Search papers, labs, and topics across Lattice.
This study evaluates the trade-off between detection performance and computational cost in AI-based intrusion detection for 5G networks by comparing traditional machine learning models, such as XGBoost and TabNet, against a large language model (LLM). The results reveal that traditional models consistently achieve near-perfect detection performance with minimal inference time, while LLMs exhibit significantly poorer performance and substantially higher CPU usage, even with few-shot prompting. These findings underscore the necessity of selecting models based on task suitability, as the complexity of LLMs does not translate to better performance in this specific application.
Traditional machine learning models outperform large language models in 5G intrusion detection, achieving near-perfect accuracy with far less computational cost.
The increasing adoption of Artificial Intelligence (AI) in network intrusion detection raises the question of whether complex and computationally expensive models are justified for this task. In this work, we investigate the trade-off between detection performance and computational cost for intrusion detection in 5G network telemetry. We compare traditional machine learning (ML) models, including XGBoost as a representative of tree ensemble, and TabNet for tabular deep neural network (DNN), with a large language model (LLM) used as a general-purpose intrusion detector. The LLM is evaluated under both zero-shot and few-shot prompting configurations. We evaluate the models in terms of detection performance, inference time, and CPU time as a proxy for energy efficiency. Using a relatively large available 5G dataset, we show that traditional ML models consistently achieve near-perfect detection performance with negligible inference time, while LLM-based approaches perform significantly worse and incur orders-of-magnitude higher CPU usage. Few-shot prompting improves recall, but at the cost of lower accuracy and further increased CPU time, without closing the performance gap. These findings indicate that, for tabular intrusion detection in 5G networks, XGBoost offers a substantially better performance-cost trade-off than DNNs and LLMs, highlighting the importance of selecting models based on task suitability rather than increasing complexity.
