Abstract

Intrusion detection systems for 5G networks are typically reported at a single operating point, obscuring the trade-off between missed attacks and false alarms that governs real deployments. Building on a lightweight conditional counter-inspection pipeline, in which a global classifier is selectively validated by curriculum-biased experts under a unanimous dissent rule, we remove the constraint that all components share one learning algorithm, assigning decision trees, random forests, extremely randomized trees, and histogram-based gradient boosting independently to the global (G), malicious-biased (EM), and benign-biased (EB) roles. Across two datasets of contrasting difficulty, 5G-NIDD and UNSW-NB15, all 14 evaluated tree-based configurations reduce missed attacks, by 36.5–79.6% on 5G-NIDD, confirming that the recovery effect is a property of the architecture rather than of decision trees. The expert assignment also selects which error the system controls: the same pipeline can be steered toward fewer false alarms, fewer missed attacks, or higher aggregate F1 without retraining the first stage. The mechanism also rescues a weak linear filter: on 5G-NIDD it cuts false positives and false negatives by 92.8% and 95.8%, and on UNSW-NB15 it raises F1 from 0.903 to 0.934 while reducing missed attacks by 35.5%. These results reframe the pipeline as a configurable validation layer matched to a deployment’s cost structure. We further show, through direct measurement on both datasets, that the conditional routing evaluates at most four of seven models per record, keeping classifier inference below 0.1 ms per record and leaving the detection stage a small contributor to overall processing cost.

IPC Classification

Keywords