# A Distributed Trustable Framework for AI-Aided Anomaly Detection +
## 5 Conclusions and Future Directions  
In this paper, we presented a distributed AI/ML framework for attack detection in 6G networks. Here, AI/ML model training, deployment and inference are handled by a distributed trustable engine (DTE), being a core component of the SNS HORSE project. The DTE architecture adopts 3 GPP NWDAF specifications related to data collection from diverse sources within the wireless network infrastructure. In this context, we discussed the building blocks of the DTE, supporting ML model training and deployment, as well as the DTE's adherence to intent-based networking principles. Furthermore, to safeguard our  
Figure 7: Attack type classification accuracy for various ML models (DDoS edge attack case).  
cybersecurity solution against the inherent drawbacks of centralized ML, we presented a federated learning (FL)-based architecture extension to accommodate the needs of advanced scenarios and stimulate synergies among stakeholders in the communication networks domain. Finally, we evaluated the DTE's performance by focusing on two attack scenarios affecting the core and the edge part of the network. For these two cases, we provided the dimensionality reduction process and ML model training and compared different algorithms in terms of attack classification accuracy.  
Ongoing research focuses on extending and evaluating the DTE towards FL-based deployments and the investigation of different attack types from datasets generated within the HORSE project. It should be noted that experimental evaluation in this work focused on single network deployments where only one DTE instance is present, while multi-operator or single-operator multi-cell settings will be explored in a future paper. In addition, possible attack scenarios that will be studied include the detection of physical-layer attacks related to data leakage or untrusted nodes and the operation of edge AI/ML in settings with resource-constraint devices and intermittent connectivity, such as maritime communication networks [38]. In such complex settings, the deployment of specialized deep learning models for anomaly detection [39], graph neural networks to improve node representations by exploiting the aggregating node neighborhood information [40], and diffusion-based imputation methods, mitigating model bias problems under cases of anomaly concentration [41] can be adopted.  
Conceptualization, N.N., G.X., P.G. and P.T.; methodology, N.N., G.X., G.P. and A.G.; validation, N.N., G.P., V.N. and C.M.; formal analysis, N.N., G.X. and A.G.; investigation, N.N. and P.G.; resources, P.T.; data curation, G.P., V.N. and C.M.; writing--original draft preparation, N.N., G.X. and G.P.; writing--review and editing, P.G., A.G., C.S. and P.T.; visualization, G.P., V.N. and C.M.; supervision, C.S. and P.T. All authors have read and agreed to the published version of the manuscript.  
This research was partially supported by the HORSE project, funded by the Smart Networks and Services Joint Undertaking (SNS JU) under the European Union's Horizon Europe research and innovation programme under Grant Agreement No. 101096342 (www.horse-6g.eu, accessed on 1 December 2024).  
The raw data supporting the conclusions of this article will be made available by the authors on request.  
Author [PERSON] was employed by the company Four Dot Infinity. The author declares that the research was conducted in the absence of any commercial or financial relationships that could be construed as a potential conflict of interest.