University of Surrey Develops AI Defence System That Stops 5G Cyber-Attacks in Under 100 Milliseconds
Key Takeaways
- ▸TwinGuard detects and blocks 5G cyber-attacks in under 100 milliseconds using a real-time digital twin paired with reinforcement learning
- ▸The system learns behavioural patterns from live network data rather than relying on pre-defined attack signatures, enabling detection of novel threats
- ▸Successfully tested against sophisticated attacks including handover flooding and E2 subscription flooding in realistic multi-cell and virtual 5G environments
Summary
Researchers at the University of Surrey have successfully developed TwinGuard, an AI-powered defence system that detects and neutralises sophisticated 5G cyber-attacks in under 100 milliseconds. The framework combines a real-time digital twin—a live virtual replica of mobile networks updated every few milliseconds—with reinforcement learning AI that can anticipate suspicious behaviour and neutralise threats before they cause disruption. TwinGuard was tested on two realistic 5G environments: a simulated multi-cell Open Radio Access Network (O-RAN) setup and a fully virtual 5G core network built with open-source software, successfully blocking handover flooding attacks and E2 subscription flooding attacks in both scenarios.
Unlike traditional security systems that rely on recognising known attack patterns, TwinGuard uses AI to learn behavioural patterns from a live virtual copy of the network, enabling it to identify and respond to novel and rapidly evolving threats in real-time. The research team notes that as 6G networks are expected to arrive in the early 2030s, future mobile networks will require security systems that learn adaptively rather than relying on fixed, rule-based warnings. The framework represents a significant shift from static defences to dynamic, AI-driven security capable of matching the speed and sophistication of modern cyber-attacks.
- Represents critical advancement toward secure 6G networks, with researchers planning to scale the framework to larger, multi-cell environments
Editorial Opinion
TwinGuard represents a paradigm shift in mobile network security, moving from reactive, signature-based defences to proactive, adaptive AI-driven protection. The sub-100-millisecond response time is genuinely impressive and addresses a real vulnerability in modern 5G networks where traditional security struggles with novel or gradually escalating attacks. However, the practical deployment challenge will be significant—integrating such systems into diverse, proprietary 5G infrastructures while maintaining computational efficiency across a network operator's entire estate remains a substantial hurdle before 6G deployment.
