Modern 5G networks are designed to be open and flexible, which makes them easier and cheaper to build and upgrade. However, this openness also creates more chances for hackers to attack. To counter this, researchers created TwinGuard, a defense system that uses a digital twin - a virtual copy of the network that updates in real time every few milliseconds. This system works with reinforcement learning, a type of artificial intelligence (AI) that learns through trial and error.
Traditional security methods depend on spotting known attack patterns, so they often fail against new or changing threats. In tests, TwinGuard was tried in two realistic setups. One was a simulated multi-cell Open Radio Access Network, or O-RAN, which is an open standard for connecting mobile towers. The other was a virtual 5G core network made with open-source software called OpenAirInterface and controlled by a real-time platform named FlexRIC.
How TwinGuard stops attacks
In both setups, TwinGuard spotted and blocked attacks in less than 100 milliseconds. Examples include a handover flooding attack, where fake signals overwhelm the system that manages connections between towers, and an E2 subscription flooding attack, where a bad app floods the network controller with too many data requests to disrupt it. Attackers now probe networks slowly, adapting and hiding by copying normal traffic, which makes them hard to detect in complex 5G systems built from many parts.
Experts note that fixed-rule security cannot match the speed of these attacks, but TwinGuard learns normal behavior from the digital twin to act fast. As 6G networks, expected in the early 2030s, will be even more complex, such AI-driven systems are vital for reliability. The framework's developer linked real-time data to the twin, allowing the AI to halt control-plane attacks—threats to the network's command layer—in under 10 milliseconds in O-RAN. The work was presented at a 2025 conference and published in IEEE Xplore, with plans to test it in larger settings for real-world use in future networks.