From User-Plane Telemetry to Closed-Loop Control: NWDAF-Enabled Automation in 5G Networks

Abstract

The fifth generation of cellular technology (5G) delivers faster speeds, lower latency, and improved network service alongside support for a large number of users and a diverse range of verticals. This brings increased complexity to network control and management, making closed-loop automation essential. In response, the 3rd Generation Partnership Project (3GPP) introduced the Network Data Analytics Function (NWDAF) to streamline network monitoring by collecting, analyzing, and providing insights from network data.

While prior research has focused mainly on isolated applications of machine learning within NWDAF, critical aspects such as standardized data collection, analytics integration in closed-loop automation, and end-to-end system evaluation have received limited attention. This work addresses existing gaps by presenting a practical implementation of NWDAF and its integration with leading open-source 5G core network solution.

We designed a closed-loop-enabled system that can collect UE communication data from the User Plane Function (UPF) via the UPF Event Exposure Service (UPF EES), and provision different machine learning models based on the analytics use case using our ML Model Provision Service integrated with MLflow. Additionally, we implemented user-plane token-bucket-based rate policing to enable fine-grained traffic enforcement actions. We showed that, with one active subscriber to the Event Exposure Service, UPF increases the one-way delay by at most 0.11 ms and the CPU usage by less than 6.5\% compared to the baseline UPF across different data rates. For memory usage, we observed only a small constant overhead that was independent of throughput. We also demonstrated the scalability of our UPF EES by increasing the number of active UEs and examining its effect on the UPF’s CPU and memory utilization. Additionally, we investigated the resource usage of different NWDAF components across different reporting intervals, showing that the ML Model Provision Service is the most resource-intensive component of the NWDAF.

Building on this framework, we instantiated two closed-loop use cases: (i) anomaly detection and mitigation, in which we use graph-based features derived from UPF telemetry to detect bot behavior and ban anomalous User Equipments (UEs) from the network, and (ii) dynamic QoS adaptation, in which we adjust the traffic rate of UEs based on the level of congestion using a confidence-driven heuristic that maps congestion levels to proportional rate adjustments. We demonstrate the effectiveness of each closed-loop system and identify the associated trade-off in use case (i), namely between data collection interval and detection latency. In use case (ii), we show that the proposed mechanism can protect guaranteed flows through runtime rate adaptation.