Security-Aware AI for 6G LEO Satellite–Terrestrial Networks: Handover-Aware Temporal Graph Learning for Identity–Route Desynchronization Attacks

Security-aware artificial intelligence is becoming essential for protecting future wireless communication networks, particularly 6G terrestrial–non-terrestrial networks (TN–NTNs), where rapid mobility and dynamic routing create new opportunities for cross-layer attacks. This study introduces a Handover-Aware Temporal Graph Transformer (HATGT) for AI-driven detection and forecasting of Identity–Route Desynchronization Attacks (IRDAs) in LEO satellite–terrestrial networks. A 6G-oriented TN–NTN simulation environment is constructed using ns-3.48 and 5G-LENA v5.1 with available NR/NTN modeling capabilities, where “6G-oriented” denotes prospective satellite–terrestrial integration characteristics rather than a finalized 6G air interface or operational deployment, incorporating heterogeneous UE mobility, terrestrial gNBs, LEO satellites, NTN gateways, handover dynamics, routing evolution, and session-state transitions. Five IRDA mechanisms are modeled, and 100,000 synchronized observations are generated from 60 independent simulation runs. HATGT represents wireless-network states as heterogeneous temporal graphs and integrates relation-aware graph encoding, explicit handover-aware gating, causal temporal attention, and supervised contrastive learning to capture security-relevant dependencies among mobility, session, anchor, and forwarding states. The shared representation jointly supports six-class attack attribution, binary IRDA detection, 5 s early-warning prediction, and time-to-attack estimation. Under a run-disjoint evaluation protocol involving independent stochastic realizations of a common network configuration, HATGT achieves 98.42% accuracy, 98.38% Macro-F1, 0.998 AUROC, and 0.992 AUPRC for multiclass detection. The early-warning head achieves 90.29% F1, 0.914 AUPRC, a 0.15% false-alarm rate, and an average warning lead time of 3.76 s. These simulation-based findings demonstrate the potential of handover-aware temporal graph learning to distinguish legitimate mobility-induced transients from malicious identity–route inconsistencies under the investigated TN–NTN conditions. The reported performance supports within-configuration stochastic generalization rather than verified cross-topology robustness or operational 6G deployment readiness. Further evaluation across diverse network configurations, prediction horizons, hardware-in-the-loop platforms, and operational TN–NTN testbeds is required to establish real-world applicability and end-to-end security-response feasibility.