Enhanced RNN-Autoencoder for Time-Series Anomaly Detection in 5G Networks

To build a realistic anomaly detection workflow, the data was not treated as an abstract benchmark. Instead, it was generated and collected from a practical SDR-based 5G environment. The setup included a machine running the 5G core and gNB stack, a separate machine acting as the UE-side receiver and analysis node, and a jammer machine used to inject controllable attack scenarios. This made it possible to observe both normal RF behavior and attack-driven spectral deviations under realistic over-the-air conditions.

From the collected I/Q streams, the data engineering stage focused on transforming raw signal captures into model-ready sequential inputs. This included windowing, sequence construction, normalization, and organization of temporal slices for training and inference. In other words, this stage plays the role of feature engineering for time-series RF learning, where the objective is to preserve temporal behavior while making the sequences consistent and learnable for the encoder-decoder model.

After collection and preprocessing, the project uses a streaming-oriented data pipeline to move sequential signal data into the anomaly detection workflow. The core engineering goal here was not only model accuracy, but also deployment readiness: the system needed to support continuous ingestion, structured buffering, and model-side processing under high-volume RF data conditions.

To support this, I designed the pipeline around Apache Kafka so that incoming time-series sequences could be transported between stages in a reliable streaming format. In the portfolio context, this section highlights the AI/ML engineering layer of the project: moving data from live signal capture, through preprocessing and batching, into model inference and anomaly decision logic. The deployed workflow combines signal ingestion, temporal feature construction, model serving, and alert-oriented inference.

Model Architecture

At the model level, the system follows a sequence-to-sequence reconstruction framework. The encoder maps the input signal sequence into a compressed latent representation, the attention mechanism reweights informative temporal regions, and the decoder reconstructs the expected normal behavior. The anomaly score is then computed from the distance between the original sequence and the reconstructed sequence. This makes the architecture suitable for unsupervised anomaly detection in settings where threat patterns are dynamic and not easily expressed through fixed signatures.

Inference Results and Evaluation

The evaluation stage focuses on how well the trained model separates normal and anomalous RF behavior during inference. Since the model is trained to reconstruct normal temporal patterns, the most important signal at inference time is the reconstruction error profile. When the incoming sequence follows normal behavior, the original and reconstructed I/Q trajectories remain closely aligned. When jammer-driven or abnormal spectral behavior appears, the reconstructed output diverges and the sequence produces a noticeably larger anomaly score.

From a machine learning perspective, this section demonstrates the transition from training-time representation learning to deployment-time inference. The plots below show the practical effect of the model: abnormal intervals generate stronger error excursions, while normal intervals stay near the expected reconstruction manifold.

Tech Stack and Deployment