Explainable AI for Anomaly Detection in 5G Networks: Bridging Accuracy and Interpretability

Abstract

The rapid adoption of 5G—offering ultra-low latency, enhanced connectivity, and massive throughput, broadens the network-security threat landscape. Monitoring intelligent anomaly detection systems for network security is now a necessity rather than an option. This paper presents a unique approach to Explainable Artificial Intelligence (XAI) for 5G networks using Shapley Additive Explanations (SHAP) and Local Interpretable Model-Agnostic Explanation (LIME), not only to discover anomalies but also to explain them coherently while providing intuitive interpretations. A novel framework was developed to augment the Canadian Institute for Cybersecurity Intrusion Detection System 2017 (CICIDS2017) dataset with simulated features such as latency and throughput associated specifically with 5G networks, training a Random Forest (RF) classifier yielding 91% accuracy (precision = 0.89, recall = 0.85). SHAP attributes a higher percentage of the model’s attack detection logic to three features—Backward Packet Length Minimum (Bwd Packet Length Min), Total Length of Forward Packets (Total Length of Fwd Packets), Flow inter-arrival time Minimum (Flow IAT Min), while LIME identifies causal trigger points like explicit congestion notification echo (ECE) Flag Count spikes. For the real-time evaluation and benchmarking, we compare the efficiencies of RF, Deep Neural Networks (DNN), and Autoencoders. We find that RF is remarkably fast for real-time explainability compared to its counterparts. The new framework enables network administrators to make informed decisions based on concrete evidence, which marks a progressive achievement in explainable 5G security technology.