While modern 5G networks are becoming more open and flexible, making them easier to upgrade and cheaper to build, that also creates more opportunities for hackers. The Surrey-developed defence framework, called TwinGuard, addresses this challenge using a real-time digital twin – a live virtual replica of a mobile network that updates every few milliseconds. The team paired TwinGuard with reinforcement learning AI that can anticipate suspicious behaviour and shut down attacks before they cause disruption.
Traditional security systems usually rely on recognising known attack patterns, which means that they can struggle to deal with new or rapidly changing threats. To test whether TwinGuard could respond more quickly, researchers used two realistic 5G environments. The first was a simulated multi-cell Open Radio Access Network (O-RAN) set-up, which mimics several mobile masts working together. The second was a fully virtual 5G core network built with open-source software (OpenAirInterface) and controlled through the real-time FlexRIC platform.
Across both environments, TwinGuard detected and blocked attacks in under 100 milliseconds. These included a handover flooding attack (fake signals that try to overwhelm the system managing connections between masts) and an E2 subscription flooding attack, where a malicious app bombards the network controller with data requests to disrupt normal operation.
Dr Sotiris Moschoyiannis, Associate Professor in Complex Systems at the University of Surrey’s Centre for Cyber Security, who led this research study, said: “Attackers rarely come through the front door anymore. They probe, adapt and escalate in ways that traditional defences simply weren’t designed to handle.
“What TwinGuard demonstrates is that mobile networks can learn to recognise these behaviours as they unfold, and respond accordingly, rather than relying on pre-defined rules. That shift is essential if we want future 6G networked systems to be resilient and remain dependable in the face of increasingly agile threats.”
Unusual activity can be difficult to spot because today’s 5G networks are built from many different components working together. Hackers often hide their movements by mimicking normal traffic or escalating slowly over time. With 6G expected to arrive in the early 2030s, researchers say the next generation of mobile networks will need security systems that learn behavioural patterns rather than relying on fixed warning signs.
Dr Mohammad Shojafar, Associate Professor in Network Security at the University of Surrey’s 5G/6G Innovation Centre, said: “Static, rule-based security systems simply cannot keep pace with the speed and complexity of attacks on modern 5G networks.
“Our defence framework lets the AI learn directly from a virtual copy of the live network, so it understands what ‘normal’ looks like and can spot trouble before any impact. The fact that it can shut down attacks in under a tenth of a second shows how important real-time, AI-driven defence will be for future 6G networks.”
Neha Gupta, Researcher and Developer at Surrey’s 5G/6G Innovation Centre (6GIC), who is behind the TwinGuard framework, said: “As the researcher and developer behind TwinGuard, I designed the framework to link real-time network data with an intelligent Digital Twin, enabling our reinforcement learning agent to anticipate and stop control-plane attacks in O-RAN networks in under 10 milliseconds.”
The study was initially presented at the 2025 IEEE International Conference on Trust, Security and Privacy in Computing and Communications and published in IEEE Xplore. The research team now plans to expand the framework to larger, multi-cell environments, bringing it another step closer to deployment in future 6G systems.
