5G networks increasingly rely on key enabling technologies such as Software-Defined Networking (SDN), Network Function Virtualization (NFV), Multi-Access Edge Computing (MEC), and end-to-end network slicing to deliver heterogeneous services with strict quality-of-service (QoS) guarantees. However, programmability, multi-tenancy, and distributed edge–cloud operation significantly expand the attack surface. At the same time, traditional rule-based and reactive security mechanisms remain slow to adapt and may violate latency constraints during mitigation. This paper addresses the problem of QoS-compliant, closed-loop security control for
sliced SDN/NFV infrastructures. We propose an AI-assisted, cross-layer security orchestration framework that integrates epoch-wise telemetry with ML-based risk estimation and formalizes mitigation as a Constrained Markov Decision Process (CMDP). The CMDP controller selects enforceable actions—slice isolation, rate limiting, traffic rerouting, and key reconfiguration—while explicitly satisfying latency/overhead constraints, and executes them via SDN flow-rule updates and NFV policy/VNF reconfiguration. Simulation results over 50 decision epochs demonstrate effective response to an injected high-risk event: risk spikes to 0.95 at epoch 15, after which the controller drives risk toward ≈0.10 while maintaining latency below the 40ms QoS bound (with a transient rise during mitigation and subsequent stabilization). The reward trajectory briefly degrades during disruption but recovers and converges to a positive long-term return, indicating stable constraint-aware operation. This work provides (i) a deployable cross-layer orchestration architecture for sliced networks, (ii) a QoS-constrained CMDP decision model that converts risk signals into actionable SDN/NFV controls, and (iii) empirical evidence
that adaptive mitigation can reduce security risk without sacrificing service guarantees.