Researchers at Universidade of Esta innovation emerges as a crucial response to the security challenges posed by the increasing complexity and openness of fifth generation networks, which, although they offer greater flexibility and reduced deployment costs, also expose more entry points for potential cyber intrusions. The technology promises to strengthen the resilience of global communications infrastructure.
The architecture of modern 5G networks, characterized by its flexibility and more open infrastructure, facilitates updates and optimizes expansion, but this same characteristic significantly expands the attack vector for malicious actors. Diante In a scenario where cyber threats constantly evolve and become increasingly difficult to predict, TwinGuard positions itself as a proactive barrier, capable of anticipating suspicious movements before attacks cause serious disruptions to services.
The core of the innovation lies in the use of a real-time “digital twin”, an accurate virtual replica of the mobile network that updates every few milliseconds. Complementado through artificial intelligence that employs reinforcement learning, the system can identify anomalous patterns and intercept malicious activities with an agility that conventional security systems rarely achieve.
Innovation in cybersecurity for 5G networks
The “digital twin” concept in TwinGuard is fundamental to its effectiveness. Ele functions as a virtual shadow of the physical network, mirroring each component and data stream with microscopic precision. Essa real-time replication allows the system to continuously monitor network behavior without interfering with its operations, offering unprecedented visibility into activities occurring, whether legitimate or suspicious. The ability to have such a dynamic virtual representation is what allows TwinGuard instant in-depth analysis.
The integration of reinforcement learning artificial intelligence takes TwinGuard to a new level of defense. Diferente than fixed rule-based systems, TwinGuard’s AI is designed to learn and adapt. Ela is trained to recognize not only known attack patterns, but also to infer and anticipate anomalous behavior, however subtle. By identifying deviations from normal network behavior, AI can initiate actions to contain and interrupt attacks, ensuring that the network remains operational and secure, minimizing the risk of interruptions and data leaks.
Rigorous testing and promising results
To prove TwinGuard’s effectiveness, researchers at Universidade and Surrey conducted tests in 5G environments that simulated real-world scenarios with high fidelity. One of the environments used was a simulated multi-cell Rede, Acesso, Rádio Aberta (O-RAN) configuration, which replicates the operation of multiple cell phone antennas working together. Esse scenario allowed evaluating the system’s ability to deal with the complexity of a distributed and interconnected communication infrastructure.
The second test environment consisted of a fully virtual 5G core network built using open source software known as OpenAirInterface. Esta network was controlled by the FlexRIC platform in real time, which provided an ideal scenario to simulate different types of cyber attacks in a controlled and reproducible environment. The choice of these environments ensured that the tests covered both the access part and the core of the network, covering a wide range of potential vulnerabilities.
During these tests, TwinGuard was subjected to complex attacks, such as a handover flood attack, which attempts to overload the inter-antenna connection management system with false signals. Outro simulated attack was the E2 signature flood, where a malicious application bombards the network controller with an excessive volume of data requests, aiming to disrupt its normal operations. In both scenarios, the system demonstrated its effectiveness by detecting and blocking attacks in an impressive less than 100 milliseconds.
The lag of traditional defenses in the face of agile threats
Conventional cybersecurity systems often encounter significant limitations when faced with the dynamic and evasive nature of modern cyberattacks. Their dependence on databases of known attack patterns makes them vulnerable to new threats or variations of existing attacks that have not been previously catalogued. Essa lag is a critical point, as attackers are constantly innovating, developing increasingly sophisticated methods to bypass established defenses.
As highlighted by Dr. Sotiris Moschoyiannis, Sistemas Complexos Associate Professor at Centro at Segurança Cibernética at Universidade at Essa observation highlights the pressing need for a paradigm shift in network security, moving away from static and reactive approaches.
The TwinGuard demonstration offers a clear view that mobile networks can, and should, be able to learn and recognize malicious behavior as it manifests, responding autonomously and in real time, rather than relying solely on predefined rules. Essa adaptive capacity is what gives the system a decisive advantage over defense strategies that simply filter based on known signatures, which can be easily updated or evaded by cybercriminals.
Detecting unusual activity in 5G networks is a challenge inherent to their very architecture, which is made up of a vast array of interconnected components. Essa complexity offers multiple layers where hackers can camouflage their actions, mimicking normal network traffic or escalating their malicious activities gradually over time. Tal behavior makes identification difficult for systems that do not have the ability to discern subtle variations in communication patterns, making adaptive AI an indispensable solution for constant surveillance.
Paving the way for 6G resilience
With the imminent arrival of 6G networks, projected for the early 2030s, the need for highly adaptable and intelligent security systems becomes even more crucial. The next generation of mobile networks promises to bring significant advances in terms of speed, latency and capacity, but, on the other hand, it will also introduce new complexities and potential vulnerabilities. Pesquisadores assert that future security systems for 6G will need to transcend reliance on fixed warning signals and incorporate the ability to continually learn patterns of behavior to protect infrastructure against increasingly sophisticated and changing threats. The resilience of these networks will directly depend on security innovation.
TwinGuard research represents a fundamental step in this direction, demonstrating that a fundamental change in the approach to security is not only possible, but indispensable. Moving away from defenses based solely on predefined rules in favor of systems that can learn and recognize threats in real time is vital. Essa transition will ensure that future network systems, such as 6G, maintain their reliability and security, even in the face of a scenario of cyber threats that become progressively more agile and evasive. A network’s ability to proactively adapt and protect itself will be the foundation for its continued, secure operation in the future.
Next steps in research and the future of network defense
The Universidade team of researchers from Surrey, led by Dr. Sotiris Moschoyiannis, don’t plan on stopping here. Após the success of initial tests, the next stage of TwinGuard’s development involves expanding its framework to significantly larger and more complex environments, which include multiple network cells. Esta phase is crucial to simulate large-scale deployment scenarios, bringing TwinGuard even closer to its practical application in future 6G systems. By testing the system under conditions that mirror the vast and intricate architecture of commercial networks, researchers hope to further improve its robustness and scalability. The ultimate goal is to ensure that technology can effectively protect communications infrastructures that will become even more essential to the digital society, consolidating defense against cyberattacks in an increasingly interconnected and vital network ecosystem.
TwinGuard Publication and Academic Recognition
The study detailing the TwinGuard system and its promising results was initially presented at the renowned 2025 IEEE Conferência Internacional on Confiança, Posteriormente, the research was published in IEEE Xplore, one of the most important technical and scientific literature databases in the world, which gives the project significant recognition and peer validation. Este endorsement from the academic and technical community reinforces the credibility and relevance of the innovation proposed by TwinGuard in the field of cybersecurity for communication networks.
