An Unsupervised Detection-to-Mitigation Framework for Resource Exhaustion Attacks in 5G/6G Network Slicing

Massive Internet of Things (IoT) and sensor-network services in 5G/6G systems increasingly rely on network slicing to support large-scale sensing, monitoring, and mission-critical applications. In such sliced infrastructures, Proportional Fair (PF) allocation assigns resources according to slice-reported demands. This reliance on trusted demand reporting makes coexisting slices, including mMTC-based IoT sensor slices, vulnerable to resource exhaustion attacks, where a malicious slice inflates its demand to monopolize shared resources and induce Service Level Agreement (SLA) violations. Existing unsupervised defenses mainly focus on anomaly detection, while the translation of detection results into resource-level mitigation remains insufficiently addressed. To bridge this gap, this paper proposes AutoGuard-Hybrid, an unsupervised detection-to-mitigation framework that combines complementary anomaly detectors with allocation-aware mitigation policies to preserve slice-level service availability. Unlike prior detection-only approaches, AutoGuard-Hybrid converts unsupervised anomaly evidence into allocation-aware demand purification before PF scheduling. Its key design is a closed-loop integration of Isolation Forest (IF) and Long Short-Term Memory Autoencoder (LSTM-AE) as spatial and temporal front-end detectors with Adaptive Clipping and a Safety Cap, which translate anomaly scores into demand purification actions. Experiments show that AutoGuard-Hybrid remains comparable to Isolation Forest under Continuous attacks and improves the mean system-wide SLA violation rate by 27.6% under Adaptive Probing attacks. Stage activation analysis further shows that LSTM-AE activations increase from 9.3 under Continuous attacks to 29.4 under Adaptive Probing attacks. Ablation results show that Adaptive Clipping alone reduces the system-wide SLA violation rate by 75.0%, while the full mitigation pipeline achieves an 84.6% total reduction. AutoGuard-Hybrid operates within the 1 ms Transmission Time Interval (TTI) constraint and provides a practical defense framework for next-generation network slicing-enabled IoT and sensor-network services.