LENS: Lightweight and Explainable LLM-Based APT Detection at the Edge for 6G Security
IEEE Access, cilt.13, ss.172402-172415, 2025 (SCI-Expanded, Scopus)
- Yayın Türü: Makale / Tam Makale
- Cilt numarası: 13
- Basım Tarihi: 2025
- Doi Numarası: 10.1109/access.2025.3616235
- Dergi Adı: IEEE Access
- Derginin Tarandığı İndeksler: Science Citation Index Expanded (SCI-EXPANDED), Scopus, Compendex, INSPEC, Directory of Open Access Journals
- Sayfa Sayıları: ss.172402-172415
- Anahtar Kelimeler: 6G mobile communication, Lenses, Image edge detection, Real-time systems, Telecommunication traffic, Correlation, Computer security, Cryptography, Cross layer design, Semantics, 6G networks, advanced persistent threats (APTs), large language models (LLMs), edge computing, explainable artificial intelligence (XAI)
- Boğaziçi Üniversitesi Adresli: Evet
Özet
Expected to be deployed in the early 2030s, sixth-generation (6G) wireless networks, with their high speed and integration with cutting-edge technology such as intelligent edge computing, expand the attack surface and face serious cyber threat risks such as Advanced Persistent Threats (APTs). This type of cyber attack can imitate benign network traffic and operate for long periods of time without being detected by traditional detection systems. This paper introduces LENS, a lightweight and explainable LLM-based network security framework designed to address this cybersecurity threat for 6G environments. LENS uses a fine-tuned DistilBERT model to convert raw network streams into natural language commands using contextual metadata and is trained on the CICAPT-IIoT (2024) dataset generated using real-time network traffic data. To evaluate the proposed model, adapted versions of DeepLog and EarlyCrow are compared using F1-score, false positive rate, and explainability metrics for binary APT classification on the CICAPT-IIoT dataset. All models are trained using a high-performance GPU (Nvidia A10) and validated by deploying on a real-world resource-constrained edge node (Raspberry Pi 4). The results confirm that LENS has higher performance in APT detection with 0.82 accuracy and 0.82 recall despite consuming higher energy compared to the other two baselines, and is applicable for edge-enabled 6G environments.