Abstract: An apparatus for 5G security management of a malicious device based on an open-radio access network (O-RAN) architecture includes a service management orchestration (SMO) unit, an O-RAN element unit and an artificial intelligence (AI) processing unit. The SMO unit includes a non-real time radio access network intelligent controller (non-RT RIC). The non-RT RIC collects a non-real time traffic data of a user. The O-RAN element unit includes a near-real time radio access network intelligent controller (near-RT RIC). The near-RT RIC collects a near-real time traffic data of the user. The AI processing unit is configuring to classify the user into one of a plurality of categories, predict at least one traffic index of the user, and determine whether the user is the malicious device.