## 2 Architectures of 5G and 6G Networks
### ML Algorithms for Detection
#### 3.1.1 Proposed Methodology and Corresponding Tool  
ML provides a potent way of detecting both known and new security threats in wireless networks [26; 27]. The initial step in any robust methodology is the collection of relevant data from wireless network traffic, log files, and management systems. Examples of such data include signal strength indicators (RSSIs), metadata related to packets, usage \begin{table}
\begin{tabular}{p{113.8 pt} p{113.8 pt} p{113.8 pt} p{113.8 pt}} \hline \hline
**ML Technique** & **Purpose** & **Advantages** & **Challenges** \\ \hline Supervised Learning (Random Forest, XGBoost) & Classify known attacks on labeled training data & High accuracy on known attack patterns & Requires large, labeled datasets; poor to zero-day attacks \\ \hline Unsupervised Learning (K-Means, Isolation Forest, Autoencoders) & Detect anomalies without needing labeled data & Good for unknown threats and evolving attacks; good for dynamic environments & High false positives; harder to tune \\ \hline Reinforcement Learning (e.g., Q-Learning, Deep Q-Networks) & Optimize adaptive responses and proactive threat mitigation & Learns best defense strategies dynamically; adapts to changing threats & Slow convergence; exploration–exploitation trade-off \\ \hline Deep Learning (e.g., CNNs, RNNs, Transformers) & Automatic feature extraction from raw traffic data & Handles large and complex datasets & High computation cost; explainability issues; black-box nature \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Comparative overview of machine learning techniques for intrusion detection and prevention in 5G/6G networks. of protocols, and time intervals that reflect traffic patterns [28]. Ensuring its quality and relevance is crucial, so any incomplete, duplicated, or corrupted records should be removed at this stage [29]. Preprocessing often involves normalizing numeric features (e.g., with standard scaling) and, if necessary, using dimensionality reduction techniques like PCA or t-SNE to simplify high-dimensional inputs [30; 31]. Feature engineering can either be expert-driven, focusing on domain-specific indicators such as packet types, signal strength fluctuations, and connection attempt frequencies, or automated through deep learning models that learn feature representations directly from the data [32]. Once the features are defined, choosing the right ML algorithm depends on the data scenario and detection goals. Supervised methods like Random Forest or Gradient Boosting excel when representative labeled examples of normal and malicious behavior are available [33]. Unsupervised and anomaly-detection approaches such as Isolation Forest or Autoencoders are valuable when labeled data is scarce, particularly for detecting zero-day or novel threats that deviate from expected behavior [34; 35]. Deep learning architectures, including LSTMs for time-series data and CNNs for spatial or grid-like data, can be especially effective for complex patterns. After selecting an algorithm, the ML model is trained and validated, often splitting the dataset into training, validation, and test sets to confirm effectiveness and avoid overfitting [26; 27]. Hyperparameter tuning via methods like grid search or Bayesian optimization can further refine performance [36]. Metrics such as precision, recall, the F1-score, or AUC-ROC curves are typically used to assess how well the model distinguishes between benign and malicious events [37]. Once the performance is satisfactory, the model is ready for deployment in a real-time environment where it merges with network monitoring frameworks to classify or assess incoming traffic. Specific thresholds or anomaly scores may trigger automated notifications or actions, such as the isolation of potentially malicious endpoints [38]. A continuous feedback loop, leveraging new data from detected anomalies or false alarms, helps refine the model and maintain its accuracy over time [18; 27].