AI 中文总结
本研究针对5G网络入侵检测任务，对比XGBoost、TabNet和LLM等模型，发现XGBoost在性能与计算成本上的权衡最优，强调需根据任务适用性选择模型而非追求复杂度。
AI 中文摘要
人工智能（AI）在网络入侵检测中的应用日益广泛，这引发了一个问题：复杂且计算成本高昂的模型是否适用于该任务。本研究针对5G网络遥测中的入侵检测，探究检测性能与计算成本之间的权衡关系。我们对比了传统机器学习（ML）模型，包括作为树集成代表的XGBoost、用于表格数据的深度神经网络（DNN）TabNet，以及作为通用入侵检测器的大语言模型（LLM），并在零样本和少样本提示配置下对LLM进行评估。我们从检测性能、推理时间、作为能效代理的CPU时间三个维度评估模型。利用规模相对较大的可用5G数据集，研究显示传统ML模型始终能达到近乎完美的检测性能，且推理时间可忽略不计；而基于LLM的方法性能显著更差，CPU使用量则高出数个数量级。少样本提示可提升召回率，但会导致准确率降低、CPU时间进一步增加，且无法缩小性能差距。这些发现表明，对于5G网络中的表格型入侵检测，XGBoost相比DNN和LLM具有明显更优的性能-成本权衡，凸显了根据任务适用性选择模型而非单纯追求复杂度提升的重要性。
英文摘要
The increasing adoption of Artificial Intelligence (AI) in network intrusion detection raises the question of whether complex and computationally expensive models are justified for this task. In this work, we investigate the trade-off between detection performance and computational cost for intrusion detection in 5G network telemetry. We compare traditional machine learning (ML) models, including XGBoost as a representative of tree ensemble, and TabNet for tabular deep neural network (DNN), with a large language model (LLM) used as a general-purpose intrusion detector. The LLM is evaluated under both zero-shot and few-shot prompting configurations. We evaluate the models in terms of detection performance, inference time, and CPU time as a proxy for energy efficiency. Using a relatively large available 5G dataset, we show that traditional ML models consistently achieve near-perfect detection performance with negligible inference time, while LLM-based approaches perform significantly worse and incur orders-of-magnitude higher CPU usage. Few-shot prompting improves recall, but at the cost of lower accuracy and further increased CPU time, without closing the performance gap. These findings indicate that, for tabular intrusion detection in 5G networks, XGBoost offers a substantially better performance-cost trade-off than DNNs and LLMs, highlighting the importance of selecting models based on task suitability rather than increasing complexity.
CommentsThis paper was accepted and presented at the 2026 IEEE International Symposium on Measurement in Networking and Communications and will appear in the conference proceedings soon
DOI：10.1109/MNC69143.2026.11680628
