KG-LLM: A Framework for Intrusion Detection in 6G Industrial Internet of Things

With the deep integration of Sixth-generation (6G) networks and the Industrial Internet of Things (IIoT), security threats are becoming increasingly sophisticated. Recently, Large language models (LLMs) have demonstrated unique potential in handling massive heterogeneous data and unknown attack patterns within 6G-enabled IIoT environments. However, challenges remain in terms of addressing fragmented information and complicated and high-dimensional spatio-temporal correlation in industrial contexts. To this end, this article proposes an intrusion detection framework that integrates Knowledge Graphs (KGs) with LLMs. We first systematically review the key technologies of 6G IIoT and LLMs, and analyze in depth the application of LLMs to intrusion detection in 6G IIoT as well as the associated challenges. The framework encodes domain knowledge into structured KGs and fuses them with LLMs, thereby enhancing the model’s capability to understand and reason about attack behaviors in complex industrial scenarios. Extensive experiments demonstrate that the proposed KG-LLM achieves superior performance in intrusion detection, outperforming traditional machine learning models such as XGBoost, Random Forest, and Logistic Regression in accuracy, precision, recall, and F1-score. The model particularly excels in detecting attacks, showing robust performance even under noisy conditions. Finally, we discuss promising future research directions.