The integration of 5G mobile networks with Software Defined Networking (SDN) technologies has altered contemporary communication structures by offering ultra-reliable, low-latency, and scalable services via centralized control and programmable networking. Recent work has included explainability in collaborative systems. For instance, used attention-based federated learning to identify the main sources of security problems in changing situations. This increases the attack surface, such as Distributed Denial of Service (DDoS) and spoofing attacks, as well as more complicated flow- and application-layer attacks.

Conventional Intrusion Detection Systems (IDSs) with signature-based or shallow-learning-based detection approaches are not equipped to discover new or concealed attacks in dynamic 5G-enabled SDNs. Modern methods differ from older host-based analysis by looking at anomalies in the entire network. [1] showed that changing graph features significantly improves the detection of multi-class attacks in complex networks. One promising alternative is Graph Neural Networks (GNNs), which learn from the organization of network traffic by representing networks and communication flows as graphs [2].

GNNs can be particularly applied to SDN environments, where flow logs and packet-in messages are visualized in real-time and converted into spatio-temporal graphs that evolve over time. Multi-Head Attention (MHA) systems, originally proposed in Transformer models, have been effectively incorporated into GNNs to enhance feature discrimination on these complex graphs. MHA allows the model to consider several relational subspaces simultaneously, capturing interactions across different temporal and spatial granularities [3]. This is crucial in 5G networks, where traffic patterns are constantly changing due to network slicing, mobility, and edge devices.

Although GNN-based models are often accurate, they tend to be black-boxes, limiting their reliability for security-sensitive applications. To address this, Explainable AI (XAI) methods, particularly SHapley Additive exPlanations (SHAP), have gained popularity. SHAP offers post-hoc interpretability by explaining decisions based on individual input features using cooperative game theory [4]. When applied to intrusion detection, SHAP highlights what each flow feature (e.g., packet entropy, duration, number of bytes) contributed to the final prediction, offering valuable forensic insights to security analysts [5].

Recent studies have focused on making GNN-based intrusion detection systems explainable. For example, a GNN system using multi-head attention (MHA) and SHAP for analyzing encrypted network data showed improvements in both system interpretability and detection accuracy [6]. Used SHAP, in combination with attention-based federated learning, to improve the understandability of collaborative intrusion detection systems [7]. Another study demonstrated that GNNs combined with MHA and SHapley Additive exPlanations (SHAP) can improve malware analysis by explaining intrusion behaviors on individual computers [8].

In addition to SHAP, attention scores offer a straightforward interpretation of the system by identifying significant components of the network graph. This can be explained using both attention weights and SHAP values to provide a two-level explanation: one representing the graph structure (how important each node is) and the other representing the feature importance (what features matter). This enhances confidence and simplifies auditing.

Temporal GNNs, such as the Dynamic Self-Attention Network (DySAT) and Temporal Graph Attention Networks (TGAT), have been used to monitor network dynamic behavior in systems that manage high volumes of data. These methods align with the principles of zero-trust security, which emphasize continuous observation and adaptability [9].

The presented system includes a GNN encoder with MHA, trained on the graphical version of SDN flow data. Each analysis is supplemented with SHAP-based tools for explanation. The system was tested on standard datasets, such as CIC-IDS2017, TON_IoT, and NSL-KDD, converted into graph snapshots [10]. The experiments showed improved F1-scores (up to an 18-point variation) and increased confidence in the explanations compared to simpler systems, like Graph Attention Networks (GAT) or convolutional neural networks (CNN).

Furthermore, the studies introduced an Interpretability Confidence Score (ICS), which compares the vectors of SHAP importance with ground-truth attack signatures to measure alignment [11]. Our system is implemented as a modular microservice, deployable on SDN controllers like OpenDaylight, using gRPC for low-latency inference and explanation retrieval. The system’s throughput is 5G core-compatible. Additionally, to support multi-tenancy and cross-slice traffic monitoring, the system’s architecture enables dynamic graph abstraction and federated training across edge sites, without exchanging actual traffic contents [12]. This aligns with privacy-protective standards and ensures flexibility in various 5G implementations.

The system is resistant to adversarial attacks, as SHAP-based monitoring can identify perturbation attempts by detecting anomalies in explaining consistency [13]. GNNs, combined with MHA and SHAP, provide an integrated system for robust, interpretable, and high-throughput IDS in 5G-SDN networks. The proposed solution lays the foundation for trusted AI-assisted cybersecurity in next-generation networks by bridging the gap between deep learning performance and human-understandable outputs.

The introduction of 5G networks and Software Defined Networking (SDN) has gone a long way in enhancing the programmability of the network, traffic engineering, and scalability of the services. But this change has also come with other issues of network security especially with the implementation of Non-IP Data Delivery (NIDD) protocols in the IoT and the increasing complexity of flow-based attacks in SDN worlds. The NGIDS-DS dataset, attempted to depict the actual SDN traffic, reveals that centralized SDN controllers are vulnerable to attacks. They are controller flooding, ARP spoofing and alteration of flow rules. They cannot easily be detected by regular Intrusion Detection Systems (IDS). Meanwhile, the 5G-NIDD data gathers data of NB-IoT and LTE-M devices that are based on non-IP protocols. Due to their basic payloads, malicious activities are difficult to identify with regular ML techniques. Therefore, studies are in growing need of an intrusion detection system, which is capable of structurally modeling the behaviour of a network, processing data quickly, and providing feature-level justification to security experts.

The following points outline some of the key limitations of current IDS models in the context of 5G-SDN and NIDD traffic. These challenges highlight areas that require novel approaches or significant improvements to enhance security in these emerging network environments:

Lack of Necessary Flexibility of Traditional IDS: Static detection models are ineffective in detecting new and multi-stage SDN attacks such as rule overflow or lateral propagation as observed in NGIDS-DS.

The purpose of the study is to develop an effective and explainable intrusion detection model utilizing Graph Neural Networks (GNNs) with built-in Multi-Head Attention (MHA) and SHAP-based interpretability, derived to work with 5G-enabled SDNs and Non-IP Data Delivery (NIDD) traffic in IoT settings. This system was trained and tested using two current datasets. NGIDS-DS models SDN attacks like flow-table saturation and ARP spoofing. The 5G NIDD dataset has structured, non-IP telemetry data common in NB-IoT and LTE-M scenarios. By using graphs to show network traffic and adding attention, the model seeks to spot complex, multi-stage attacks and give human-understandable feature explanations via SHAP. The final aim is a fast, adaptable, and clear IDS that works well with both IP and non-IP traffic in 5G networks.

Graph-Based Modeling for SDN and IoT Traffic: Develop a GNN-based architecture that represents both flow-based (NGIDS-DS) and session-based (5G-NIDD) traffic as dynamic graphs, enabling structured learning of network behaviors.

The structure of this research will be as follows: Section 2 will be a review of studies connected to this one and the areas in which the future study is required. Section 3 provides the details of GNN-MHA-SHAP architecture, data preparation and training. Section 4 presents the findings of experiments and examines explanations. Section 5 discusses the obtained knowledge and its applicability to 5G-SDN rollouts. Lastly, the last Section 6 concludes with recommendations on the direction of further research.

The rapid adoption of 5G and Software Defined Networks has transformed contemporary networking, where it is more flexible, centrally controlled, and flow can be managed easily. Although such changes are useful to manage large IoT systems and high-performance applications, they introduce new cyber threats, such as dynamical and topological attacks. The research indicates that regular Intrusion Detection Systems such as rule based and simple learning models are ill equipped to detect complex attacks in real time. This is attributed to the fact that they do not respond to the changes in the network structures, size, and its operation. Conventional flat feature-vector models often struggle with intricate attack patterns. [14] suggest that AI fusion is needed, noting that current cybersecurity approaches should move toward more advanced methods like GNNs to address these complicated threats. Meanwhile, another detection issue is introduced by Non-IP Data Delivery (NIDD) in 5G networks, particularly in the case of NarrowBand-Internet of Things (NB-IoT) and Long Term Evolution for Machines (LTE-M). Unlike normal IP traffic, NIDD communication usually has structured, lightweight, and regular messages. Attackers use this structure for things like injecting bad session data, spoofing telemetry, and registering devices without permission. The 5G-NIDD data collection, based on actual NIDD telemetry data, shows that standard Intrusion Detection System (IDS) methods fail to find these unusual activities because they lack typical IP-layer traits. Accurate network traffic representation is key for better detection. [15] presented FN-GNN, a new graph embedding method that improves GNN performance by more accurately capturing structural dependencies in network intrusion datasets. Previous works on graph-based intrusion detection typically model the network as a graph: (1)G=(V,E,X)where V is the set of nodes (e.g., hosts, switches, loT devices), E is the set of communication edges (flows), and X∈R|V|×d represents node or edge features (e.g., packet size, flow duration, telemetry frequency). The propagation rule of a standard Graph Convolutional Network (GCN) for IDS is given by: (2)H(l+1)=σ(D^−12A^D^−12H(l)W(l))where A^=A+I is the adjacency matrix with self-loops, D^ is the degree matrix, H(l) is the node embedding at layer l,W(l) is the trainable weight matrix, and σ(⋅) is an activation function such as ReLU. This allows GNNs to capture structural relationships in traffic graphs as shown in NGIDS-DS. To improve adaptability, Multi-Head Attention (MHA) has been integrated into GNNs. The attention coefficient between two connected nodes i and j is defined as: (3)αij(h)=exp⁡(LeakyReLU(a(h)T[W(h)hi‖W(h)hj]))∑k∈𝒩(i)exp⁡(LeakyReLU(a(h)T[W(h)hi‖W(h)hk]))where 𝒩(i) denotes the neighbors of node i,W(h) and a(h) are learnable parameters for head h, and ‖ is concatenation. Multiple attention heads H are then aggregated as: (4)hi′=‖h=1H∑j∈𝒩(i)αij(h)W(h)hj

This formulation enables IDS models to attend to diverse contextual relationships in network graphs, crucial for detecting multi-stage attacks in SDNs.

Finally, to improve explainability, SHAP (SHapley Additive exPlanations) assigns an importance value ϕi to each feature xi contributing to a prediction f(x). The SHAP value is defined as: (5)ϕi=∑S⊆F∖{i}|S|!(|F|−|S|−1)!|F|![f(S∪{i})−f(S)]where F is the set of all features and S is a subset excluding feature i. Due to the special way connected devices are set up, we need specific ways to spot problems [16] came up with an intrusion detection system that uses a GNN, made just for the Industrial Internet of Things. It’s good at finding attacks in these complicated, spread-out networks. This game-theoryic model is such that the attributions of the features are fairly allocated, and additively consistent, so that operators can know whether the flow duration, the entropy of the packets or the frequency of the NIDD messages was the cause of the detection alert. These mathematical models provide a foundation of flexible and comprehensible real-time intrusion detection systems. NGIDS-DS and 5G-NIDD data sets have been used to check them. Graph Neural Networks have taken the step forward, and they allow traffic to be represented as dynamic graphs. This is the relationship between various portions of a network to one another such as hosts, switches, devices, flow paths and message exchanges. Moreover, an addition of Multi-Head Attention to GNNs assists the model to perceive various types of contextual connection. This assists in identifying an attack that occurs in stages and cannot be easily identified [17]. They are good models, though, that do not tell much about the reasons why they have been making the detections they have made, such as what features or interactions caused a decision [18]. To solve this, scientists have resorted to Explainable AI (XAI) approaches and SHapley Additive exPlanations (SHAP) has experienced considerable popularity owing to its capability to assign predictive values to each of the input features. The usefulness of SHAP in graph-based intrusion detection is growing, especially in the analysis of such characteristics as flow length, payload size, NIDD message types, and packet frequency [19]. In [20], the researchers and others demonstrated that the analysis of SHAP plots can visually identify errors in the intrusion detection systems based on ML. This study supports our approach to using SHAP in order to gain forensic insight, and ensure that real-time alerts are very dependable. Even with such developments, there are still a number of gaps. Current IDS models often lack protocol-level adaptability, especially for non-IP or lightweight traffic patterns, and fail to scale under the high-throughput conditions characteristic of 5G networks. Furthermore, the lack of dual support for both SDN-based and NIDD-based communication restricts broader applicability across multi-layered 5G infrastructures. Researchers have also raised concerns regarding latency, false positive rates, and the operational burden of integrating black-box AI models into live network environments [21]. Prior work in intrusion detection systems shows three main weaknesses: simple models of software-defined networking control and OpenFlow, weak support for non-IP telemetry, and a lack of explanation for high-speed 5G situations. Our work attempts to fix these by: (i) modeling SDN traffic as control/data-plane graphs that change with time, (ii) adding non-IP session data with IP flows, and (iii) using SHAP with an attention-guided graph neural network to give explanations for each flow that can scale and still meet 5G speed needs.

This paper will follow a three-step approach, combining graph-based deep learning with attention and explainable AI to detect intrusion in real-time in 5G-enabled SDNs. At first, the network data of NGIDS-DS (1.5M records of flows, 28 features, 10 attack types) and 5G-NIDD (0.8M records, 20 features, non-IP telemetry anomalies) are transformed into dynamic graphs. In such graphs, the nodes represent devices or flows; and the edges depict communication styles. It is then trained by creating a Graph Neural Network (GNN) with three hidden layers with 128 neurons. This GNN contains Multi-Head Attention (MHA) of 8 attention heads per layer to learn various context based relations in the evolving traffic graphs. The model was trained using the Adam optimizer with a learning rate of 1 × 10⁻³. Early stopping was applied during training. A batch size of 64, dropout rate of 0.3, and an L2 regularization penalty of 1 × 10⁻⁴ were used. The second stage involves simulation and validation. This stage is implemented using the Mininet + ONOS SDN controller for SDN flow simulation and the NS-3 LTE module for NIDD traffic. The dataset is divided into 70% for training, 15% for validation, and 15% for testing. Accuracy, Precision, Recall, F1-score, ROC-AUC and latency are used as benchmarks of performance with a target of processing 10,000 flow entries/s with an inference time under 30 ms. They include baselines like SVM, Random Forest, CNN-LSTM, and standard GCN/GAT, which are likely to be significantly lower than the proposed GNN + MHA + SHAP by 8–12. The third part focuses on research that places an emphasis on making things clear with SHAP values. This technique relates predictions with some features, including the length of a flow, the frequency of packets transmission, and the frequency of messages. This assists in ensuring that the decision making process is not complicated to follow. Research use something called an Interpretability Confidence Score (ICS), and it needs to be at least 0.85.

This flowchart in Fig. 1 illustrates the stepwise pipeline beginning with NGIDS-DS and 5G-NIDD dataset preprocessing, followed by graph construction and feature extraction. A multi-layer GNN with 8-head attention is used to model relational dependencies in traffic, while SHAP ensures feature-level explainability of predictions. Decision nodes handle validation accuracy thresholds (>95%), latency constraints (<30 ms per inference), and explainability consistency (ICS ≥ 0.85). The final deployment stage integrates the IDS into an SDN controller with real-time alerts, and the framework is benchmarked on a 5G Testbed for throughput, robustness, and interpretability validation.

The results of this study demonstrate the effectiveness of the proposed GNN-MHA-SHAP-based IDS in detecting intrusions within 5G-enabled SDN environments using the NGIDS-DS and 5G-NIDD datasets. Each table and figure is described comprehensively: we report metric definitions, class-wise breakdowns, and statistically significant comparisons with baselines. Beyond numerical performance, we discuss operational implications for 5G-SDN operators—for example, how the observed latency/throughput trade-offs affect placement (edge vs. central controller), and how SHAP attributions can assist SOC analysts in triage and forensic workflows without violating URLLC requirements. The model had a consistent accuracy of 98.67% and a 97.9% F1-score with a 5–8 margin over the baseline ML and CNN-based IDS models during training. Multi-head attention and SHAP analysis, respectively, improved the skill of the model in capturing fine inter-flow dependencies in SDN traffic graphs and interpreted the feature attributions, respectively, making its approach to decision-making transparent as illustrated in Figs. 7 and 8.

Fig. 7 describes what the model attends the most when it is making a choice of normal or malicious traffic. The more bright the sphere, the more influential it is. You will notice that there are a few features that always tend to drive the prediction to make a prediction of attack and this is because the timings of the flows or pattern of the packets change dramatically. In the case of NIDD traffic, the model disperses its focus on more aspects, implying that it is based on the general behavior of the flow, but not on one signal. This aids in the explanation of why the GNN works better than the traditional methods of IDS; it is identifying subtle relationships in the data, which would have otherwise gone unidentified.

Moreover, the suggested IDS was able to achieve latency values of less than 25 ms, which is below the 5G URLLC (Ultra-Reliable Low-Latency Communication) requirement of 30 ms. The overall findings confirm that the GNN-MHA-SHAP model is not only accurate but also satisfies the strong performance of 5G networks in terms of real-time and scale, as well as strong interpretability of the network operators as demonstrated in Fig. 9.

Table 8 is the combined analysis of the proposed GNN-MHA-SHAP IDS to the classic, advanced, and emerging 5G threats, incorporating 18 different types of attacks. The IDS has always ensured accuracy and detection rates of more than 97 percent and PortScan (99.2) and Fake Base Station (99.1) achieved highest detection rates.

For 5G-connected IoT, detection systems need to be strong and fast [34] pointed out that graph-based methods are more accurate, but making them work well in fast 5G settings is still a key focus. Besides typical intrusions, current IDSs have to resist tricky attacks [35] studied how well GNNs hold up against real-world attacks and stressed that using clear layers like SHAP is important for finding altered input data.

Figs. 10 and 11 ROC curves demonstrate that the performance of classic (e.g., DDoS, Botnet, SQL Injection) and novel (e.g., Fake Base Station, IoT Botnet, Adversarial Evasion) threats of the 5G-SDN environment are poor with baseline IDS models with AUC values of between 0.45 and 0.54. All micro- and macro-average values near 0.49 to 0.50 are evidence of almost random detection, which proves the lack of robustness and scalability of the traditional IDS methods to the complex 5G traffic. Fig. 12 demonstrates the performance of classification based on six key 5G-SDN attacks whose values were normalized in order to compare them. Good detection accuracy is observed with high values of diagonal (more than 95%). In off-diagonal cells, there are some errors, most of them between Botnet and MITM traffic. There is consistency through cross-dataset validation, and it demonstrates that the IDS is generalizable. The 5G live testbed is noisier to a slightly lower extent which is actually a reflection of how complicated live 5G traffic streams are. In general, the findings demonstrate high accuracy, recall and plasticity in both experimental and real-life scenarios as illustrated in Table 9.

Findings of this paper show that the adoption of the GNN using multi-head attention and SHAP-based explainability significantly enhanced intrusion detection in 5G-SDN systems. The biggest enhancement was on detection accuracy, which was higher in 92.15 (baseline models) and 98.67 (proposed IDS). The rate at which it was detected (DR) also increased (89.42 to 99.20) demonstrating the GNN-based method was successful at extracting complex relational aspects of traffic flows. Latency was also minimized at 24.6 ms (compared to 47.3 ms of the existing IDS) to 5G URLLC specifications, and throughput increased to 11,384 flows/sec (compared to 7420 flows/sec). In addition, the interpretability confidence scores (ICS), not applied in the previous studies, were of 0.92 using SHAP-based explanation, which guarantees transparency in essential security applications.

As it can be seen in Table 10, the GNN-MHA-SHAP IDS performs better than the older models in all aspects that are evaluated. The accuracy of attack detection provided by the system is enhanced by 6.52% and the number of attacks identified is nearly 10 higher. This will aid in detecting covert 5G network attacks. Processing speed is nearly doubled and there is increased processing on data by 53.4 percent keeping up with the 5G network requirements. The SHAP tool offers insights into the model’s decision-making process, improving understanding and trust in the results. These results indicate that graph-based deep learning, combined with attention features and explanation tools, is an applicable method for detecting intrusions in SDN-based 5G networks. Recent work has reinforced the need for sophisticated and understandable AI in network security.

The given research work proves the potential of the GNN with Multi-Head Attention and SHAP-based explainability to optimize the results of intrusion detection in 5G-enabled SDNs. Detecting accuracy of the model was 98.67 percent, which is better than the baseline values of 91–93 percent that are being used in the current IDS methods. The detection rate was enhanced to 99.20 making sure that virtually all the malicious traffic was identified properly in various attack categories. The latency was also minimized to 24.6 ms, meaning almost half of the traditional IDS (40–50 ms) and in the 5G URLLC range. Throughput was improved too, and it now supported 7420 flows/sec to 11,384 flows/sec, which was scalable to real-world 5G. The study is a significant contribution since it incorporates SHAP-based interpretability, with an Interpretability Confidence Score (ICS) of 0.92. This renders it distinct and dependable, which studies in the past on intrusion detection system (IDS) have not had. In addition, the tests with NGIDS-DS and 5G-NIDD datasets as well as real-time testbed work demonstrated the robustness of the system and its capability to be effective within different network environments. This method was always superior to previous ones, whose detection rates were typically less than 93 percent, and reaction times were more than 40 ms. The findings confirm this hypothesis that implementing graph-based deep learning and attention approaches and explanation systems can generate an IDS solution that is highly useful, flexible, and comprehensible. To conclude, the GNN-MHA-SHAP IDS offers a future-proof architecture in handling the complex security problems of 5G-enabled SDN deployments. Future research will take the proposed GNN-MHA-SHAP IDS and implement it on federated learning models to provide distributed 5G security without aggregating data in a central location, as well as consider adversarial robustness mechanisms to resist evasion attacks. It is also going to be integrated with 6G-native capabilities, including network slicing and AI-based orchestration to provide scalability and flexibility in future mobile networks.