# A Distributed Trustable Framework for AI-Aided Anomaly Detection +
## 2 ML-Aided Anomaly Detection Review
### AI/ML-Aided Anomaly Detection  
Recently, various works have dealt with 6G security and privacy issues, proposing AI/ML-aided solutions for threat detection. ML and AI-aided security can be employed to improve time-series and statistics-based methods and train the system by generating attacks under the generative adversarial network (GAN) paradigm. GANs can facilitate threat detection and mitigation, as new datasets can be generated from already available training data for simulating additional potential attacks that may occur. Here, the authors in [19] used GANs to simulate intrusions and malware to improve detection accuracy and robustness against different attack types. Then, in [20], various deep learning (DL) architectures were used for the detection of threats and the experimental analysis showed that DL improved cybersecurity accuracy, scalability, reliability, and performance when applied in real-time. There are also works that use DL neural network models to detect traffic anomalies and raise alarms proactively to ensure seamless service availability [21]. More specifically, the authors developed automated scalability functionalities in a resource overload prediction scenario, triggering notifications on upcoming resource scaling needs that can be satisfied through service scaling and proper load balancing. Other works investigated FL-based solutions. In [6], an analysis of the 6G threat landscape was provided, considering a space-air-ground ocean integrated network. For this setting, two FL-based model training schemes were presented, i.e., single region FL, where all network nodes correspond to a particular area, and cross-layer FL, where FL is applied across different service areas. Specific security attacks were considered and efficiently mitigated using Q-learning at the local learning level, deciding when trusted nodes should participate in the FL training process, aiming at the maximization of training rewards. Next, the paper in [22] proposed FL-based anomaly detection, where each FL node follows a double hierarchy for anomaly detection. In the first stage, the ML model is trained with a relatively smaller number of threats. Then, the second detector employs a more complex model, which identifies anomalies that were not detected by the first detector. The study in [23] developed a multi-level FL scheme among IoT devices and edge applications. Three phases were considered, i.e., clustering, training, and detection, and a set of trusted IoT nodes was chosen to be associated with the nearest edge server, sharing the training models and attack detection events. For each set, a cluster head and cluster members are defined, and the edge devices update the corresponding models that are transmitted to the corresponding cluster heads. During detection, the cluster heads and the edge server evaluate and classify the behaviors of the monitored devices as normal or malicious using the globally trained model. Additionally, several works have studied the role of NWDAF in supporting anomaly detection and mitigation. As depicted in Figure 1, the NWDAF is a new feature of 5G networks, enabling network operators to implement their own ML-aided data analytics methodologies or integrate third-party solutions. In addition, it incorporates standard interfaces for data collection from other core functions. The work in [24] presents the state-of-the-art on the role of the NWDAF for data collection, resource optimization and security enhancement in wireless networks. At the same time, key 6G technologies for data collection and threat mitigation are discussed and categorized, and a high-level FL-based architectural approach for multi-NWDAF large-scale heterogeneous environments is given in detail. On a similar note, the study in [25] discussed various challenges related to anomaly detection with NWDAF, pointing out that the communication among NWDAFs is not standardized.