Cyber defense framework for 5G/6G using a Network Digital Twin

With the rapid evolution of 5G and emerging 6G networks, ensuring security against DDoS threats remains a pressing challenge, particularly due to expanded attack surfaces across the edge–cloud continuum and heterogeneous edge devices. Traditional security mechanisms struggle to provide proactive, scalable, and low-risk detection and classification solutions in such highly dynamic environments. This paper proposes a Network Digital Twin (NDT)–driven framework for DDoS detection, analysis, and classification in 5G/6G networks, leveraging a synchronized digital twin for safe attack emulation and AI/ML-based anomaly detection. We implement and validate the framework on a real 5G testbed combined with an operational NDT platform, demonstrating that the NDT accurately reproduces network behavior under both normal and attack conditions and validating its efficacy for DT-driven, adaptive security in next-generation mobile systems.