With the rapid advancement of mobile communication networks, key technologies such as Multi-access Edge Computing (MEC) and Network Function Virtualization (NFV) have enhanced the quality of service for 5G users but have also significantly increased the complexity of network threats. Traditional static defense mechanisms are inadequate for addressing the dynamic and heterogeneous nature of modern attack vectors. To overcome these challenges, this paper presents a novel algorithmic framework, ScalaDetect-5G, designed for high-precision intrusion detection in 5G environments. ScalaDetect-5G adopts a three-stage architecture comprising traffic feature extraction, elastic representation, and adaptive classification. Specifically, an enhanced Concrete Autoencoder (CAE) is employed to reconstruct and compress high-dimensional network traffic features, producing compact and expressive representations suitable for large-scale 5G deployments. To further improve accuracy in ambiguous traffic classification, a Residual Convolutional Long Short-Term Memory model with an attention mechanism (ResCLA) is introduced, enabling multi-level modeling of spatial–temporal dependencies and effective detection of subtle anomalies. Extensive experiments on benchmark datasets—including 5G-NIDD, CIC-IDS2017, ToN-IoT, and BoT-IoT—demonstrate that ScalaDetect-5G consistently achieves F1 scores exceeding 99.19% across diverse network environments, indicating strong generalization and real-time deployment capabilities. Overall, ScalaDetect-5G achieves a balance between detection accuracy and deployment efficiency, offering a scalable, flexible, and effective solution for intrusion detection in 5G and next-generation networks.

Fileless webshell attacks against Java web applications have become more frequent in recent years as Java has gained market share. Webshell is a malicious script that can remotely execute commands and invade servers. It is widely used in attacks against web applications. In contrast to traditional file-based webshells, fileless webshells leave no traces on the hard drive, which means they are invisible to most antivirus software. To make matters worse, although there are some studies on fileless webshells, almost all of them are aimed at web applications developed in the PHP language. The complex mechanism of Java makes researchers face more challenges. To mitigate this attack, this paper proposes JShellDetector, a fileless webshell detector for Java web applications based on program analysis. JShellDetector uses method probes to capture dynamic characteristics of web applications in the Java Virtual Machine (JVM). When a suspicious class tries to call a specific sensitive method, JShellDetector catches it and converts it from the JVM to a bytecode file. Then, JShellDetector builds a Jimple-based control flow graph and processes it using taint analysis techniques. A suspicious class is considered malicious if there is a valid path from sources to sinks. To demonstrate the effectiveness of the proposed approach, we manually collect 35 test cases (all open source on GitHub) and test JShellDetector and only two other Java fileless webshell detection tools. The experimental results show that the detection rate of JShellDetector reaches 77.1%, which is about 11% higher than the other two tools.