## 4 Real-Time Threat Detection and Response
### Illustrative Use Cases in High-Speed Networks  
As new air interfaces and spectrum bands are introduced in 5G and beyond, edge-based anomaly detection systems help maintain Quality of Service by detecting and isolating malicious traffic swiftly [47]. One such successful method is the deployment of a deep learning model in every base station to detect anomaly activities, such as unusually high data transfer from a single endpoint, to alert the network administrators before the threat expands. This becomes very important in smart factories and industrial environments, where edge gateways using compressed machine learning models can constantly monitor operational data for anomalies. In such environments, anomalies in sensor readings or control commands can point to possible security breaches that need immediateaction [48]. Integrating Azure IoT Edge with real-time analytics engines further strengthens this capability by automating the process of threat identification and mitigation. Smart city infrastructure benefits from similar approaches, as edge nodes that oversee traffic lights, surveillance cameras, or public utilities can leverage lightweight intrusion detection or anomaly detection software to protect essential services. By installing ONNX runtime-optimized models on traffic controller units, network administrators can swiftly detect and react to suspicious patterns, such as repeated unauthorized requests to camera feeds, ensuring the safety and resilience of urban systems [49]. Future directions in real-time threat detection and response must account for the rapid evolution of cyber threats, the increasing complexity of network environments, and the growing emphasis on data privacy. One key avenue is the development of dynamic model updates that operate seamlessly at the edge. As new threats emerge or evolve, security models require continuous retraining to maintain high detection accuracy. Because edge devices often run with constrained resources, frameworks that enable automated, on-device retraining without interrupting essential services are critical. Recent studies highlight federated learning and decentralized approaches as viable methods for dynamic updates, allowing distributed networks to share learned parameters while keeping raw data local for confidentiality and reduced latency [50; 51]. Alongside dynamic updates, next-generation networks, including 5G and 6G, demand specialized optimizations to handle massive device density, ultra-high data rates, and the stringent latency requirements of mission-critical applications. Dedicated security slices and network functions optimized for near-real-time machine learning inference can support proactive threat mitigation and anomaly detection. Research has shown that deep learning-based intrusion detection systems, when combined with hardware acceleration and slicing mechanisms, can meet the millisecond-level latencies required in these high-speed environments [47; 51]. Those may involve on-board accelerators, model compression techniques, and adaptive routing protocols with an emphasis on security tasks while ensuring Quality of Service is maintained. Ultimately, striking a balance between end-to-end encryption and the need for continual, efficient monitoring is a significant challenge. Since data privacy regulations and user demands increasingly push for stronger encryption mechanisms, security analysts and researchers are exploring how homomorphic encryption or secure multiparty computation might enable network operators to detect threats within encrypted traffic without exposing sensitive information. Recent efforts in privacy-preserving machine learning show promise in performing inference on encrypted data with relatively low performance overhead, although these techniques remain an active area of research for scalability and speed [49].