AI Framework Boosts 6G Traffic Forecasts and Threat Detection in Benchmark Tests

FALCON-6G combines federated learning and language models to improve network traffic prediction and intrusion detection. Benchmark tests showed better accuracy, faster decisions and lower communication overhead than FedAvg.

A busy mobile network needs to anticipate demand, recognise suspicious activity and decide where limited resources will make the biggest difference. Research published as an article in press in Scientific Reports, titled "Enhancing network science with large language models and federated artificial intelligence," explores how those decisions could become more effective in future 6G systems.

Lalit Kumar and colleagues developed FALCON-6G, a framework that combines learning across distributed devices with the reasoning capabilities of a large language model, reporting better traffic forecasts and intrusion detection across six benchmark datasets.

How shared learning feeds network decisions

FALCON-6G stands for Federated AI and LLM-Oriented Cognitive Optimization in 6G Networks; the design links devices, nearby edge servers and a cloud orchestration layer, with each level handling a different part of the work. Devices learn from their own network observations and retain the raw data locally, sending model updates to edge servers that combine their contributions.

The language model receives the combined learning information alongside details about traffic, mobility, service requirements, available resources and detected anomalies, and uses that context to generate structured policies for network control.

That division gives the predictive model and the language model distinct jobs: one learns patterns from distributed observations, and the other interprets those patterns in their current operating context. Decisions return through the edge layer, and the resulting network conditions inform later learning rounds.

Lightweight adapters provide local personalisation without retraining the language model's entire backbone. An adaptive aggregation mechanism weights contributions using data volume and the alignment between local and global updates, helping address uneven data across devices. Its optimisation balances learning performance against communication costs and decision delays.

Six datasets test traffic forecasting and security

The experiments ran on a high-performance computing cluster with CPU and GPU resources, using 50 simulated clients over 200 global communication rounds. Each client completed five local training passes before sharing updates, with communication bandwidth limited to 1 megabit per second per client.

The cognitive layer used Llama 3.1 8B Instruct, an eight-billion-parameter language model with its backbone frozen and 128-dimensional trainable adapters. Two Open RAN datasets covered network traffic and performance indicators, including the TRACTOR dataset; four security datasets, NSL-KDD, CICIDS2017, Edge-IIoTset and N-BaIoT, covered conventional intrusions, industrial connected devices and botnet activity.

Four alternatives provided the comparison: Federated Averaging, known as FedAvg; FedProx, which addresses differences between clients' data; centralised language-model orchestration; and Hybrid Edge Orchestration, or HEO. The researchers evaluated prediction accuracy, intrusion-detection F1-scores, decision latency and the communication required to exchange learning updates. These measures capture several demands that an operational network would need to balance, including prediction quality and manageable computing and communication requirements.

Better forecasts and detection with fewer update exchanges

Traffic prediction accuracy reached 83% on the Open RAN Traffic dataset and 79% on TRACTOR, compared with FedAvg's 68% and 64%. Across the two datasets, average accuracy rose from 66% to 81%, producing the reported 22.7% relative improvement in throughput prediction accuracy. This figure describes how accurately the system predicted network throughput. Average decision latency fell from 145 milliseconds to 119.5 milliseconds, a 17.6% reduction against FedAvg. HEO remained slightly quicker at 118.5 milliseconds on average, giving FALCON-6G an accuracy advantage accompanied by a small response-time trade-off.

Intrusion detection improved across all four security datasets, with FALCON-6G recording the highest F1-score among the tested methods in each case. F1 combines precision and recall, reflecting the balance between reliable alerts and detecting actual attacks. Scores reached 0.893 on NSL-KDD, 0.951 on CICIDS2017, 0.864 on Edge-IIoTset and 0.879 on N-BaIoT. Relative improvements over FedAvg were 10.0%, 23.9%, 16.6% and 16.4%, respectively, making CICIDS2017 the strongest result. The mean F1-score across these datasets rose from about 0.769 to 0.897.

Communication requirements for learning updates fell by approximately 33.2% to 34.0% across the six datasets, suggesting that the efficiency benefit extended across different workloads. Tests that removed individual components showed why the complete design mattered. Removing the language model layer reduced traffic accuracy from 83% to 78.9% and increased latency from 117 to 131 milliseconds in the relevant traffic evaluation.

The largest predictive decline came from removing the joint optimisation of accuracy, communication and latency, which lowered traffic accuracy to 77.4% and the CICIDS2017 F1-score to 0.887. Without communication optimisation, the reduction in update overhead shrank from 34% to 11.5%; removing personalisation, adaptive aggregation or robustness weighting also weakened results.

What needs proving before deployment

The evidence comes from benchmark experiments, and the framework still needs testing in live, large-scale 6G or Open RAN environments. Performance with substantially more than 50 clients was not examined, leaving questions about growth in communication traffic and coordination demands.

Real networks bring differences in hardware, intermittent connections, moving devices and delayed updates that can complicate learning. Cloud-based language model reasoning adds computing costs, and its decisions depend on accurate, timely network context, making outdated information another practical concern.

Keeping raw observations on devices supports data locality, but exchanged model updates can still reveal information through inference or reconstruction attacks. Proposed safeguards, including secure gradient perturbation, secure aggregation and elliptic-curve encryption, were described in the architecture but were not implemented or evaluated in the experimental code.

The study lacked controlled tests of poisoning, backdoors and other adversarial behaviour, as well as a formal privacy budget and dedicated defence measurements. Its detection results support better recognition of benchmark attack traffic; protection of the learning system itself requires separate validation.

A Friedman ranking test supported differences among the methods across the four security datasets, with FALCON-6G ranked first on each. The analysis used dataset-level results without repeated independent runs using different random seeds, and the paper reported no confidence intervals or measures of variation across such runs.