Conf-Gate XGBoost-RF Hybrid Model for Multi-Class Anomaly Classification in 5G-Enabled eMTC IoT Networks.

Abstract

The rapid growth of Internet of Things (IoT) deployments in 5G Enhanced Machine-Type Communication (eMTC) networks has significantly increased the network attack surface. A major challenge for Network Anomaly Detection Systems (NADS) in this environment is severe class imbalance, where dominant benign traffic obscures rare but high-impact attacks, leading to poor minority-class detection. This paper presents Conf-Gate XGBoost-RF, a two-stage hybrid anomaly detection architecture designed to address this limitation without compromising real-time performance. The framework employs a high-speed XGBoost classifier for initial screening and a confidence-gated mechanism that selectively routes low-confidence predictions to a specialist Random Forest trained on synthetically balanced data. Evaluation on the large-scale CICIoT2023 dataset shows that the proposed model achieves 99.32% accuracy and a Macro F1-score of 0.80, substantially outperforming single-stage baselines. Notably, recall for critical low-volume attacks, such as Command Injection, improves by over 34%. With an average inference latency of 0.87 ms, the proposed approach remains compatible with the stringent low-latency requirements of 5G eMTC control signaling, demonstrating a practical balance between computational efficiency and rare-attack sensitivity.