Trusted Ran-Edge Digital Twin Framework for Next-Generation IoT Security

As we move toward 6G networks, millions of IoT devices will demand both high performance and resilience against sophisticated attacks. The problem is that traditional security monitoring can't keep up with the scale and speed of edgebased IoT traffic. I present a lightweight digital twin framework deployed at the RAN edge that mirrors real-time IoT behavior using only RF key performance indicators. My approach differs from existing digital twin architectures in three ways: (1) it uses only KPI telemetry rather than full network state, keeping computational overhead minimal; (2) it incorporates security-aware synchronization with integrity checks designed for adversarial environments; and (3) it operates under strict edge resource constraints without requiring cloud connectivity. I track metrics like latency, block error rate (BLER), and handover patterns to detect threats before they spread through the RF infrastructure. Testing on 100 simulated IoT devices and a small set of real LTE logs shows detection latency of 2-5 seconds for spoofing and KPI manipulation attacks, with 3-7% false positive rates and roughly 15-20% CPU overhead on edge hardware. This demonstrates that KPI-only twins can form a practical security layer for resourceconstrained edge deployments, providing rapid threat detection without overwhelming computational resources.