2025-11-11T12:22:08.597062

LLM-Driven APT Detection for 6G Wireless Networks: A Systematic Review and Taxonomy

Golec, Khamayseh, Melhem et al.

Sixth Generation (6G) wireless networks, which are expected to be deployed in the 2030s, have already created great excitement in academia and the private sector with their extremely high communication speed and low latency rates. However, despite the ultra-low latency, high throughput, and AI-assisted orchestration capabilities they promise, they are vulnerable to stealthy and long-term Advanced Persistent Threats (APTs). Large Language Models (LLMs) stand out as an ideal candidate to fill this gap with their high success in semantic reasoning and threat intelligence. In this paper, we present a comprehensive systematic review and taxonomy study for LLM-assisted APT detection in 6G networks. We address five research questions, namely, semantic merging of fragmented logs, encrypted traffic analysis, edge distribution constraints, dataset/modeling techniques, and reproducibility trends, by leveraging most recent studies on the intersection of LLMs, APTs, and 6G wireless networks. We identify open challenges such as explainability gaps, data scarcity, edge hardware limitations, and the need for real-time slicing-aware adaptation by presenting various taxonomies such as granularity, deployment models, and kill chain stages. We then conclude the paper by providing several research gaps in 6G infrastructures for future researchers. To the best of our knowledge, this paper is the first comprehensive systematic review and classification study on LLM-based APT detection in 6G networks.

academic

LLM-Driven APT Detection for 6G Wireless Networks: A Systematic Review and Taxonomy

基本信息

论文ID: 2505.18846
标题: LLM-Driven APT Detection for 6G Wireless Networks: A Systematic Review and Taxonomy
作者: Muhammed Golec, Yaser Khamayseh, Suhib Bani Melhem, Abdulmalik Alwarafy
分类: cs.CR (Cryptography and Security)
发表时间: 2025年6月23日 (arXiv预印本)
论文链接: https://arxiv.org/abs/2505.18846v2

摘要

本文针对预计在2030年代部署的第六代(6G)无线网络中的高级持续威胁(APT)检测问题，提出了基于大语言模型(LLM)的系统性解决方案。尽管6G网络承诺超低延迟、高吞吐量和AI辅助编排能力，但仍容易受到隐蔽的长期APT攻击。作者通过分析142篇相关论文，提出了LLM在APT检测中的综合分类法，并识别了可解释性差距、数据稀缺、边缘硬件限制等关键挑战。这是首个专门针对6G网络中基于LLM的APT检测的系统性综述研究。

研究背景与动机

问题定义

6G网络安全挑战：6G网络的异构架构(地面、空中、卫星层)创造了更大的攻击面，使其容易受到APT攻击
传统检测方法局限性：基于签名的入侵检测系统(IDS)在面对加密层和动态拓扑时，行为检测变得复杂
数据碎片化问题：6G网络产生的日志数据碎片化且不一致，限制了层间关联分析

研究重要性

时效性：6G技术即将商用，安全问题亟待解决
技术融合：LLM、APT检测和6G网络三个领域的交叉研究空白
实用价值：为未来6G网络安全部署提供理论指导

现有方法局限性

缺乏针对6G特定约束的LLM优化方法
APT检测数据集稀缺且缺乏真实世界代表性
边缘设备资源受限，难以部署完整LLM模型

核心贡献

首个系统性综述：提供了LLM驱动的6G网络APT检测的首个全面系统文献综述
五维研究框架：定义了五个核心研究问题，涵盖语义关联、加密流量分析、边缘约束、数据集建模和可复现性
多层次分类法：提出了包括输入模态、检测粒度、LLM技术、部署模型和威胁生命周期的综合分类体系
挑战识别与未来方向：系统性识别了开放挑战并提出了具体的未来研究方向
比较分析：与16个现有综述进行了详细比较，突出了本研究的独特价值

方法详解

系统性综述方法

本文采用Kitchenham的系统文献综述(SLR)方法和Petersen的系统映射研究(SMS)方法：

文献收集流程：
- 识别阶段：搜索IEEE、ACM、Elsevier、Springer等主要学术数据库
- 筛选阶段：去除重复文档，从300+篇减少到126篇
- 资格评估：专家分析，筛选出120篇高质量论文
- 最终纳入：通过雪球方法补充，最终确定142篇论文

搜索关键词策略：

[(LLM) OR (Large Language Model)] AND [(APT) OR (Advanced Persistent Threat)]
[(6G) OR (Wireless Networks)] AND [(LLM) OR (APT Detection)] AND [(Edge) OR (Cross-Layer Security)]
[(Cyber Threat Intelligence) OR (Provenance Logs)] AND [(LLM) OR (APT)] AND [(6G)]