LENS: Lightweight and Explainable LLM-Based APT Detection at the Edge for 6G Security
Sep 30, 2025
DOI: 10.1109/ACCESS.2025.3616235
Published in: IEEE Access
Publisher: IEEE
Expected to be deployed in the early 2030s, sixth-generation (6G) wireless networks, with their high speed and integration with cutting-edge technology such as intelligent edge computing, expand the attack surface and face serious cyber threat risks such as Advanced Persistent Threats (APTs). This type of cyber attack can imitate benign network traffic and operate for long periods of time without being detected by traditional detection systems. This paper introduces LENS, a lightweight and explainable LLM-based network security framework designed to address this cybersecurity threat for 6G environments. LENS uses a fine-tuned DistilBERT model to convert raw network streams into natural language commands using contextual metadata and is trained on the CICAPT-IIoT (2024) dataset generated using real-time network traffic data. To evaluate the proposed model, adapted versions of DeepLog and EarlyCrow are compared using F1-score, false positive rate, and explainability metrics for binary APT classification on the CICAPT-IIoT dataset. All models are trained using a high-performance GPU (Nvidia A10) and validated by deploying on a real-world resource-constrained edge node (Raspberry Pi 4). The results confirm that LENS has higher performance in APT detection with 0.82 accuracy and 0.82 recall despite consuming higher energy compared to the other two baselines, and is applicable for edge-enabled 6G environments.
Other Researches
With the widespread use of renewable energy sources (RES) in the smart grid, the next generation power system, short-term load forecasting (STLF) is of critical importance in grid stability and energy optimization. Traditional STLF models include is...
LLM-Driven APT Detection for 6G Wireless Networks: A Systematic Review and Taxonomy
Sixth Generation (6G) wireless networks, which are expected to be deployed in the 2030s, have already created great excitement in academia and the private sector with their extremely high communication speed and low latency rates. However, despite t...
Unmanned Aerial Vehicles (UAVs) have been extensively used recently for wireless networks. However, such networks encounter several challenges that remain unsolved. In this paper, we address the issue of joint optimization of trajectory design and r...
Supervised methods of machine learning for email classification: a literature survey
In today’s digital landscape, email is acknowledged as a critical conduit for global data exchanges. With a surge in data volume, malefactors exploit user identities, leading to data misuse. Cybercriminals employ electronic transgressions such as ph...
Cybersecurity activities for education and curriculum design: A survey
Cyber threats are one of the main concerns in this growing technology epoch. To tackle this issue, highly skilled and motivated cybersecurity professionals are increasingly in demand to prevent, detect, respond to, or even mitigate the effects of su...
Dynamic Resource Management for Cloud Spot Markets
Resource management for cloud computing environments that are characterized by many layers emerges as a critical task for cloud computing providers. Such providers are compelled by the demands and strategies of stochastic customers to adopt dynamic ...
Dynamic mobility load balancing for 5G small-cell networks based on utility functions
Deployment of small cells was introduced to support high data rate services and expand macro cell coverage for the envisioned 5G networks. A small cell network, which has a smaller size, along with the user equipment (UE) mobility, frequently underg...
Markov prediction model for host load detection and VM placement in live migration
The design of good host overload/underload detection and virtual machine (VM) placement algorithms plays a vital role in assuring the smoothness of VM live migration. The presence of the dynamic environment that leads to a changing load on the VMs m...
Soap-based vs. restful web services: A case study for multimedia conferencing
RESTful Web services are now emerging as an alternative to SOAP-based Web services and might be a more suitable choice in some cases. A comparison of two Web programming interfaces — the standard Parlay-X multimedia SOAP-based Web service and a REST...