AI-Native Closed-Loop Security for 6G-Enabled Cyber-Physical Systems: From Edge Detection to Network-Wide Mitigation

Abstract: In sixth-generation (6G) networks, billions of cyber-physical systems (CPSs) - autonomous vehicles, smart grids, industrial robots, and remote-surgical equipment - will run over ultra-reliable low-latency slices, collapsing the gap between a remote breach and physical harm to milliseconds, a budget perimeter firewalls and centralised security operations centres cannot meet. This survey reframes 6G CPS security as a closed-loop, AI-native pipeline that senses at the multi-access edge computing (MEC) tier, using minute-scale call-detail records (CDRs) for baseline learning and sub-millisecond RAN/Open-RAN (O-RAN) telemetry for the latency-critical path. It decides locally with compressed deep models, mitigates network-wide via SDN, NFV, and O-RAN controllers, and retrains through federated learning (FL) and digital-twin (DT) replay. We formalise a per-slice, tail-bounded latency contract on the sense, detect, and mitigate stages, enforced at a slice-dependent tail percentile (p99 for safety-critical URLLC slices). Organising 128 peer-reviewed studies (2017-2026) under a PRISMA 2020 protocol, we (i) map the 6G/CPS threat surface to MITRE ATT&CK and a CDR-observable feature space; (ii) unify edge anomaly detection and DDoS classification across twelve datasets and statistical, graph, and transformer models; (iii) synthesise SDN/NFV/O-RAN primitives into one closed-loop reference architecture; (iv) treat FL, LLMs, DT, post-quantum cryptography (PQC), zero-trust architecture (ZTA), and explainable AI as cross-cutting enablers, not parallel pillars; and (v) consolidate open problems into five directions spanning data, latency, trust, standardisation, and evaluation.

• The paper introduces an AI-native closed-loop security framework that fuses edge-based anomaly detection with network-wide mitigation and continuous learning.
• It details a four-stage security pipeline—sense, detect, mitigate, and learn—backed by empirical metrics such as tail-latency and detection accuracy.
• The study outlines open challenges including robust federated learning, digital twin integration, and explicit per-slice latency contracts crucial for URLLC safety.

AI-Native Closed-Loop Security for 6G-Enabled Cyber-Physical Systems

This essay critically synthesizes "AI-Native Closed-Loop Security for 6G-Enabled Cyber-Physical Systems: From Edge Detection to Network-Wide Mitigation" (2606.08173), focusing on the survey's formulation of CPS security as a tightly integrated, latency-bounded, AI-native closed loop. Emphasis is placed on the technical mechanisms that undergird distributed, real-time defense in 6G, empirical findings from cross-validated datasets, explicit per-slice latency contracts, architectural integration of enablers such as FL, DT, and XAI, and open technical and standardisation challenges.

---

Architectural Reframing: From Perimeter to AI-Native Closed Loops

The proposed paradigm departs fundamentally from legacy perimeter-based cellular defense. 6G architectures—characterized by disaggregated RAN, ultra-dense heterogeneous slicing, and extreme latency/availability requirements—render classical, centralized SOC models obsolete on four axes: control/telemetry volume, ultra-low detection/mitigation latency, lack of unified trust domains, and operationally rich multi-modal telemetry (CDR, RAN, NWDAF). The paper formalizes a closed-loop, four-stage security pipeline—sense, detect, mitigate, learn—anchored in the edge/MEC layer, with network-wide actuation via SDN/NFV/O-RAN and continuous learning via FL and DT replay, fully aligned with zero-trust and PQC requirements.

Figure 1: End-to-end AI-native security ecosystem for 6G CPSs, structured as a closed control loop encompassing edge sensing, detection, network-wide mitigation, and continuous learning.

This loop is not only operational but contractually falsifiable: all sense-through-mitigate stages are subject to a per-slice, tail-latency budget (e.g., $p_{99}$ for URLLC slices), collapsing the distinction between network- and physical-layer harm.

---

Threat Axes and Expanded Attack Surface

The 6G/CPS attack surface is expanded along two dimensions: protocol stack layer (physical to AI-model), and adversary proximity to operator trust boundaries. Physical and RAN attacks comprise jamming, RIS hijacking, and adversarial ISAC; protocol-level attacks include NAS/RRC storms, GTP-U flooding, and cross-slice interference; orchestration threats target O-RAN/xApp lifecycles and FL/SDN controllers; AI-model threats include adversarial evasion and gradient-data leakage. Trust boundaries are porous—notably due to co-tenant edge workloads, third-party xApp deployment, and absence of monolithic operator control—necessitating zero-trust enforcement.

Figure 3: Two-dimensional attack surface: protocol layers (left-right) and adversary trust-distance (vertical), spanning from remote jamming to insider supply chain compromise.

DDoS vectors of central concern include multi-vector signaling storms, GTP-U floods, polymorphic attacks, and slice-hop strategies, all exploiting the high control-plane amplification and minimal time-to-harm for CPS slices.

---

CDR-Driven Edge Detection: Models and Metrics

The survey's unification of literature around CDR-driven, edge-hosted detection is technically notable. CDRs, with per-cell and per-subscriber spatio-temporal features, are established as operationally privileged signals for anomaly detection and DDoS classification, due to their privacy posture, historical continuity across generations, and preexistence in operator billing flows. The paper systematically analyzes model families (statistical/ML, CNNs/ResNets, LSTM/ConvLSTM, autoencoders, GNNs, transformers, GAN/diffusion augmented) for their edge-deployability (latency, memory/power envelope, label efficiency, interpretability), with robust comparison across evaluation tiers (real operator CDRs, public benchmarks, synthetic attacks).

Empirically, weak points are found in scalability from benchmark to deployment: headline accuracy exceeds 97–99% on CICDDoS2019, Bot-IoT, and UNSW-NB15, but real CDR datasets benchmark closer to 91–98%, and edge/MEC live deployments show the increasing importance of FPR, $p_{99}$ latency, and energy-per-decision, not simply average accuracy.

---

Network-Wide Mitigation and End-to-End Loop Contract

A core contribution is the formalization of the detect–mitigate–learn hand-off. Mitigation primitives are composed using SDN rules, rapid O-RAN xApp interventions, and elastic NFV instantiation, with actuation latency and reversibility explicitly bounded per slice class—an essential property for URLLC slices, where over-blocking is worse than under-reacting for safety-of-life workloads.

Mitigation frameworks are contrasted for their latency and impact on slice availability, FBR, recovery time, and resource overhead. AI-native orchestrators use calibrated detector output (via four-tuple hand-off including class, evidence, TTL), mapping to mitigation primitives selected by minimization of policy cost functions factoring in per-slice weights for $\Delta t_\mathrm{mit}$, FBR, and reversibility.

Figure 5: End-to-end latency budget composition for a 5G slice, including PQC, ZTA, xApp, transport, and jitter, bounded by $\tau_\mathrm{max}$.

The loop is slice-admissible only if the cumulative $p_{99}$ per-stage latency is strictly within the end-to-end safety envelope.

---

Cross-Cutting Enablers: FL, DT, LLMs, and Substrate Security

Federated Learning (FL): FL is demonstrated as the only scalable, privacy-respecting approach for model evolution, leveraging per-MEC local training and secure cross-operator aggregation (FedAvg, FedProx, BREA, DP-SecAgg). Non-IID heterogeneity, Byzantine resilience, and secure aggregation are treated as conjoined requirements.

Digital Twins (DT): DTs enable test-time counterfactual reasoning, policy validation, and adversarial replay, providing synthetic ground-truth for evaluation of harm in scenarios where operator-grade annotated security telemetry remains scarce.

LLMs: The survey delineates a conservative role for LLMs—serving as explain-and-query rather than decide-and-act agents. LLMs (BERT, Llama-2 derivatives) are shown, via inference benchmarks and error analyses, to be currently unsuited for real-time, in-the-loop actuation; their strengths are in natural-language audit, runbook synthesis, explainability, and incident summarization, gated by hard refusal envelopes and retrieval grounding, and explicitly excluded from safety-critical actuation.

Substrates: PQC, ZTA, XAI: Integration with PQC (Kyber, Dilithium), zero-trust architectures, and explainable AI is essential for compliance and auditability, especially regarding URLLC latency constraints. Cross-substrate latency is jointly budgeted, and compositional security is treated at the protocol and implementation level.

---

Five Open Research and Standardization Challenges

The paper distills the open problem space into five compositional challenges:

1. C1: Sub-millisecond, adversarially robust, edge-deployable detection.
2. C2: Verified XAI/LLM auditability—per-decision explanations stable to bounded perturbations.
3. C3: Cross-operator FL with DP and Byzantine guarantees, and conformance to jurisdictional privacy/gov standards.
4. C4: Complete API/lifecycle/conformance standardization for AI-native security (3GPP, O-RAN, ETSI).
5. C5: Release/evaluation of harm-labelled, slice-aware, 6G-native CDR+RAN datasets—closing the fundamental benchmarking gap.

Explicit falsifiable targets and cross-standardization roadmaps (EU AI Act timelines, 3GPP Rel-21, O-RAN Alliance) are prescribed for each challenge.

---

Implications and Future Directions

Practical impact: The AI-native, closed-loop framing compels a shift in both industrial R&D and standards bodies from siloed anomaly detection to latency- and explainability-contracted, fully integrated security pipelines. Immediate imperatives include development of energy-efficient, robust, on-edge models, orchestration APIs with rollback semantics, audit-duty XAI, and differentially-private, operator-consortium dataset releases.

Theoretical impact: The formalization of per-slice, tail-latency contracts and explicit coupling of detection, mitigation, and learning stages provides a concrete foundation for benchmarking and certifying the safety of autonomous CPS network control. The survey's taxonomy and performance synthesis shape the agenda for adversarial ML, privacy-preserving FL, and digital-twin-enabled validation under operational metrics.

Future directions center on (i) consortial governance structures for cross-operator intelligence sharing, (ii) closed-loop standardization in 3GPP/O-RAN interfaces, (iii) quantifiable auditability (especially in the context of regulatory AI-Act demands), and (iv) design and operation of dynamic metacontrol agents capable of bounded, explainable interventions in safety-of-life slices.

---

Conclusion

The AI-native closed-loop security framework articulated here fundamentally redefines the operational, architectural, and evaluative basis for defending 6G-enabled CPSs. By establishing explicit, measurable design contracts and integrating edge-based detection with network-wide, slice-aware mitigation, the survey bridges gaps left by prior work and grounds future research and deployment in quantifiable, auditable security metrics. Much work remains—in robust cross-operator FL protocols, in standardization of xApp lifecycle security, in release of open, harm-labelled 6G datasets, and in regulatory/operational auditability—but the path is made concrete by the compositional, contract-based approach and the presented roadmap.