5G Core & IMS Training

Eight build-and-break courses that take an engineer from running a 5G core, to operating IMS voice, to modelling the network with deep learning and defending it in roaming — all on one low-cost cloud lab.

8Courses
736Runnable cells
~40Guided hours
4Learning tracks

The program is built on the open-source 5G stack — Open5GS (5G Standalone core), UERANSIM (simulated RAN), and a Kamailio + PyHSS IMS subsystem — running together on a single cloud VM. Every procedure is proven with real packet evidence: the habit trained throughout is never claim it works without the signalling to prove it.

Setup 5G Core track IMS / Voice track Data & ML track Security & Roaming track
00

Lab Setup

Prerequisite

Build the whole lab from an empty cloud project — a single VM, a 5G Standalone core, NAT and IP forwarding, the kernel GTP module (with the toolchain pitfall pre-solved so you don't lose an afternoon to it), a simulated RAN and test subscriber, and a three-line smoke test that proves a phone can attach. No prior 5G experience assumed.

You leave able to: You walk away with a working, reproducible 5G lab you own end to end — and the confidence to tear it down and rebuild it from scratch.

41 cells build-your-ownlow-cost cloud VM
Cloud VMOpen5GS installGTP / NATUERANSIMFirst attach
01

5G Core Operations in Practice

5G Core

Live at the console of a running 5G Standalone core. Watch the network functions negotiate over the service-based bus, trace a UE from registration through 5G-AKA authentication to an established PDU session, read the operational dashboard, and — the load-bearing skill — localize a fault to the exact reference point (N1/N2/N3/N4) instead of guessing.

You leave able to: You can look at a broken 5G core and say which function and which interface is at fault, with the signalling to back the claim.

99 cells ~4 hhands-on
NF lifecyclePDU sessions5G-AKAN1/N2/N3/N4Fault localization

Requires 00 · basic Linux + networking

View course →
02

IMS Core & VoNR Procedures

IMS · Voice

Stand up voice on top of the 5G core: a full P/I/S-CSCF call-session chain, an HSS, and a media relay. Drive an IMS-AKA REGISTER, place a VoNR call between two UEs, and decode the SIP and Diameter (Cx: UAR/MAR/SAR/LIR) side by side so the SIP dialog and the subscriber lookups line up. Every step proven with real packet evidence — never "it rang, so it works".

You leave able to: You can bring up IMS voice from nothing and read a VoNR call end to end, separating a signalling problem from a media problem on sight.

111 cells ~4.5 hcore lab
IMS-AKA REGISTERVoNR callCx: UAR/MAR/SAR/LIRSIP + Diameter decodeRTP / MOSSMS over IMS

Requires 01

View course →
03

Advanced 5G Core Engineering

5G Core

Stop watching the network and start changing it. Cut an end-to-end network slice, differentiate QoS with Linux traffic control and prove the shaping in the data plane, harden the core against the TS 33.501 threat model (SUCI/ECIES subscriber-identity protection included), reconstruct signalling from the NF discovery API, and stand up a KPI pipeline that feeds an AI root-cause on-ramp.

You leave able to: You can engineer a differentiated, hardened core to a requirement — and show the packets and KPIs that prove the change did what you claimed.

71 cells ~5 hengineering
Network slicingQoS / tc shapingTS 33.501 securitySUCI / ECIESSignalling forensicsKPI pipeline

Requires 01 · 02 recommended

View course →
04

Advanced IMS Scenarios & Service Engineering

IMS · Voice

The service layer that turns a raw call into a product: initial Filter Criteria routing to Application Servers over ISC, the MMTEL suite (hold, call diversion, barring, identity presentation/restriction), transfer and conference (REFER), emergency (sos) calls, access continuity (T-ADS, SRVCC), interconnect (ENUM, IBCF/TrGW) and Rf/Ro charging. Roughly half is offline reference call-flows that run with no lab attached.

You leave able to: You can reason about why a supplementary service misbehaves — from the iFC that should have triggered to the AS that answered — not just whether.

119 cells ~6 h20 call-flows
iFC / AS / ISC / ShMMTEL servicesREFER / conferenceEmergency (sos)T-ADS / SRVCCENUM / IBCFRf/Ro charging

Requires 02

View course →
05

Data Engineering, Analytics & ML

Data · ML

Turn the telemetry every earlier course emits into a full data-science lifecycle — ingestion, a time-aligned feature store, analytics on standardized TS 28.554 KPIs, visualization for two audiences, and machine learning (Isolation-Forest anomaly detection, DTW fault classification, seasonal forecasting). The recurring lesson is honesty: a 0.99 score is usually a leak, and every model ends by asking what would be true on real traffic. Ships two notebooks — a synthetic edition that runs anywhere, and a live-lab edition on real telemetry.

You leave able to: You can build an honest pipeline from packets to predictions — and you trust the lower, leak-free number over the flattering one.

179 cells 101 + 78 cells~7 h + 4 h
Ingestion & feature storeSessionizationTS 28.554 KPIsIsolation ForestDTW classificationForecastingMLOps

Requires 01 · 02/03 for vocabulary

View course →
06

Deep, Graph & Federated ML

Data · ML

The honest case for deep learning in a telco: when a deep, graph or federated method genuinely beats the classical baseline from Course 05 — and, just as often, when it does not. CNNs/ROCKET for KPI time series, sequence models and self-attention for signalling ladders, graph neural nets that localize a fault on the service-based topology itself, deep anomaly detection, federated learning across sites that never share raw data, and a trust layer — conformal prediction, drift detection and a human in the loop. Offline, no GPU required.

You leave able to: You can pick the right model for a telco problem on evidence, and wrap it in the calibration and drift checks that make it safe to trust.

52 cells ~5 hoffline · no GPU
CNN / ROCKETSequence models · attentionGraph neural netsDeep anomaly detectionFederated learning (FedAvg)Conformal predictionDrift & trust

Requires 05

View course →
07

IMS Roaming & Signalling Security

Security · Roaming

Cross the operator boundary and learn to defend it. The roaming architecture (home vs visited network, the IPX, the DEA and the SEPP), legacy SS7/MAP and CAMEL flows and why they are dangerous, Diameter roaming over S6a, VoLTE/VoNR roaming (S8HR vs local breakout), 5G roaming secured by the SEPP over N32/PRINS, signalling firewalls built to GSMA guidance (FS.11/FS.19), roaming-fraud detection (IRSF, Wangiri, SIM-box), and the on-call side — incident response and operations. Offline-first.

You leave able to: You can read an inter-operator signalling flow for both correctness and attack, and reason about the firewall rule that should have stopped it.

64 cells ~6 hoffline-first
Roaming architectureSS7 / MAP / CAMELDiameter S6aVoLTE/VoNR roamingSEPP · N32 · PRINSSignalling firewallsFraud detectionIncident & on-call

Requires 02 (+ 01)

View course →

The one idea the whole path is built on

Every voice fault forks into the pipe (5G core) versus the application (IMS). Course 01 owns the pipe, Course 02 owns the application, the advanced pair deepens each, and Course 05 teaches the machine to read both. You leave able to answer that fork first — with evidence, not guesswork. Courses 06–07 then extend that reflex to the model layer (deep, graph & federated learning) and to the operator boundary (roaming and signalling security).

Build 00 Operate 01 Call 02 Engineer 03·04 Model 05·06 Defend 07

What each course ships

A self-contained package, not just a notebook.

  • Notebook — the instrument you run, cell by cell
  • Guide — a narrative companion, module by module
  • Assessments — quizzes, a practice test and a capstone
  • Slides — concept decks for the theory
  • Resources — quick-reference cards and a glossary

Cell-safety discipline

Every cell is labelled so you always know what it does.

  • 🟢 read-only — inspects, never changes the lab
  • 🟠 changes state — starts a service, provisions a UE
  • 🔴 instructor-guarded — fault injection; never fires on Run All