SIP-Classifier: Unsupervised Classification of SIP-IMS Signaling With Transformer and Clustering

Ensuring the reliability of voice services in 5G networks requires effective detection of anomalies in IMS signaling. However, this task remains challenging due to the architectural complexity of IMS and the large volume of signaling data. In this paper, we propose SIP-Classifier, an unsupervised methodology that combines Transformer-based representation learning with clustering to identify anomalous SIP sequences. The approach encodes SIP messages through protocol-aware tokenization, learns latent representations via an autoregressive Transformer, and clusters them to distinguish valid from anomalous flows. We evaluate the method on real-world IMS data collected from operational 5G networks. It achieves 98% accuracy, 98% precision, 95% recall, and a 96% F1-score, significantly outperforming state-of-the-art approaches.