Securing GTP Protocol on Cellular Networks using Anomaly Based Intrusion Detection System

Abstract

Cellular networks are expanding swiftly, and this growth has been accompanied by an increase in the activities of advanced threat actors such as Liminal Panda and Light Basin. These groups often direct their efforts toward both network operators and subscribers. Their objectives encompass financial profit, espionage, and extensive data exfiltration. A significant incident took place at SK Telecom in April 2025, when malicious actors gained unauthorized access to subscriber data stored within the Home Subscriber Server. Incidents of this magnitude underscore the critical importance of dependable security solutions capable of identifying malicious traffic within the core of cellular infrastructures. This study proposes an anomaly-based intrusion detection system utilizing a Convolutional Neural Network (CNN) to augment the security of the General Packet Radio Service Tunnelling Protocol. The CNN learns standard traffic patterns during training and detects anomalous behavior when certain thresholds are surpassed. This method facilitates rapid identification of many types of malicious behavior. The experimental analysis indicates that the proposed model exhibits high performance, achieving an accuracy of 99.07%, precision of 98.59%, recall of 99.43%, and an F1-score of 99.05%. These results illustrate the efficacy of CNN-based anomaly detection as a robust protective strategy for cellular networks.