5G Endogenous Security Framework and Key Technical Approaches

China Mobile Research Institute researchers proposed a 5G endogenous security framework that embeds micro-isolation, attack awareness, and malicious file detection in core-network VMs and virtualization hosts. A two-tier design pairs a central management plane with in-built plugins so security controls scale with network functions.

Overview

Current 5G core networks use domain-based security designs and isolate zones with traditional devices such as firewalls and intrusion prevention systems. As attacks intensify and AI tooling spreads, add-on perimeter products struggle against internal threats. Protection needs to shift from bolt-on appliances toward endogenous controls that sit inside network functions.

Researchers at China Mobile Research Institute present a 5G endogenous security framework built on three capabilities: micro-isolation, attack awareness, and malicious file detection. The design monitors unauthorized traffic, anomalous behavior, and malicious files in real time. Security functions are embedded in network-function virtual machines and in virtualization-layer hosts so that protection and services can scale together.

5G Core Network Security Challenges

Cloudification of 5G mobile networks is a milestone in ICT convergence and architecture evolution. Flexible resource orchestration, elastic scaling of network functions, and dynamic service interaction also create new risks. Shared virtualization resources weaken physical security boundaries, so a single compromise can spread more widely. Homogeneous virtualized network functions and common IT components lower the bar for known-vulnerability attacks. Service-based architecture opens inter-function interfaces, which increases unauthorized access and east-west movement risk.

Existing perimeter add-on schemes fit poorly with virtualized, dynamic, service-based 5G cores. They cannot apply protection at network-function granularity or see east-west access and runtime state inside the virtualization layer. Static policies do not track frequent scale-out and scale-in, so rules can fail or disrupt traffic. Operators also lack a unified internal security view, which slows coordinated response.

Endogenous 5G security treats network-function self-protection as the base, with intelligent analysis and flexible orchestration as supporting means. The stated goal is an active, coordinated, elastic security system. Security is internalized into infrastructure and workflows so that controls are finer-grained, more flexible, and more efficient.

Framework Design

The architecture uses two tiers: an endogenous security management center and multi-layer built-in security plugins. The center schedules policy. Plugins enforce it locally.

Figure 1. 5G endogenous security framework

The management center is the network-wide hub. It orchestrates policy, analyzes threats, presents global situation, and directs response. It can generate fine-grained, differentiated policies from 5G core business logic, correlate events, and dispatch handling.

Built-in plugins act as enforcement points. Network-function plugins sit inside core-network VMs and share the lifecycle of network-function processes. Virtualization-layer plugins run on the host operating system and cover hypervisor operations that network functions cannot see. Plugins collect runtime information, enforce policy, and report events and logs to the center. Local monitoring at second-level latency combines with global analysis to close a detect-and-respond loop.

Key Technologies

Micro-isolation

Micro-isolation targets management-plane traffic among core network functions and among VMs inside a function. In-function plugins use kernel-native eBPF to collect access traffic and match it against a whitelist. Unauthorized access generates a security event immediately. The whitelist is learned from live traffic models. Policies use network-function business labels rather than static IP attributes, so they adapt to scale events, IP changes, and VM live migration.

Attack awareness

Attack awareness watches operating-system-level intrusion behavior on network-function VMs and virtualization hosts. It complements micro-isolation at the access layer with a behavior layer. Plugins collect process lifecycle, system-call sequences, privilege changes, scheduled tasks, and related signals. The framework builds per-function and per-host normal-behavior baselines from the deterministic traits of telecom workloads and maps them against ATT&CK patterns. It raises events on five major classes and 15 subclasses of anomalies, including privilege escalation, file tampering, covert outbound connections, and brute-force attempts.

Malicious file detection

Malicious file detection covers filesystems on network-function VMs and virtualization hosts. It watches newly written, downloaded, and decompressed files and starts inspection when a file lands on disk. Three stages apply. A preset 5G core business-file baseline separates legitimate files and cuts false positives. Hash and signature matching identifies known malware. An AI engine at the management center correlates dynamic anomalies and threat intelligence to judge unknown and variant files.

Summary

The proposed framework coordinates the management center and plugins to deliver micro-isolation, attack awareness, and malicious file detection. It monitors unauthorized internal traffic, anomalous behavior, and malicious files across the 5G core in real time. Embedding these controls in the native cloud architecture matches the elastic character of virtualized networks and addresses coarse grain, slow response, and weak coordination in traditional perimeter defense.

Authors: Zhang Fanglei, China Mobile Research Institute Security Technology Institute, working on 5G core endogenous security. Zhuang Xiaojun, same institute, working on 5G, 5G-A, 6G, and network-cloud security. Reviewer: Du Chenhui, Security Technology Institute (China Mobile Artificial Intelligence Security Governance Research Center).