SAGSU-6G:A Real-Time Dynamic CNN+BiLSTM Framework for Physical-Layer Intrusion Detection in Multi-Domain 6G Networks

Sixth-generation (6G) wireless networks introduce a fundamentally new communication paradigm by integrating heterogeneous Space–Air–Ground–User–Sea Surface–Underwater (SAGSU-U) domains into a unified architecture. Although this integration significantly enhances network connectivity and coverage, it also expands the cyberattack surface, creating new security challenges for physical-layer intrusion detection. This paper presents SAGSU-6G, a unified physical-layer intrusion detection (PIDS) framework based on a hybrid convolutional neural network and bidirectional long short-term memory (CNN+BiLSTM) architecture for real-time classification of twelve cyberattack categories across six network layers. A custom Python-based dynamic physical-layer simulation environment incorporating realistic propagation models and 'Dwell Time' mechanics was developed to generate continuous sequential data. The live monitoring interface processed 1,453 sliding-window observations using eight physical-layer metrics: RSSI, SINR, Doppler, CSI, BER, jitter, PDR, and throughput. Experimental results demonstrate distinct attack-dependent degradation patterns across heterogeneous communication domains and a balanced class distribution suitable for multi-class learning. The proposed CNN+BiLSTM model achieved an 87.1% real-time streaming classification accuracy with an inference latency below 50 ms, demonstrating its effectiveness for real-time intrusion detection in future heterogeneous 6G environments.