D4.3 Intelligent networking, CTI & explainability.r1

This deliverable, D4.3 – Intelligent Networking, CTI & Explainability.r1, presents the first results of Work Package 4 (WP4) of the NATWORK project, regarding the development of AI-powered security services for 6G networks. It focuses on integrating AI-based automation, cyber threat intelligence (CTI), and explainability into the orchestration and security management of distributed services. The document outlines the conceptual foundations, architectural models, and initial technical components developed to enable NATWORK’s vision of secure, self-adaptive, and trustworthy service environments. It addresses the technical challenges that arise when delegating critical security decisions to AI-driven systems, particularly in terms of real-time responsiveness, human interpretability, and integration with heterogeneous infrastructures.The work reported on this deliverable is the outcome of two complementary tasks. Task 4.3 introduces the concept of AI-as-a-Security-Service (AIaaSecS), a paradigm in which modular AI components operate across the orchestration layers to detect threats, enforce dynamic policies, and autonomously adapt service configurations in response to changing risk conditions. Task 4.4 focuses on two critical enablers: the integration of multi-source cyber threat intelligence and the design of mechanisms for explainability and observability in AI-based decision-making. Together, these efforts support the development of intelligent network services that are not only secure but also transparent, traceable, and responsive to evolving operational contexts. Section 2 of the document provides a thorough state-of-the-art review, situating the NATWORK approach about ongoing research in zero-touch orchestration, threat detection, blockchain for trust, and explainable AI. Building on this foundation, Section 3 introduces the initial design of NATWORK’s zero-touch solutions, which aim to automate the deployment and lifecycle management of services with minimal human input. Section 4 presents the architecture for real-time threat detection based on AI agents that process telemetry and contextual information to identify attacks and abnormal behaviour. Section 5 outlines a decentralized trust framework based on blockchain technology, supporting secure data sharing and authentication across service components. Section 6 develops the explainability dimension, proposing techniques and tools to ensure that AI decisions—especially those related to security—are understandable and verifiable. Finally, Section 7 describes the NATWORK CTI framework, which enables the ingestion, processing, and operational use of diverse threat intelligence sources. The main conclusion of this deliverable is that NATWORK’s combined use of AI, CTI, and explainability represents a viable and forward-looking approach to securing the next generation of networked services. The architectural designs and early components presented here demonstrate strong technical feasibility and alignment with the project’s goals of building resilient, adaptive, and low-overhead cybersecurity solutions for 6G infrastructures. They also provide a foundation for the deployment of intelligent orchestration platforms that can respond to threats in real-time while maintaining transparency and auditability. The purpose of Deliverable D4.3 is to consolidate the results of the first phase of technical work within WP4 and to establish a coherent baseline for further development, integration, and testing. It provides a shared reference for partners working on related tasks. It prepares the ground for the implementation and validation activities that will follow in the second half of the project. The final results will be documented in Deliverable D4.4, where the complete system integration and performance evaluation will be presented based on NATWORK’s use cases and scenarios.