An LLM-based Self-Evolving Security Framework for 6G Space-Air-Ground Integrated Networks

2025-05-06

AI Summary

To address security defense latency in dynamic, heterogeneous 6G space-air-ground integrated networks (SAGINs)—caused by unstructured threat intelligence and unknown attack types—this paper proposes the first large language model (LLM)-driven self-evolving security framework. Methodologically, it introduces a dual-module architecture: (i) LLM-6GNG, integrating chain-of-thought (CoT) reasoning with multi-agent collaboration for fine-grained threat inference; and (ii) 6G-INST, enabling online continual learning and dynamic policy adaptation. A closed-loop validation platform is built by integrating software-defined radio (SDR), ns-3, and OpenAirInterface (OAI). Evaluated on three benchmark datasets, the framework achieves a 23.6% improvement in policy accuracy and demonstrates superior robustness over baseline methods, successfully mitigating diverse zero-day attacks. A functional prototype system has been implemented, and the source code will be open-sourced.

Technology Category

• Machine Learning: Large Multimodal Models (LMMs)
• Natural Language Processing: Language Grounding & Multi-modal NLP
• Multiagent Systems: Adversarial Agents

Application Category

• Search and Retrieval-Augmented AI: Search Tool Learning with LLM: Teaching LLMs to invoke search and make use of retrieved information
• Semantics and Knowledge: Methods to enhance, augment, integrate or synergize semantic models such as knowledge graphs and LLMs
• Systems and Infrastructure for Web, Mobile and WoT: Applied ML and AI for Web-based mobile applications

Abstract

Recently emerged 6G space-air-ground integrated networks (SAGINs), which integrate satellites, aerial networks, and terrestrial communications, offer ubiquitous coverage for various mobile applications. However, the highly dynamic, open, and heterogeneous nature of SAGINs poses severe security issues. Forming a defense line of SAGINs suffers from two preliminary challenges: 1) accurately understanding massive unstructured multi-dimensional threat information to generate defense strategies against various malicious attacks, 2) rapidly adapting to potential unknown threats to yield more effective security strategies. To tackle the above two challenges, we propose a novel security framework for SAGINs based on Large Language Models (LLMs), which consists of two key ingredients LLM-6GNG and 6G-INST. Our proposed LLM-6GNG leverages refined chain-of-thought (CoT) reasoning and dynamic multi-agent mechanisms to analyze massive unstructured multi-dimensional threat data and generate comprehensive security strategies, thus addressing the first challenge. Our proposed 6G-INST relies on a novel self-evolving method to automatically update LLM-6GNG, enabling it to accommodate unknown threats under dynamic communication environments, thereby addressing the second challenge. Additionally, we prototype the proposed framework with ns-3, OpenAirInterface (OAI), and software-defined radio (SDR). Experiments on three benchmarks demonstrate the effectiveness of our framework. The results show that our framework produces highly accurate security strategies that remain robust against a variety of unknown attacks. We will release our code to contribute to the community.

Problem

• Addressing security challenges in dynamic 6G SAGINs
• Generating adaptive defense strategies against unknown threats
• Analyzing multi-dimensional threat data for comprehensive security

Innovation

• LLM-based framework for 6G SAGIN security
• Refined CoT reasoning for threat analysis
• Self-evolving method for unknown threats