Traditional intrusion detection systems such as Snort and Suricata rely on rule-based or signature-based detection mechanisms. While effective against known attack patterns, these systems exhibit limited capability in identifying zero-day exploits and polymorphic threats. Moreover, centralized deployment architecture introduces scalability and latency challenges in intelligent communication systems where nodes are geographically distributed and operate with real-time constraints.

Centralized IDS models also present a single point of failure and increase network overhead due to continuous telemetry aggregation. In high-throughput environments such as IoT-enabled smart grids or vehicular communication systems, this architectural limitation significantly affects detection latency and responsiveness.

Limitation Identified: Lack of adaptability and insufficient resilience against evolving, multi-stage attacks.

Recent advancements have incorporated supervised and unsupervised machine learning techniques for anomaly detection in communication networks. Approaches leveraging Support Vector Machines (SVM), Random Forests, k-Nearest Neighbors, and Deep Neural Networks have demonstrated improved detection accuracy compared to signature-based systems.

Deep learning models, including Convolutional Neural Networks (CNN) and Long Short-Term Memory (LSTM) networks, have been applied for traffic pattern recognition and time-series anomaly detection. These models enhance classification performance; however, they are typically trained offline and lack dynamic threat adaptation capabilities.

Furthermore, most ML-based IDS implementations operate in centralized environments. Distributed deployment remains limited due to computational overhead and synchronization challenges across heterogeneous nodes.

Limitation Identified: Static model training, insufficient cross-layer contextual fusion, and limited distributed enforcement.

To overcome centralization constraints, recent research has explored distributed intrusion detection frameworks and cybersecurity mesh architectures. Cybersecurity mesh models emphasize decentralized policy enforcement, micro-segmentation, and zero-trust principles. Security capabilities are deployed closer to assets, often at edge gateways or node clusters.

Such architecture enhances resilience and reduces response latency. However, many implementations still rely on static rule engines or traditional ML classifiers without adaptive threat generation mechanisms. Additionally, risk scoring is often performed independently at the node level without systematic cross-layer correlation.

Limitation Identified: Absence of adaptive intelligence capable of synthesizing new attack hypotheses and limited risk fusion mechanisms.

Generative Artificial Intelligence (GenAI) has recently been explored in cybersecurity contexts for synthetic attack generation, adversarial training, automated threat intelligence summarization, and log analysis. Large language models and generative adversarial networks (GANs) have demonstrated potential in simulating evolving attack patterns and improving detection robustness through adversarial learning.

Despite promising advancements, integration of GenAI into real-time distributed communication security remains limited. Existing work often focuses on either:

Offline threat simulationIsolated anomaly detection enhancementSecurity operations automation

There remains a gap in embedding GenAI as an adaptive reasoning component within a distributed cybersecurity mesh capable of continuous cross-layer threat modeling.

Existing IDS research has improved detection accuracy, but three gaps remain important for intelligent communication systems. First, many models still assume centralized collection and inference, which is not ideal for latency-sensitive edge environments. Second, AI-based IDS methods often operate as fixed classifiers rather than continuously updating their threat assumptions as adversarial behavior changes. Third, available approaches rarely combine network events, application behavior, node telemetry, and external threat context into a single operational risk score. These gaps motivate a mesh-based approach in which local detection, AI-assisted threat reasoning, and policy enforcement operate as coordinated functions.

We consider an intelligent communication environment comprising:

N distributed nodes (IoT devices, embedded systems, edge servers)Edge gateways responsible for traffic aggregationA centralized orchestration layer for policy coordinationMulti-layer communication stack:Network layer (packet flows, routing behavior)Transport/session layer (connection states, protocol exchanges)Application layer (API calls, service requests, payload semantics)Behavioral layer (node-level telemetry, CPU/memory usage, process anomalies)

Each node is equipped with a lightweight security agent capable of telemetry collection and local anomaly pre-processing. These agents communicate with a distributed mesh controller enforcing zero-trust policies.

We assume a probabilistic polynomial-time (PPT) adversary with the following capabilities:

1)Network Manipulation

Packet injectionReplay attacksDistributed Denial of Service (DDoS)Man-in-the-Middle (MITM)

2)Protocol Exploitation

Exploiting insecure handshake sequencesSession hijackingRouting manipulation

3)Node Compromise

Malware injection into edge devicesPrivilege escalationLateral movement within sub-networks

4)Zero-Day Attack Simulation

Novel attack patterns not previously observedPolymorphic traffic behavior

The adversary does not possess global cryptographic key material but may compromise a subset k of nodes where k < N .

The proposed system aims to satisfy the following objectives:

1)Real-Time Threat Detection

Minimize detection latency T d Maintain bounded response time T r

2)High Detection Accuracy

Maximize True Positive Rate (TPR)Minimize False Positive Rate (FPR)

3)Adaptive Threat Modeling

Continuous update of anomaly hypothesesDynamic risk threshold recalibration

4)Distributed Resilience

Avoid single point of failureMaintain detection capability under partial node compromise

The experimental evaluation considers five primary attack categories:

1)Distributed Denial of Service (DDoS)

High-volume traffic floods targeting gateways

2)Man-in-the-Middle (MITM)

Traffic interception and modification

3)Protocol Exploitation

Malformed packet injectionSession hijacking

4)Anomalous Behavioral Drift

Gradual deviation in device resource patterns

5)Synthetic Zero-Day Patterns

Generated attack traffic not matching predefined signatures

The threat model was instantiated by allowing up to 10% of nodes to exhibit compromised behavior during selected attack windows. Compromised nodes generated abnormal communication patterns, protocol irregularities, or behavioral telemetry drift depending on the attack category. Adaptive threshold updates were performed every 30 simulated minutes using training-window statistics and were frozen during final testing. Poisoning risk was represented as an adversarial limitation: the current simulation did not allow attackers to directly modify the GATE training process, but telemetry manipulation by compromised nodes was included as part of the behavioral drift and protocol exploitation scenarios.

The following assumptions constrain the system:

Secure initial device onboarding with cryptographic identity provisioning.Encrypted communication channels between mesh nodes and orchestrator.Computational capability at edge nodes sufficient for lightweight inference.Availability of baseline training dataset for initial model bootstrapping.

We define a threat confidence function:

where:

N i = Network-layer anomaly score; A i = Application-layer anomaly score; B i = Behavioral deviation metric; C i = Contextual threat intelligence weight.

The final risk score for node i is computed as:

Subject to:

This weighted fusion model enables cross-layer anomaly aggregation and adaptive risk recalibration through the GenAI threat modeling engine described in Section 5.

The threat model reflects realistic adversarial behavior in distributed intelligent communication systems. The security objectives emphasize adaptive detection, cross-layer reasoning, and distributed resilience. These assumptions form the basis for the architectural design described in the next section.

The proposed system follows a distributed mesh topology composed of:

1)Edge Security Nodes (ESNs)

2)Mesh Coordination Layer (MCL)

3)GenAI Adaptive Threat Engine (GATE)

4)Policy Orchestration and Response Layer (PORL)

The design adheres to zero-trust principles: no device, session, or communication flow is inherently trusted, even within internal network boundaries. Figure 1 presents the proposed GenAI-assisted cybersecurity mesh architecture, showing the flow from edge security nodes to mesh coordination, generative threat reasoning, dynamic risk fusion, and adaptive policy enforcement. At the edge layer, heterogeneous nodes (IoT sensors, control systems, and gateways) perform network, application, and behavioral anomaly detection, followed by local risk scoring. Telemetry summaries are forwarded to the Mesh Control Layer (MCL), which coordinates distributed updates. The Generative AI Adaptive Threat Engine (GATE) synthesizes adversarial threat hypotheses and recalibrates contextual risk weights. The Dynamic Risk Fusion module computes the composite risk score R i = α N i + β A i + γ B i + δ C i , triggering the Adaptive Policy Module when thresholds are exceeded.

Diagram showing edge security nodes performing network, application, and behavioral anomaly detection, followed by local risk scoring, telemetry aggregation, mesh coordination, generative threat analysis, dynamic risk fusion, and adaptive policy enforcement.

Figure 1.GenAI-assisted cybersecurity mesh architecture for edge-enabled communication networks.

Components:

1) Edge Security Nodes (ESNs)

Deployed at IoT devices, gateways, and edge servers.

Functions:

Real-time packet inspectionLightweight anomaly scoringBehavioral telemetry collectionLocal enforcement (micro-segmentation, traffic throttling)

Each ESN computes preliminary anomaly metrics:

This reduces central bandwidth overhead and detection latency.

2) Mesh Coordination Layer (MCL)

Acts as a distributed synchronization fabric:

Aggregates anonymized anomaly summariesSynchronizes threat intelligenceMaintains node trust scoresEnsures resilience against partial compromise

Unlike centralized IDS, MCL operates in a logically distributed fashion to prevent single points of failure.

3) GenAI Adaptive Threat Engine (GATE)

This is the core novelty of the architecture.

Capabilities:

Synthesizes potential attack hypothesesGenerates adversarial traffic variationsRefines anomaly detection thresholdsUpdates contextual threat intelligence weights C i

GATE continuously adjusts fusion weights:

where t represents adaptive time intervals.

4) Policy Orchestration and Response Layer (PORL)

Responsible for:

Dynamic rule generationAutomated quarantine actionsNetwork isolation policiesAdaptive rate limiting

Response decisions are triggered when:

where θ t is an adaptive risk threshold recalibrated by GATE.

1) Telemetry captured at ESNs

2) Local anomaly scoring

3) Aggregated signals transmitted to MCL

4) GATE performs contextual reasoning

5) Updated policies propagated back to ESNs

6) Enforcement applied in near real-time

Latency target:

The architecture aims to minimize T p r o p a g a t i o n through decentralized updates.

Each communication request undergoes:

1) Identity verification

2) Context validation

3) Behavioral deviation check

4) Dynamic risk scoring

Trust is continuously re-evaluated rather than statically assigned.

If k nodes are compromised:

ESNs operate independentlyMCL redistributes trust scoresCompromised nodes are isolated via automated micro-segmentation

System integrity is maintained provided:

(Assuming distributed consensus threshold)

Table 1 compares the proposed mesh architecture with a centralized IDS baseline across adaptability, scalability, latency, zero-day detection, and failure-resilience dimensions.

Table 1.Comparison of centralized IDS and proposed cybersecurity mesh.

The proposed architecture integrates distributed enforcement, adaptive generative threat modeling, and cross-layer risk fusion. It is designed to operate efficiently within heterogeneous intelligent communication environments while maintaining resilience and low latency.

Traditional IDS models rely on static datasets and fixed decision boundaries. In contrast, the proposed framework embeds a Generative AI-based Adaptive Threat Engine (GATE) that continuously refines detection models using contextual telemetry and synthesized adversarial patterns.

The adaptive process operates in iterative cycles:

1) Telemetry aggregation

2) Anomaly detection

3) Threat hypothesis synthesis

4) Adversarial pattern generation

5) Model refinement

6) Policy redistribution

This cycle reduces concept drift and enhances zero-day detection resilience.

Let X t represent observed traffic and telemetry features at time t .

The generative engine learns an evolving distribution:

Using a generative model G , new adversarial samples are synthesized:

where:

Z = latent noise vector; C = contextual threat embedding; ϕ = generative model parameters.

These synthetic samples simulate polymorphic or zero-day attack variants. The anomaly detection model is retrained incrementally with both real and synthesized samples:

where:

θ = detection model parameters; η = learning rate; L = loss function.

In this study, the GenAI Adaptive Threat Engine (GATE) was implemented as a conditional generative model trained on contextual traffic and telemetry embeddings from the training partition. The model family follows a conditional generative adversarial structure in which the generator produces candidate adversarial feature vectors and the discriminator rejects samples that do not resemble plausible communication-layer anomalies.

The input to GATE consists of four feature groups: network anomaly descriptors, application interaction descriptors, behavioral telemetry descriptors, and contextual threat labels. The output is a synthetic adversarial feature vector representing a plausible attack variant. The model was recalibrated every 30 simulated minutes using newly observed training-window telemetry summaries. Synthetic samples were accepted for detector updates only when they satisfied three criteria: feature-range validity, discriminator confidence above the validation threshold, and non-duplication against existing attack vectors based on cosine similarity. Samples failing these checks were discarded.

Each Edge Security Node extracts features across three layers:

1) Network Layer Features N i .

Packet inter-arrival timeFlow durationEntropy of source/destination distributionTCP flag anomalies

2) Application Layer Features A i .

API call frequency deviationRequest payload entropyAuthentication failure ratesSession irregularities

3) Behavioral Layer Features B i .

CPU utilization driftMemory allocation anomaliesProcess spawning irregularitiesDevice energy usage deviations

Feature vectors are normalized and fed into local anomaly estimators:

where g ( ⋅ ) may represent a lightweight neural classifier deployed at the edge.

The final threat score is computed as:

where:

C i = contextual threat intelligence from GATE;Weights dynamically updated over time.

Adaptive Weight Update Rule

Weights are updated using performance feedback:

Similarly, for β , γ , δ .

Subject to normalization constraint:

This enables the system to emphasize layers that improve detection performance in current threat landscapes.

Each Edge Security Node computes three normalized anomaly scores before risk fusion. The network-layer score N i ∈ [ 0 , 1 ] represents deviation in packet timing, flow duration, source-destination entropy, and protocol-flag behavior. The application-layer score A i ∈ [ 0 , 1 ] represents deviation in API request frequency, payload entropy, authentication failures, and session-state consistency. The behavioral score B i ∈ [ 0 , 1 ] represents deviation in CPU utilization, memory consumption, process activity, and device-level resource patterns.

These values are not class probabilities. They are normalized anomaly aggregates produced by lightweight local estimators at each Edge Security Node. A value closer to 0 indicates behavior close to the learned baseline, while a value closer to 1 indicates stronger deviation from expected behavior. The fused risk score combines these normalized signals with contextual threat intelligence weight C i .

A static threshold increases false positives during traffic bursts. Therefore, threshold θ t is adjusted dynamically:

where:

R a v g = rolling average risk; R s t d = rolling standard deviation; μ , σ = tuning constants.

This ensures statistical anomaly responsiveness.

Algorithm 1: Adaptive Mesh Threat Detection.

Input: Telemetry stream T

Output: Risk scores R_i and policy actions

1) Collect multi-layer features (N_i, A_i, B_i)

2) Compute local anomaly scores

3) Transmit summaries to MCL

4) Generate synthetic threat patterns using GATE

5) Update detection model parameters

6) Compute fused risk score R_i

7) If R_i ≥ θ_t:

Trigger enforcement policy

8) Update weights and thresholds

9) Repeat

Time Complexity:

Edge inference: O(d)Generative update: O(n·k)Fusion scoring: O(1)

Overall complexity remains scalable under distributed deployment.

Compared to static ML-based IDS:

Reduces concept driftEnhances zero-day robustnessImproves contextual reasoningMaintains low edge latencyEnables distributed adaptation

The proposed methodology integrates generative threat synthesis, cross-layer anomaly extraction, dynamic risk fusion, and adaptive threshold recalibration into a cohesive distributed framework. This creates a continuously evolving detection ecosystem suitable for intelligent communication infrastructures.

The evaluation aims to measure:

1) Detection Accuracy (ACC)

2) Precision, Recall, and F1-Score

3) False Positive Rate (FPR)

4) Detection Latency

5) Adaptive Improvement Over Time

6) Scalability under increasing node count

Baseline comparisons include:

Signature-based IDS (Rule-driven)Centralized ML-based IDS (Static Deep Neural Network)

Table 2 summarizes the configuration of the simulated edge-enabled communication environment.

Table 2.Simulation environment configuration.

Nodes emulate heterogeneous behavior:

IoT sensorsEmbedded control systemsEdge analytics devicesGateway nodesTraffic patterns include:Normal operational flowsBurst traffic eventsPeriodic device reportingRandomized noise injection

The experimental dataset was generated within the simulated intelligent communication environment described in Table 2. No external public dataset was directly reused for the primary evaluation. Normal traffic instances were generated from heterogeneous node profiles representing IoT sensors, embedded control devices, edge analytics nodes, and gateway services. These profiles produced periodic telemetry, burst communication, API requests, session exchanges, and randomized background noise. The 120,000 normal instances, therefore represent simulated per-flow and per-session communication records collected over a 24-hour synthetic timeline.

Malicious traffic was injected at a 15% attack rate across selected time windows and node groups. DDoS traffic was modeled through high-volume request bursts against edge gateways; MITM behavior was modeled through delayed, modified, and replayed packet sequences; protocol exploitation was modeled through malformed packet fields, irregular handshake sequences, and session manipulation; behavioral drift was modeled through gradual resource-usage deviation at compromised nodes. Synthetic zero-day patterns were generated only from the training partition using the GATE module and then evaluated on held-out test windows to avoid test-set leakage.

To reduce leakage risk, the train, validation, and test partitions were separated by time window rather than by random flow-level sampling. The first 70% of the synthetic timeline was used for training, the next 15% for validation, and the final 15% for testing. Feature normalization parameters, adaptive thresholds, and generative updates were fitted only on the training partition and applied unchanged to validation and test partitions.

The dataset consists of:

120,000 normal traffic instances25,000 malicious instances8000 synthetic zero-day patterns generated by GATEMixed multi-stage attack sequences

Table 3 lists the attack categories and instance counts used in the simulated evaluation.

Table 3.Attack category composition.

Data was partitioned:

70% training15% validation15% testing

Edge inference model: Lightweight feedforward neural networkGenerative model: Conditional generative model with contextual embeddingsOptimization: Adam optimizerLearning rate: 0.001Risk fusion weights initialized uniformlyThreshold recalibration interval: Every 30 minutes (simulated)

Hardware configuration (simulation environment):

16-core CPU64 GB RAMGPU-assisted generative training

Standard classification metrics were used:

Detection latency measured as:

False Positive Rate:

Baseline 1: Signature-Based IDS.

Static rule databaseCentralized monitoringNo adaptive retraining

Baseline 2: Centralized ML IDS.

Deep neural networkPeriodic offline retrainingNo generative augmentation

All evaluated methods used the same train, validation, and test partitions, feature extraction pipeline, and normalization procedure. The signature-based IDS baseline used static rule patterns corresponding to the attack categories included in the simulation and did not receive adaptive threshold updates or synthetic samples. The centralized ML baseline used a feedforward neural network with three hidden layers, ReLU activation, dropout regularization, Adam optimization, and a learning rate of 0.001. The proposed GCM model used the same base feature set as the centralized ML baseline but added edge-local inference, dynamic risk fusion, adaptive threshold recalibration, and GATE-generated adversarial samples during training-window updates.

Hyperparameters were selected using the validation partition and then fixed before final test evaluation. No model used test-set labels during training, threshold tuning, or synthetic sample generation.

Node count was scaled from 100 to 500 nodes:

Measured:

Latency growth rateThroughput degradationModel update overhead

To mitigate bias:

Balanced attack injectionCross-validation across time windowsIndependent test partitionAblation study for:No generative augmentationStatic weight fusionNo adaptive threshold

The experimental design simulates a realistic intelligent communication network with heterogeneous nodes and diverse attack scenarios. Comparisons against rule-based and centralized ML-based IDS models enable quantitative evaluation of adaptive performance improvements.

The proposed GCM model achieved the strongest overall classification performance among the three evaluated methods. Accuracy increased from 0.914 for the centralized ML baseline to 0.948, while the false positive rate declined from 0.062 to 0.038. This improvement is important for communication networks because excessive false alerts can delay operational response and reduce trust in automated enforcement. The F1-score also improved to 0.935, indicating that the gain was not driven by precision or recall alone.

Overall Classification Metrics

Table 4 reports the overall classification performance of the evaluated IDS models.

Table 4.Overall classification performance of evaluated IDS models.

Results were evaluated across five chronological test windows from the held-out test period. The proposed GCM model consistently outperformed both baselines in accuracy, F1-score, and false positive rate. The paired comparison across the five test windows showed that the GCM improvement over the centralized ML baseline was statistically significant for F1-score.

Table 5.Zero-day detection performance.

Table 5 summarizes detection performance on synthetic zero-day attack patterns.

The largest relative gain appears in the zero-day evaluation. The rule-based IDS performed poorly because the attack patterns were not represented in its signature base. The centralized ML model performed better but remained limited by its static training distribution. In contrast, the GCM approach benefited from generated adversarial variants, which exposed the detector to a wider range of plausible attack behaviors before evaluation.

Table 6 compares the average detection latency of the evaluated models.

Table 6.Average detection latency comparison.

GCM also produced the lowest mean detection latency at 74 ms, compared with 118 ms for centralized ML-based IDS and 142 ms for the signature-based IDS. The reduction is mainly attributable to local inference at the edge, which avoids continuous backhaul of raw telemetry to a central decision point. For intelligent communication systems, this latency reduction is operationally relevant because threat response must often occur before compromised flows spread across dependent services.

Cross-layer weight distribution evolved over the simulation. The initial weights were approximately uniform: network-layer weight = 0.33, application-layer weight = 0.33, and behavioral-layer weight = 0.34. After 24 simulated hours, the weights shifted to network-layer weight = 0.46, application-layer weight = 0.34, and behavioral-layer weight = 0.20.

Interpretation:

Network-layer anomalies contributed more significantly during DDoS-heavy intervals.Behavioral metrics reduced weight as attack emphasis shifted.

This confirms adaptive rebalancing effectiveness.

Table 7 summarizes latency and throughput behavior as the simulated node count increases from 100 to 500.

Table 7.Scalability analysis under increasing node count.

Latency growth remained sub-linear, demonstrating distributed efficiency.

Table 8 reports the ablation results for the main components of the proposed GCM model.

Table 8.Ablation study of proposed GCM components.

The proposed GCM model achieved an ROC-AUC of 0.963, compared with 0.928 for CML and 0.871 for SID. This result indicates stronger separability across attack categories.

The proposed GCM architecture demonstrates:

Higher detection accuracySignificant false positive reductionStrong zero-day detectionLower latencyStable scalabilityMeasurable contribution of generative augmentation

8.1.1. Why Generative Augmentation Improves Detection

The improvement in zero-day recall (0.862) is primarily attributable to adversarial pattern synthesis. By generating contextualized synthetic attack variants, the detection model becomes less dependent on fixed traffic signatures and better generalized to unseen distributions.

This reduces:

Overfitting to historical trafficConcept drift vulnerabilitySensitivity to polymorphic attacks

The ablation study confirms that removing generative augmentation reduces F1-score by approximately 3%.

8.1.2. Effectiveness of Cross-Layer Fusion

The adaptive weight mechanism allowed the system to dynamically prioritize relevant layers during specific attack phases. For instance:

Network layer weight increased during DDoS bursts.Behavioral features became more relevant during stealth compromise phases.

This dynamic rebalancing improved robustness compared to static fusion schemes.

8.1.3. Distributed Architecture Benefits

Edge-based inference reduced centralized bottlenecks, leading to lower detection latency. Sub-linear latency growth during node scaling indicates that the distributed mesh design effectively mitigates performance degradation in large networks.

The largest performance gain was observed for synthetic zero-day and protocol exploitation scenarios, where static signatures were least effective. DDoS detection improved mainly because network-layer entropy and packet-rate features were captured locally at edge nodes, reducing response delay. MITM detection improved moderately, especially when application-session irregularities were combined with transport-layer deviations. Behavioral drift remained the most difficult category because gradual resource changes sometimes overlapped with benign workload variation. Most false alarms occurred during bursty legitimate traffic, where temporary packet-rate increases resembled early-stage DDoS behavior.

While promising, deployment in real-world environments requires addressing:

1)Computational Constraints

Edge devices with limited processing capability may struggle with frequent adaptive updates.Lightweight inference optimization is required.

2)Model Synchronization Overhead

Frequent weight updates may introduce network overhead.Efficient update batching strategies must be implemented.

3)Trust in Generative Outputs

Poorly calibrated generative models may introduce adversarial bias.Synthetic pattern validation mechanisms are necessary.

4)Privacy and Data Governance

Cross-layer telemetry aggregation may raise privacy concerns.Secure aggregation and anonymization must be enforced.

8.4.1.Synthetic Dataset Dependence

The experimental evaluation was conducted in a simulated intelligent communication environment. Although diverse attack scenarios were modeled, real-world deployment may introduce unforeseen noise patterns and operational variability.

8.4.2.Generative Model Complexity

Generative threat synthesis requires periodic retraining. In highly resource-constrained environments, maintaining real-time adaptability may be challenging.

8.4.3.Threshold Sensitivity

Dynamic threshold recalibration improves adaptability but may cause temporary instability during abrupt traffic shifts. Stability mechanisms must be incorporated.

8.4.4.Adversarial Manipulation of GenAI

Sophisticated adversaries could attempt to poison telemetry inputs to manipulate generative adaptation. Defensive adversarial training strategies should be integrated.

Several extensions are proposed:

1) Federated generative threat modeling across organizational boundaries.

2) Integration with blockchain-backed trust management.

3) Formal verification of adaptive threshold stability.

4) Extension toward 6G-enabled ultra-low latency communication systems.

5) Deployment in real-world IoT testbeds for longitudinal validation.

The results suggest that embedding adaptive generative intelligence into distributed cybersecurity meshes can meaningfully improve detection robustness in intelligent communication systems. However, practical scalability, stability, and adversarial robustness must be further evaluated under operational deployment conditions.