AI-Native Closed-Loop Security for 6G-Enabled Cyber-Physical Systems: From Edge Detection to Network-Wide Mitigation

2026-06-06

AI Summary

This study addresses the critical risk of millisecond-scale remote attacks causing physical harm in 6G networked cyber-physical systems, where conventional security mechanisms fall short of meeting real-time protection demands under ultra-reliable low-latency communication (URLLC) constraints. To bridge this gap, the authors propose a native AI-integrated closed-loop security paradigm that fuses call detail records and RAN telemetry data at the multi-access edge computing layer, enabling lightweight deep models for local real-time decision-making. The framework orchestrates network-wide mitigation through SDN/NFV/O-RAN coordination and uniquely unifies edge-based detection, network response, and continual learning under slice-level p99 tail latency guarantees. It systematically integrates cross-domain technologies—including federated learning, digital twins, zero trust, post-quantum cryptography, and explainable AI—into a cohesive architecture. Validated across 12 datasets and grounded in a unified reference model derived from 128 studies, the work formally defines latency-assured security contracts and identifies five key open challenges: data, latency, trust, standardization, and evaluation.

Abstract

In sixth-generation (6G) networks, billions of cyber-physical systems (CPSs) - autonomous vehicles, smart grids, industrial robots, and remote-surgical equipment - will run over ultra-reliable low-latency slices, collapsing the gap between a remote breach and physical harm to milliseconds, a budget perimeter firewalls and centralised security operations centres cannot meet. This survey reframes 6G CPS security as a closed-loop, AI-native pipeline that senses at the multi-access edge computing (MEC) tier, using minute-scale call-detail records (CDRs) for baseline learning and sub-millisecond RAN/Open-RAN (O-RAN) telemetry for the latency-critical path. It decides locally with compressed deep models, mitigates network-wide via SDN, NFV, and O-RAN controllers, and retrains through federated learning (FL) and digital-twin (DT) replay. We formalise a per-slice, tail-bounded latency contract on the sense, detect, and mitigate stages, enforced at a slice-dependent tail percentile (p99 for safety-critical URLLC slices). Organising 128 peer-reviewed studies (2017-2026) under a PRISMA 2020 protocol, we (i) map the 6G/CPS threat surface to MITRE ATT&CK and a CDR-observable feature space; (ii) unify edge anomaly detection and DDoS classification across twelve datasets and statistical, graph, and transformer models; (iii) synthesise SDN/NFV/O-RAN primitives into one closed-loop reference architecture; (iv) treat FL, large language models (LLMs), DT, post-quantum cryptography (PQC), zero-trust architecture (ZTA), and explainable AI as cross-cutting enablers, not parallel pillars; and (v) consolidate open problems into five directions spanning data, latency, trust, standardisation, and evaluation.

Problem

• 6G
• Cyber-Physical Systems
• AI-Native Security
• Ultra-Reliable Low-Latency Communication
• Closed-Loop Security

Innovation

• AI-native security
• closed-loop mitigation
• edge intelligence
• tail-bounded latency
• federated learning