基于可解释人工智能与大语言模型的AI-RAN中可解释的异常型DDoS检测
Interpretable Anomaly-Based DDoS Detection in AI-RAN with XAI and LLMs
AI总结：
本研究面向AI-RAN场景，提出结合LSTM异常检测、LIME/SHAP可解释方法与LLM自然语言转化的DDoS检测框架，在真实5G数据上F1值超0.96，实现高精度且可解释的攻击检测。
摘要：
下一代无线接入网（RAN）通过智能控制器引入可编程性、智能化与近实时控制能力，为RAN内部及更广泛的5G/6G基础设施提升安全水平提供了可能。本文开展了一项全面综述，梳理了大语言模型（LLM）辅助的可解释人工智能（XAI）入侵检测系统（IDS）在未来安全RAN环境中的应用机遇、挑战与研究空白。受此启发，我们提出了一种基于LLM可解释的异常型检测系统，用于检测分布式拒绝服务（DDoS）攻击，该系统利用从E2节点提取、部署于近实时RAN智能控制器（Near-RT RIC）内的多变量时间序列关键性能指标（KPM）实现检测。我们训练了一个基于LSTM的模型，依据这些KPM识别恶意用户设备（UE）的行为。为提升透明度，我们采用LIME、SHAP等事后局部可解释性方法对单条预测结果进行解释。此外，我们利用LLM将技术解释转化为非专业用户可理解的自然语言洞察。在真实5G网络KPM数据集上的实验结果表明，本框架实现了高检测准确率（F1值>0.96），同时可输出具备可操作性且可解释的结果。
英文摘要：
Next generation Radio Access Networks (RANs) introduce programmability, intelligence, and near real-time control through intelligent controllers, enabling enhanced security within the RAN and across broader 5G/6G infrastructures. This paper presents a comprehensive survey highlighting opportunities, challenges, and research gaps for Large Language Models (LLMs)-assisted explainable (XAI) intrusion detection (IDS) for secure future RAN environments. Motivated by this, we propose an LLM interpretable anomaly-based detection system for distributed denial-of-service (DDoS) attacks using multivariate time series key performance measures (KPMs), extracted from E2 nodes, within the Near Real-Time RAN Intelligent Controller (Near-RT RIC). An LSTM-based model is trained to identify malicious User Equipment (UE) behavior based on these KPMs. To enhance transparency, we apply post-hoc local explainability methods such as LIME and SHAP to interpret individual predictions. Furthermore, LLMs are employed to convert technical explanations into natural-language insights accessible to non-expert users. Experimental results on real 5G network KPMs demonstrate that our framework achieves high detection accuracy (F1-score > 0.96) while delivering actionable and interpretable outputs.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
