Traditional Intrusion Detection Systems (IDSs) that rely on fixed signatures or basic machine learning often struggle with sophisticated, multi-stage cyberattacks and previously unknown threats. To fix these problems, this paper introduces IntrusionNet, a mixed deep learning system that combines Convolutional Neural Networks (CNN), Recurrent Neural Networks (RNN), and Autoencoders in a two-part design. Differing from typical stacked models, IntrusionNet works on two levels at the same time. First, a supervised CNN-RNN process pulls spatial-temporal data from traffic flows to sort well-known attack patterns. Second, an unsupervised Autoencoder process spots new anomalies by looking at reconstruction error limits. This approach allows the automatic learning of threat traits as they change, without needing someone to do it by hand. The system was tested on the UNSW-NB15 data set, picked because it realistically includes many kinds of attacks, like Fuzzers, Shellcode, and Worms. Tests show that IntrusionNet gets an accuracy of 98.80% and an F1-score of 0.985, doing better than other systems, especially with less common attack types. Also, tests using Precision-Recall (PR) analysis and False Positive Rate (FPR) measurements prove that the model handles class imbalance well, which is key for real-world security. The suggested system can be scaled up easily and performs calculations fast, making it a possible key part of real-time detection in Security Information and Event Management (SIEM) systems.

The rapid evolution of 5G-enabled Software Defined Networks (SDNs) has transformed modern communication systems by enabling ultra-low latency, massive connectivity, and high throughput. However, the increased complexity of traffic flows and the rise of sophisticated cyber-attacks such as Distributed Denial of Service (DDoS), Botnets, Fake Base Stations, and Zero-Day exploits have made intrusion detection a critical challenge. Traditional Intrusion Detection System (IDS) approaches often suffer from poor gen-eralization, high false positives, and lack of interpretability, making them unsuitable for dynamic 5G environments. This paper presents a novel Graph Neural Network (GNN) with Multi-Head Attention (MHA) and SHAP-based explainability for robust, interpretable, and high-throughput intrusion detection in 5G-SDN. The model is evaluated on the NGIDS-DS and 5G-NIDD datasets, along with a real-time 5G testbed, and achieves a detection accuracy of 98.67% and a detection rate of 99.20%, outperforming baseline IDS models (92.15% accuracy and 89.42% detection rate). Latency is reduced to 24.6 ms compared to 47.3 ms in existing methods, while throughput improves from 7420 flows/sec to 11,384 flows/sec, demonstrating scalability under 5G traffic loads. Furthermore, the integration of SHAP ensures an Interpretability Confidence Score (ICS) of 0.92, providing transparency in decision-making for security-critical applications. The proposed framework significantly enhances detection robustness, reduces overhead, and maintains compliance with 5G Ultra-Reliable Low-Latency Communication (URLLC) performance thresholds, making it a strong candidate for real-world 5G deployments.