FlagThis

Abstract

In sixth-generation (6G) networks, billions of cyberphysical systems (CPSs)autonomous vehicles, smart grids, industrial robots, and remote-surgical equipmentwill run over ultra-reliable low-latency slices, collapsing the gap between a remote breach and physical harm to milliseconds, a budget perimeter firewalls and centralised security operations centres cannot meet. This survey reframes 6G CPS security as a closed-loop, AI-native pipeline that senses at the multi-access edge computing (MEC) tier, using minute-scale call-detail records (CDRs) for baseline learning and slow-rate campaigns and sub-millisecond Radio Access Network (RAN)/Open-RAN (O-RAN) telemetry for the latency-critical path. The pipeline decides locally with compressed deep models, mitigates network-wide via software-defined networking (SDN), network function virtualization (NFV), and O-RAN controllers, and retrains through federated learning (FL) and digital-twin (DT) replay. We formalise a per-slice, tailbounded latency contract on the sense, detect, and mitigate stages, enforced at a slice-dependent tail percentile (p 99 for safetycritical URLLC slices) as a conservative sum-of-stage bound that prior autonomic and network control-loop models leave undefined. Organising 128 peer-reviewed studies (20172026) under a PRISMA 2020 protocol, we (i) map the 6G/CPS threat surface to MITRE ATT&CK and a CDR-observable feature space; (ii) unify edge anomaly detection and DDoS classification across twelve datasets and statistical, graph, and transformer models; (iii) synthesise SDN/NFV/O-RAN primitives into one closed-loop reference architecture; (iv) treat FL, large language models (LLMs), DT, post-quantum cryptography (PQC), zerotrust architecture (ZTA), and explainable AI as cross-cutting enablers, not parallel pillars; and (v) consolidate open problems into five directions spanning data, latency, trust, standardisation, and evaluation.