Design of an AI-driven secure 5G-SDN framework with federated reinforcement learning for anomaly detection, mitigation, and attack forensics.

Introduction: The increasing adoption of Software-Defined Networking (SDN) in 5G networks has revolutionized network management. However, this paradigm shift has introduced critical security vulnerabilities, including data-plane anomalies, control-layer intrusions, and Distributed Denial-of-Service (DDoS) attacks. Existing intrusion detection approaches based on Convolutional Neural Networks (CNNs) and Long Short-Term Memory (LSTM) networks suffer from high computational overhead, long detection latency, and limited scalability, making them unsuitable for real-time 5G-SDN environments. Methods: This article proposes a novel multi-layered security framework for 5G-SDN that integrates EfficientNet with Knowledge Distillation (KD), Transformer Networks, Spiking Neural Networks (SNNs), Federated Reinforcement Learning (FRL), and blockchain technology. EfficientNet-KD enables lightweight and accurate anomaly detection at the data-plane layer. Transformer networks capture long-range temporal dependencies to enhance control-layer attack detection. SNNs are employed for ultra-low-latency attack classification by mimicking human brain neural processing. FRL supports decentralized and privacy-preserving mitigation across SDN controllers, improving scalability, while blockchain technology ensures the integrity and immutability of attack logs for forensic reliability. Results: The proposed framework was evaluated using multiple benchmark datasets, including CICIDS2017, UNSW-NB15, IoT-23, and InSDN. Experimental results demonstrate an average detection accuracy of 97.75%, detection latency of 15 ms, and less than 5% throughput degradation. Each detection consumes only 0.25 J of energy, achieving a 40% reduction in energy usage compared to traditional CNN- and LSTM-based approaches. Discussion: The results verify that the proposed framework provides a scalable, energy-efficient, and low-latency intrusion detection and mitigation solution for 5G-SDN environments. By integrating lightweight deep learning, neuromorphic computing, decentralized learning, and blockchain-based security, the framework effectively addresses the limitations of existing methods and offers a robust approach for securing next-generation 5G-SDN networks.