Feature-Selected Machine Learning for 5G Intrusion Detection: Leakage-Aware Evaluation and Sensitivity to Sequence Metadata in 5G-NIDD

Abstract

Fifth-generation networks present a multifaceted and software-centric attack surface, thereby necessitating a systematic approach to reproducible intrusion-detection evaluation through traffic data gathered from authentic 5G environments. This investigation examines binary intrusion detection utilizing the comprehensive 5G-NIDD Combined.csv dataset acquired from its official IEEE DataPort distribution, adhering to a standardized leakage-aware methodology. The original dataset comprised 1,215,890 records and 52 columns. Following the elimination of 21 exact duplicate entries, 1,215,869 observations were retained. A stratified 70:30 partition was executed at the record level prior to preprocessing, with all data-dependent procedures being exclusively calibrated on the pertinent training dataset. The application of zero-variance filtering, Pearson-correlation reduction, and ANOVA F-test ranking condensed the 46 usable predictors into a consistent Top-10 representation. Random Forest, XGBoost, and a scalable random Fourier feature support-vector machine (RFF-SVM) approximation of an RBF-kernel classifier were assessed employing an untouched holdout partition in conjunction with five-fold stratified cross-validation, incorporating fold-specific preprocessing and feature selection. XGBoost and Random Forest attained Top-10 holdout accuracies of 99.9748% and 99.9745%, respectively, with no statistically significant disparity between their paired errors subsequent to Holm correction. The full, correlation-reduced, and Top-10 representations yielded virtually identical outcomes for both ensemble models, suggesting that the compact feature set maintained rather than enhanced random-split performance. Nevertheless, Seq and Offset emerged as the two highest-ranked predictors. The exclusion of these predictors resulted in a decline in holdout accuracy to 71.18% forXGBoost, 71.16% for Random Forest, and 73.09% for RFF-SVM, with a similar trend noted during cross-validation. These results illustrate that nearly flawless record-level outcomes are heavily contingent upon acquisition-order metadata and should not be construed as indicative of cross-session or cross-environment generalization. Prior to operational implementation, session-aware, base-station-aware, and external validation are imperative.