Track papers across labs, topics, and trends.
Search papers, labs, and topics across Lattice.
The paper introduces DA-GC, a framework for real-time cross-slice attack attribution in 6G networks that combines resource-conditioned Granger causality with a Resource Contention Model (RCM) to filter out spurious correlations caused by shared resource contention. DA-GC achieves 89.2% attribution accuracy at 87 ms on a 15-slice 6G testbed, outperforming existing methods in both accuracy and latency. The framework also includes formal certification for statistical soundness, security, and privacy.
Pinpointing the root cause of 6G network attacks in under 100ms is now possible, even amidst the noise of shared resource contention, thanks to a new framework with formal guarantees.
Cross-slice attack attribution in 6G networks requires identifying causal propagation chains through shared infrastructure in under 100 ms. Existing methods struggle to satisfy this strict SLA without sacrificing accuracy, because shared resource contention creates spurious correlations that are indistinguishable from genuine causal links under standard Granger tests. We propose DA-GC, a certified causal attribution framework that integrates resource-conditioned Granger causality with an axiomatically derived Resource Contention Model (RCM) to systematically block resource-mediated confounding. On a 15-slice production-emulation 6G testbed with 1,100 attack scenarios, DA-GC achieves 89.2% attribution accuracy at 87 ms. This represents a 7.9 percentage-point improvement over the strongest baseline at 2.7x lower latency, alongside demonstrated cross-topology generalization and concept-drift resilience. Crucially, DA-GC is backed by a comprehensive formal certification stack. We provide mathematically proven validity certificates for statistical soundness under serially dependent telemetry and piecewise-stationarity. Furthermore, we establish strict security bounds, including an adversarial utilization spoofing breakdown point of $\delta^* \approx 0.95$, and define the minimum differential-privacy noise required for a provably private and robust deployment.