SAGSU-6G:A Real-Time Dynamic CNN+BiLSTM Framework for Physical-Layer Intrusion Detection in Multi-Domain 6G Networks

Creative Commons License

Polat O., Söğüt E., Nebi Z. Ş.

Turkish Journal of Nature and Science, cilt.15, sa.3, ss.243-253, 2026 (TRDizin)

Özet

The sixth-generation (6G) wireless networks introduce a fundamentally new communication paradigm by integrating heterogeneous Space–Air–Ground–User–Sea Surface–Underwater (SAGSU-U) domains into a unified architecture. Although this integration significantly enhances network connectivity and coverage, it also expands the cyberattack surface, creating new security challenges for physical-layer intrusion detection. This paper presents SAGSUU-6G, a unified physical-layer intrusion detection framework based on a hybrid convolutional neural network and bidirectional long short-term memory (CNN+BiLSTM) architecture for real-time classification of eleven cyberattack categories plus benign traffic across six network domains. A custom Python-based dynamic physical-layer simulation environment incorporating realistic propagation models and Dwell Time mechanics was developed to generate continuous sequential data using eight physical-layer and communication-quality metrics: RSSI, SINR, Doppler, CSI, BER, jitter, PDR, and throughput. The trained model was evaluated on a continuous, chronologically ordered live streaming session of 4,371 observations, temporally isolated from the training data by a strict purge gap. Experimental results demonstrate distinct attack-dependent degradation patterns across heterogeneous communication domains and confirm that the dataset follows a realistic, heterogeneous, and highly imbalanced class distribution strictly dominated by benign traffic. The proposed model achieved an 89.64% real-time streaming classification accuracy with an average inference latency of 53.47 ms, performing competitively against unidirectional LSTM and convolutional baselines.