMA) and 84.95% recall (Isolation Forest). The framework handles up to six concurrent attackers within the RSU's 200 m range with sub-millisecond latency, establishing a foundation for intelligent, adaptive security in vehicular networks.
Fasna Nadeera Irumpidamkandiyil Pocker, Farsana Ansari, Alexandre dos Santos Roque et al.· International Conference on...· 0 citations
Rogue Base Stations (RBS) remain a persistent security threat to fifth-generation (5G) and emerging sixth-generation (6G) cellular systems by impersonating legitimate infrastructure and exploiting vulnerabilities in pre-authentication signaling and mobility procedures. The risk is particularly critical in vehicular and Vehicle-to-Everything (V2X) environments, where high mobility and millisecond-scale handover operations tightly couple communication reliability with safety-critical control functions. Although prior surveys examine LTE identity catchers and general cellular security threats, they rarely evaluate RBS detection under vehicular mobility dynamics or within the latency and reliability constraints of Ultra-Reliable Low-Latency Communication (URLLC) services. In addition, the limited availability of realistic measurement report (MR) datasets have hindered reproducible benchmarking of data-driven detection methods. This article presents a vehicular-oriented survey of RBS detection in 5G and beyond networks, explicitly addressing mobility-constrained detection, handover-security interactions, and V2X safety requirements that are not systematically addressed in prior surveys, which primarily focus on pre-5G threat models, IMSI-catcher attacks, or general cellular security. We introduce a method-centric taxonomy that organizes existing approaches into five families based on their primary evidence sources and inference mechanisms: signal anomaly detection, protocol and traffic analytics, RF fingerprinting, network-level frameworks, and machine-learning-based detection. Using a PRISMA-compatible structured literature review across 102 included studies and a structured comparative evaluation framework, each family is analyzed across detection latency, computational overhead, robustness to mobility, false alarm susceptibility, and feasibility within quantified pre-handover decision windows. Direct cross-study quantitative comparison is precluded by heterogeneous reporting conventions across the surveyed literature; the framework, therefore, provides structured qualitative synthesis and indicative performance ranges rather than pooled empirical estimates. The analysis reveals that no individual technique satisfies vehicular URLLC constraints in isolation, motivating layered architectures combining lightweight UE-side detection with edge-assisted and operator-level analytics. A scenario-driven safety analysis links detection error rates to operational consequences across five V2X use cases under varying URLLC severity levels. The survey formalizes evaluation criteria for MR-driven detection and highlights realistic MR generation as a foundation for reproducible evaluation and cross-study comparison in next-generation vehicular communication systems.
Roland Lamptey, M. Saedi, V. Stankovic et al.· IEEE Open Journal of the Com...· 0 citations
An AI-assisted, cross-layer security orchestration framework that integrates epoch-wise telemetry with ML-based risk estimation and formalizes mitigation as a Constrained Markov Decision Process (CMDP), and empirical evidence that adaptive mitigation can reduce security risk without sacrificing service guarantees is provided.
F. Philip-Kpae, A. Imoize, K. .. Okafor et al.· E3S Web of Conferences· 0 citations
The deployment of 5G standalone (SA) networks introduces cloud-native core architectures, service-based interfaces, and programmable radio access networks that substantially expand the mobile attack surface. Existing work has focused mainly on protocol-level vulnerabilities or isolated anomaly detection, with less attention to SOC-level monitoring, correlation, and investigation of 5G-specific threats. This paper presents a SOC-integrated, protocol-aware detection framework for 5G SA environments, combining structured telemetry ingestion, log normalization, decision-based detection logic, and analyst-oriented visualization within an Elastic-Stack-based SOC architecture. The approach is implemented on an experimental 5G SA testbed at Obuda University and evaluated using a dual-source design: controlled testbed scenarios complemented by an observational analysis of telemetry from an independent, large-scale international cyber-defense exercise whose adversarial complexity is difficult to reproduce synthetically. The evaluation exercises attack scenarios including rogue network element registration, authentication abuse, and control- and user-plane manipulation. The results indicate that embedding 5G-aware detection logic into SOC workflows supports situational awareness and structured incident investigation. A single-layer versus cross-layer ablation of the published detection rules quantifies where cross-layer correlation is strictly required for detection versus where it primarily enriches interpretation. This is extended with a limited generic-SIEM-style baseline check and a live, a priori repeated-trial sensitivity check (N=30, Wilson 95% CI [88.6%, 100%]). The framework offers a reproducible methodological foundation for operational 5G security monitoring and practical guidance for next-generation mobile network defense. Future work will extend controlled repeated-trial evaluation to the remaining detection rules, broaden the SIEM baseline comparison, and assess generalizability beyond Open5GS.
Miklós Orsós, A. Bánáti· Future Internet· 0 citations
These findings demonstrate that Edge-ZTA provides an efficient, privacy-preserving, and scalable cybersecurity framework capable of mitigating sophisticated multi-stage cyberattacks while satisfying the stringent performance requirements of next-generation Industrial IoT infrastructures.
Ahmed Ramzi Rashid, Zaydon L. Ali, Ahmed Sedeeq Baker Al-Doori· Al-Noor Journal of Engineeri...· 0 citations
- Fifth-generation telecommunications networks are becoming a strategic layer of critical infrastructure because they connect public safety, financial systems, healthcare, logistics, energy, industrial control systems and intelligent edge services. The same characteristics that make 5G valuable - ultra-low latency, dense device connectivity, software-defined network functions, network slicing, cloud-native service-based architecture and edge computing - also create an expanded attack surface for adversaries using artificial intelligence. This paper develops an AI-resilient cybersecurity framework for 5G telecommunications networks by integrating 5G security literature, adversarial machine learning research, zero-trust architecture, AI risk management and empirical cyber-incident analytics. The empirical component uses the Kaggle Global Cybersecurity Threats (2015-2024) dataset, comprising 3,000 incident records across 10 countries, 7 industries and 6 attack categories, to model sectoral exposure, telecommunications-specific risk, loss severity and incident-resolution burden. The sample records USD 151.48 billion in aggregate estimated financial loss, 1.51 billion affected-user records and a mean resolution time of 36.48 hours. Telecommunications incidents account for 403 records and USD 20,459.09 million in estimated loss, with man-in-the-middle, DDoS, phishing and malware attacks showing elevated relevance for AI-enabled 5G threat scenarios. Heat-map analysis identifies telecommunications man-in-the-middle attacks as one of the highest AI-5G exposure cells, while random-forest triage demonstrates that affected-user scale, resolution time, year and the constructed AI-5G Exposure Index are the strongest predictors of high-impact incidents in the analytical design. The paper contributes a practical AI-Resilient 5G Cybersecurity Framework built around adversarially robust intrusion detection, zero-trust identity, slice isolation, secure edge orchestration, model-risk governance, threat-informed vulnerability prioritisation, incident-response automation, post-quantum crypto-agility and continuous assurance. The central finding is that 5G security cannot be reduced to conventional perimeter defence; it requires a converged operating model that secures networks, data, machine-learning pipelines, identities, cloud-native functions and critical service continuity together.
Ken Mudzingwa, Stewart Munyaradzi Nyamutswa, Admore Tafadzwa Mugwadzi et al.· Iconic research and engineer...· 0 citations
We use cookies to run the site and, with your consent, for analytics and to show ads.
See our Cookie Policy.
