Federated slice-aware DDoS defense tested with synthetic and engineered 6G features

A federated, slice-aware defense system detected and mitigated distributed denial-of-service traffic in simulations of 6G cloud networks, according to a study that combined a benchmark attack dataset with synthetic features representing terahertz links, sensing, latency and network slicing. Across three dataset configurations, the deep detector achieved accuracies from 0.9647 to 0.9974, while the mitigation system blocked or otherwise suppressed as much as 99.79% of attack flows and admitted as many as 99.90% of benign flows. The results are promising, but the 6G component was generated rather than collected from a live network, and most mitigation decisions relied on rerouting rather than the strongest possible suppression.

The proposed framework, called DT-FedMARL, was designed for cloud-edge, industrial-edge and Internet-of-Things edge domains that train collaboratively without sending their raw traffic to a central server. A neural detector first classifies each network flow as benign or malicious and supplies a confidence value together with a 32-dimensional representation of its features. Flows are then organized according to three service types: enhanced mobile broadband, or eMBB; ultra-reliable low-latency communications, or URLLC; and massive machine-type communications, or mMTC. Each slice has a mitigation policy capable of allowing, throttling, rerouting or blocking traffic, allowing the response to reflect the different service priorities of the network.

Federated training is central to the system. Each of the three simulated edge domains trains local versions of the slice policies, after which their parameters are perturbed with Gaussian noise and combined through support-weighted averaging. The aggregated policies are then returned to the participating domains. No raw traffic leaves its origin in this design, and the federated policies matched centralized training on pooled data to within 0.0002 in final accuracy. Across five random seeds, average policy accuracies were 0.6397 for eMBB, 0.8132 for URLLC and 0.7534 for mMTC. The corresponding centralized results were 0.6399, 0.8133 and 0.7534. The added noise did not provide a formal differential-privacy guarantee, and training became unstable at larger perturbation levels, making the default setting of 0.01 an important limitation.

The authors evaluated the framework on three configurations: a fully synthetic 6G dataset generated with a conditional tabular GAN, the real CICDDoS2019 benchmark, and a merged dataset combining CICDDoS2019 traffic with six engineered 6G features. The synthetic features were terahertz signal-to-noise ratio, remaining service-level-agreement budget, an integrated sensing-and-communication anomaly score, semantic payload ratio, end-to-end latency and local device density. The merged configuration contained 273,925 flows, while the synthetic configuration contained 100,000. Detection used flow statistics without access to slice identifiers, mitigation labels or SLA-violation flags, reducing the risk that downstream information could leak into the detector. After an audit found that a derived severity feature had been included inadvertently, the authors excluded it and recalculated the affected results.

Detection was strongest on the two larger configurations. The deep model achieved an accuracy of 0.9974 on CICDDoS2019 and 0.9971 on the merged 6G-cloud dataset, compared with 0.9647 on Synthetic-6G. Its corresponding F1 scores were 0.9985 and 0.9978 in the two larger configurations, and its ROC-AUC values were 0.9998 and 0.9997. Random forest performed slightly better in every case, but the researchers selected the neural model because it directly provides a calibrated attack probability and a learned embedding for the mitigation stage. A cross-day test on CICDDoS2019, including five attack families absent from training, produced an F1 score of 0.9939 and a ROC-AUC of 0.9989, supporting the claim that the model was not simply memorizing the primary benchmark split.

Calibration was strong overall but uneven at low confidence. Expected calibration error was 0.0042 for Synthetic-6G, 0.0005 for CICDDoS2019 and 0.0001 for the merged configuration, while all Brier scores were below 0.031. However, Synthetic-6G flows assigned confidence below 0.9 were only 79.8% accurate, whereas flows above that threshold were 98.5% accurate. The framework addresses this uncertainty with a gate set at a confidence threshold of 0.15. Low-confidence flows are released as benign before a slice policy is consulted; flows above the threshold proceed to the policy, which receives confidence, severity, remaining SLA budget and slice identity as inputs. The gate makes decisions auditable rather than improving the numerical outcome by itself: removing it left the reported metrics unchanged because the policy usually allowed the same low-confidence flows.

That stage-level accounting revealed where failures came from. On CICDDoS2019, all 15 missed attacks in the reference run were released by the gate rather than incorrectly suppressed by the policy. In the merged configuration, 22 of 24 missed attacks came from the gate. Synthetic-6G presented a different pattern, with most misses arising in the policy and overwhelmingly within the machine-type mMTC slice. Its benign flows had a mean confidence of 0.1958, meaning that 36.2% passed the gate and reached the policy, compared with 9.6% for eMBB and 3.0% for URLLC. The resulting mMTC false-blocking rate was 0.1200, fourteen times the URLLC rate of 0.0086. In other words, the most difficult slice was not necessarily governed by a poorly learned response, but by the greater volume of uncertain benign traffic that its detector allowed through.

Service continuity was measured in a digital twin that replayed identical traffic under no mitigation, the learned policy and an oracle that blocked all attacks. Mean sustained SLA preservation increased from 0.3571 to 0.8070 on the merged dataset, from 0.3150 to 0.7815 on Synthetic-6G, and from 0.1323 to 0.7384 on CICDDoS2019; the respective oracle ceilings were 0.9677, 0.9372 and 0.9544. The learned policies usually chose rerouting rather than blocking. Because rerouting was modeled as removing 70% of attack load, compared with 95% for blocking, the learned approach could recover at most 73.68% of the oracle’s improvement over no mitigation. This preference may preserve connectivity in latency- and density-sensitive services, but it also shows that the policies operate mainly through one of four available actions. Moreover, the SLA measure does not penalize excessive blocking, so the authors reported it alongside false-blocking rates rather than treating it as a complete measure of network welfare.

An ablation produced another important qualification: a single shared policy that was explicitly told which slice it was handling matched the three separate slice policies on accuracy. On Synthetic-6G, several aggregate metrics favored the per-slice design, while the shared policy had a marginally lower URLLC false-blocking rate, 0.0062 against 0.0086, but also showed greater variation in several results. The shared design required 4,805 parameters, 66.7% fewer than the 14,415 used by the per-slice design. Separate policies nevertheless converged faster—URLLC after one federation round and eMBB after two, compared with three rounds for the shared design—and could be updated independently, potentially reducing communication costs when deployment schedules differ. The study therefore supports separate slice policies more strongly for convergence and operational flexibility than for predictive performance. Deployment tests indicated a median end-to-end latency of 0.374 to 0.472 milliseconds per flow and 1.65 MB of federated communication over five rounds, but these figures came from the study’s computational environment rather than a deployed 6G network.

Overall, the study offers a technically detailed route to coordinated DDoS defense in sliced cloud networks, with explicit separation between detection errors and mitigation decisions. Its strongest elements are stage-level attribution, high performance on measured benchmark traffic, close agreement between federated and centralized training and a digital-twin comparison that accounts for attack density. Its largest limitation is equally clear: no public measured traces containing the required 6G features were available, so the synthetic and merged configurations test plausibility rather than real-world 6G fidelity. Adaptive attackers, traffic drift, proactive use of digital-twin state and richer action sets remain untested. The results support further experimentation with privacy-preserving, slice-specific mitigation, but they do not yet demonstrate protection of live 6G services or establish a formal privacy guarantee.

Subject of Research: Federated, slice-aware DDoS detection and mitigation for simulated 6G cloud network slices

Article Title: Attributable federated DDoS mitigation for 6G cloud network slices

Article References: Naithani, A., Rawat, S., & Kumar, P. (2026). Attributable federated DDoS mitigation for 6G cloud network slices. Frontiers in Computer Science, 8, Article 1994804. https://doi.org/10.3389/fcomp.2026.1994804

Image Credits: AI Generated

DOI: 10.3389/fcomp.2026.1994804

Keywords: 6G networks, DDoS mitigation, federated learning, network slicing, digital twins, cybersecurity, edge computing, machine learning, privacy-preserving AI, traffic analysis, Attributable, federated