Document Type
Article
Source of Publication
IEEE Access
Publication Date
9-30-2025
Abstract
Expected to be deployed in the early 2030s, sixth-generation (6G) wireless networks, with their high speed and integration with cutting-edge technology such as intelligent edge computing, expand the attack surface and face serious cyber threat risks such as Advanced Persistent Threats (APTs). This type of cyber attack can imitate benign network traffic and operate for long periods of time without being detected by traditional detection systems. This paper introduces LENS, a lightweight and explainable LLM-based network security framework designed to address this cybersecurity threat for 6G environments. LENS uses a fine-tuned DistilBERT model to convert raw network streams into natural language commands using contextual metadata and is trained on the CICAPT-IIoT (2024) dataset generated using real-time network traffic data. To evaluate the proposed model, adapted versions of DeepLog and EarlyCrow are compared using F1-score, false positive rate, and explainability metrics for binary APT classification on the CICAPT-IIoT dataset. All models are trained using a high-performance GPU (Nvidia A10) and validated by deploying on a real-world resource-constrained edge node (Raspberry Pi 4). The results confirm that LENS has higher performance in APT detection with 0.82 accuracy and 0.82 recall despite consuming higher energy compared to the other two baselines, and is applicable for edge-enabled 6G environments.
DOI Link
ISSN
Publisher
Institute of Electrical and Electronics Engineers (IEEE)
Volume
13
First Page
172402
Last Page
172415
Disciplines
Computer Sciences
Keywords
6G networks, advanced persistent threats (APTs), edge computing, explainable artificial intelligence (XAI), large language models (LLMs)
Scopus ID
Creative Commons License
This work is licensed under a Creative Commons Attribution 4.0 International License.
Recommended Citation
Bani Melhem, Suhib; Golec, Muhammed; Alwarafy, Abdulmalik; and Khamayseh, Yaser, "LENS: Lightweight and Explainable LLM-Based APT Detection at the Edge for 6G Security" (2025). All Works. 7577.
https://zuscholars.zu.ac.ae/works/7577
Indexed in Scopus
yes
Open Access
yes
Open Access Type
Gold: This publication is openly available in an open access journal/series