PaperlayerView exact revision on arXiv

Source-linked AI summary

A Survey on Large Language Models for Communication, Network, and Service Management: Application Insights, Challenges, and Future Directions

Gordon Owusu Boateng, Hani Sami, Ahmed Alagha, Hanae Elmekki, Ahmad Hammoud, Rabeb Mizouni, Azzam Mourad, Hadi Otrok, Jamal Bentahar, Sami Muhaidat, Chamseddine Talhi, Zbigniew Dziong, Mohsen Guizani

arXiv:2412.19823v1cs.NIcs.AIcs.LG

TL;DR

Communication NSM faces challenges including differing cross-domain data structures and priorities, while LLM use also raises concerns about inference speed, privacy, and sustainability. This survey reviews LLMs for NSM across communication-network domains and presents foundational material and a domain-spanning application taxonomy. It concludes that cross-domain adaptation remains a research direction.

  • Problem

    Cross-domain NSM benchmarking is challenging because mobile, vehicular, cloud, and edge networks have differing priorities and data structures.

    Source: A. Challenges and Open Issues · p. 45

  • Method

    The survey explores LLMs for NSM across mobile and IoT, vehicular, cloud, and fog/edge networks, alongside LLM fundamentals and customization.

    Source: §IX · p. 47

  • Results

    The survey provides a comprehensive exploration of LLMs for NSM across diverse communication-network domains and presents LLM fundamentals and customization for this context.

    Source: §IX · p. 47

  • Takeaways & Limitations

    Future cross-domain adaptive LLM architectures should address domain differences through modular designs, potentially using mixture-of-experts approaches.

    Source: B. Future Research Directions · p. 46

    Cross-domain benchmarks remain challenging because network domains differ in priorities and data structures.

    Source: A. Challenges and Open Issues · p. 45

Abstract

from arXiv · show

The rapid evolution of communication networks in recent decades has intensified the need for advanced Network and Service Management (NSM) strategies to address the growing demands for efficiency, scalability, enhanced performance, and reliability of these networks. Large Language Models (LLMs) have received tremendous attention due to their unparalleled capabilities in various Natural Language Processing (NLP) tasks and generating context-aware insights, offering transformative potential for automating diverse communication NSM tasks. Contrasting existing surveys that consider a single network domain, this survey investigates the integration of LLMs across different communication network domains, including mobile networks and related technologies, vehicular networks, cloud-based networks, and fog/edge-based networks. First, the survey provides foundational knowledge of LLMs, explicitly detailing the generic transformer architecture, general-purpose and domain-specific LLMs, LLM model pre-training and fine-tuning, and their relation to communication NSM. Under a novel taxonomy of network monitoring and reporting, AI-powered network planning, network deployment and distribution, and continuous network support, we extensively categorize LLM applications for NSM tasks in each of the different network domains, exploring existing literature and their contributions thus far. Then, we identify existing challenges and open issues, as well as future research directions for LLM-driven communication NSM, emphasizing the need for scalable, adaptable, and resource-efficient solutions that align with the dynamic landscape of communication networks. We envision that this survey serves as a holistic roadmap, providing critical insights for leveraging LLMs to enhance NSM.

I. INTRODUCTION

This introduction motivates LLMs for communication NSM and positions the survey as a cross-domain review of their applications. It combines LLM fundamentals with a taxonomy spanning monitoring, planning, deployment, and support.

A. Background

  • NSM optimizes infrastructure and key performance indicators such as latency, bandwidth, energy efficiency, and QoS through monitoring, planning, deployment, and ongoing support.Network management focuses on infrastructure, whereas service management concerns service delivery and end-user performance.Source: A. Background · p. 2
  • Conventional optimization methods can fall short in dynamic, heterogeneous networks, while traditional AI/ML models struggle with unstructured data and adapting to new tasks and conditions.The introduction notes that model updates can also be computationally expensive and time-consuming.Source: A. Background · p. 2
  • LLMs can process unstructured natural-language inputs and use context to derive insights, supporting potential NSM applications such as anomaly detection and predictive maintenance.The introduction describes LLMs as capable of analyzing data from multiple sources and making context-aware decisions.Source: A. Background · p. 2

B. Motivation

  • Existing surveys cover specific domains and taxonomies, while a comprehensive review of LLMs for communication NSM across network domains remains lacking.The introduction identifies prior work on telecommunications, autonomous driving, IoV, UAVs, satellite-aerial-terrestrial networks, ITS, and mobile edge intelligence.Source: B. Motivation · p. 3, C. Related Surveys · pp. 3, 5

C. Related Surveys

  • The survey reviews LLM-based NSM across mobile and IoT, vehicular, cloud, and fog/edge networks using four task groups: monitoring and reporting, planning, deployment and distribution, and continuous support.It also introduces LLM fundamentals, including transformer architecture, general-purpose and domain-specific models, and pre-training and fine-tuning.Source: C. Related Surveys · p. 5

D. Main Contributions

The survey combines LLM foundations and a four-task taxonomy with a review spanning mobile/IoT, vehicular, cloud, and fog/edge networks. Its PRISMA-based search and screening process yielded 108 manuscripts for categorization.

D. Main Contributions

  • The survey covers LLMs for NSM across mobile/IoT, vehicular, cloud, and fog/edge networks, and reviews their fundamentals, applications, challenges, and future directions.It includes transformer architecture, general-purpose and domain-specific LLMs, pre-training, and fine-tuning.Source: D. Main Contributions · pp. 5–6
  • The survey’s taxonomy groups communication NSM applications into monitoring and reporting, AI-powered planning, deployment and distribution, and continuous support.Studies are reviewed within network domains and these functional categories.Source: D. Main Contributions · p. 6

E. Survey Methodology

  • The literature review used PRISMA to identify, screen, and select relevant studies.The framework was chosen to support systematic study selection and consistency.Source: E. Survey Methodology · p. 6

1) Initial literature search:

  • The initial search returned 302 manuscripts, including 14 survey papers, using Google Scholar and Semantic Scholar to query major digital libraries.The search combined LLM, network/service management, and network-domain keywords.Source: 1) Initial literature search · pp. 6–7

2) Removal of duplicates:

  • After duplicate removal, 231 papers remained for screening; 71 duplicates had been removed.The duplicate-removal stage streamlined the review so each study was reviewed once.Source: 2) Removal of duplicates · p. 7

3) Literature screening and selection:

The survey screens and categorizes literature on LLM-enabled communication NSM, then presents the review’s structure and LLM and transformer fundamentals. Its taxonomy organizes applications across four network domains and four NSM task groups.

3) Literature screening and selection:

  • After removing duplicates, 74 papers were excluded by title, abstract, conclusion, and publication-year screening, leaving 157 for full-text review.Inclusion criteria focused on LLMs for NSM in communication networks and publication within the past five years.Source: 3) Literature screening and selection · p. 7

4) Full-text literature review:

  • The full-text review assessed study quality and relevance, removed most preprints because they were not peer-reviewed, and retained 108 manuscripts for categorization.Reviewers examined each study’s contributions and innovative methods or approaches.Source: 4) Full-text literature review · p. 7

5) Categorization and taxonomy:

  • The survey classifies studies across mobile/IoT, vehicular, cloud, and fog/edge networks, then groups them by monitoring, planning, deployment, and continuous support.Its study records include problems, proposed LLM solutions, datasets, and evaluation metrics.Source: 5) Categorization and taxonomy · p. 7

F. Outline of Survey

  • The survey proceeds from LLM fundamentals and an NSM taxonomy to four network-domain reviews, followed by challenges, future directions, and a conclusion.The domain reviews address mobile, vehicular, cloud, and fog/edge networks.Source: F. Outline of Survey · p. 7

II. LLM FUNDAMENTALS

  • LLMs are described as models trained on large datasets to learn language patterns and generalize across tasks, with applications spanning NLP and computer vision.The survey notes tasks including text classification, question answering, sentiment analysis, image recognition, and object detection.Source: §II · p. 7

B. General-Purpose vs. Domain-Specific LLMs

  • Transformers use attention and parallel processing rather than sequential dependencies, with encoder and decoder stacks supporting contextual representations and output generation.The encoder processes input tokens; the decoder uses encoder representations in generation tasks.Source: B. General-Purpose vs. Domain-Specific… · p. 9

A. Transformer Architecture

  • A transformer combines token embeddings, positional encodings, encoder and decoder modules, and an output layer to process sequences and generate predictions.Positional encoding preserves token order during parallel processing, while output probabilities support next-token selection.Source: A. Transformer Architecture · p. 9
  • Encoder self-attention relates each token to others, while decoder cross-attention aligns generated tokens with relevant encoder outputs.Decoder self-attention is masked to prevent attending to future tokens and preserve autoregressive generation.Source: A. Transformer Architecture · p. 9

B. General-purpose vs. Domain-specific LLMs

General-purpose LLMs use broad, heterogeneous training data to handle varied language tasks, while domain-specific LLMs focus on specialized knowledge and tasks. Their strengths and limits differ in breadth, domain relevance, and cross-domain capability.

1) General-purpose LLMs:

  • General-purpose LLMs offer broad task coverage through heterogeneous knowledge, but may lack the detail needed for specialized technical or scientific inquiries.The survey notes this may limit their fit for vehicular environments relying primarily on video and image data.Source: 1) General-purpose LLMs · pp. 10–11

2) Domain-specific LLMs:

  • Domain-specific LLMs target specialized fields and tasks, using curated, domain-focused datasets to improve accuracy and relevance.Examples include telecom tasks such as Q&A, 3GPP document classification, and code summarization.Source: 2) Domain-specific LLMs · pp. 11–12
  • Domain-specific LLMs can have limited capability beyond their trained field because their knowledge base is specialized.Source: 2) Domain-specific LLMs · p. 12

C. Model Pre-Training and Fine-Tuning

Pre-training builds broad language representations from extensive data, and fine-tuning adapts that base knowledge to particular tasks or domains. The survey outlines training strategies and efficiency techniques relevant to developing and adapting LLMs for communication networks.

1) Model pre-training:

  • Pre-training exposes LLMs to large datasets to learn language patterns, context, and semantics, providing a base that can reduce fine-tuning data and compute needs.Source: 1) Model pre-training · p. 12
  • Pre-training data can be general or domain-specific; Mobile-LlaMA was pre-trained on public 5G datasets including BGP routing tables, packet captures, and performance metrics.BERT was pre-trained on BooksCorpus and English Wikipedia for sentence-level tasks.Source: 1) Model pre-training · p. 12
  • Pre-training is computationally intensive, so distributed techniques include data, model, pipeline, and tensor parallelism, ZeRO, gradient accumulation, and gradient sharding.Model parallelism divides a model across devices, while ZeRO shards optimizer states to reduce memory footprint.Source: 1) Model pre-training · p. 12

2) Model fine-tuning:

  • Fine-tuning adapts pre-trained models to specific tasks or domains through supervised, unsupervised, zero-shot or few-shot, parameter-efficient, and RL-based approaches.Supervised methods use labeled input-output pairs; unsupervised methods continue learning from domain-related corpora without explicit labels.Source: 2) Model fine-tuning · pp. 13–14
  • Few-shot adaptation uses limited examples when labeled data is scarce, as in network-slice configuration using user intents and corresponding slice descriptors.Source: 2) Model fine-tuning · p. 14
  • Parameter-efficient methods such as LoRA and prompt tuning reduce fine-tuning resource demands, while RLHF uses human feedback to align responses with user expectations.LoRA adds a small number of trainable parameters; prompt tuning optimizes prompts without changing core parameters.Source: 2) Model fine-tuning · p. 14

D. Summary

The survey links LLM training choices to communication-network data and resource constraints, then organizes LLM applications across network domains and four NSM task areas. It reviews monitoring and planning uses, including their potential roles in interpreting network data and translating operator intents into actions.

D. Summary

  • Communication-network training data vary in structure, content, and quality and may be sparse, noisy, and domain-specific; preprocessing can reduce noise and improve output quality.Examples span network logs and packet data, vehicular datasets, IoT datasets, cloud-edge repair data, and mobile-network configuration intents.Source: D. Summary · p. 14
  • Training network-specific LLMs can require substantial compute, while frequent updates for changing traffic, mobility, and configurations may be resource-intensive and disrupt model performance.The survey identifies real-time response needs as an additional fine-tuning challenge, particularly for mobile and vehicular networks.Source: D. Summary · p. 14
  • LoRA and prompt tuning can avoid updating all model parameters, and the survey identifies them as useful for fine-tuning on resource-limited edge networks.Source: D. Summary · p. 15

III. PROPOSED TAXONOMY OF LLMS FOR NSM

  • The proposed taxonomy covers mobile and IoT, vehicular, cloud, and fog/edge networks across monitoring and reporting, planning, deployment and distribution, and continuous support.It is presented as a framework for categorizing LLM-based NSM literature across these domains and task areas.Source: §III · p. 15

A. LLM for Network Monitoring and Reporting

  • For monitoring, LLMs are discussed for log-based intrusion detection, forecasting resource needs, traffic analysis, and root-cause analysis across network settings.The survey contrasts these uses with conventional approaches that can struggle with unstructured logs, task-specific feature engineering, and dynamic changes.Source: A. LLM for Network Monitoring and… · p. 15

B. LLM for AI-powered Network Planning

  • For planning, LLMs are discussed for breaking high-level intents into executable policies, generating configurations, planning routes, mitigating incidents, and optimizing deployment locations.Examples include placing inference services at edge devices for real-time responses and enhanced privacy, subject to memory and compute constraints.Source: B. LLM for AI-powered Network Planning · pp. 16–17

C. LLM for Network Deployment and Distribution

The survey describes LLM applications for network deployment and distribution, continuous support, and mobile-network NSM. Mobile-network monitoring is motivated by the scale and heterogeneity of 5G and IoT services and devices.

C. LLM for Network Deployment and Distribution

  • LLMs are discussed for wireless deployment optimization, telecom maintenance and configuration tasks, and service placement based on predicted requirements and latency models.The survey describes allocating queries and scaling computing resources to help avoid SLA violations and inefficient utilization.Source: C. LLM for Network Deployment and… · p. 17

D. LLM for Continuous Network Support

  • For continuous support, the survey covers real-time optimization and adjustments, network-slice lifecycle management, IoT honeypots, code repair, and fault-tolerance management.LLMs may identify fault patterns, predict failures, and implement preemptive strategies to minimize service interruptions.Source: D. LLM for Continuous Network Support · p. 17

IV. LLMS FOR MOBILE NETWORKS AND TECHNOLOGIES-BASED NSM

  • Mobile-network LLM applications span analysis, configuration, anomaly detection, intelligence, and NSM, including resource allocation and network-function orchestration.The described mobile workflow processes network data into task inputs, applies LLM inference, and uses the resulting decisions in the network environment.Source: §IV · p. 18

A. LLM for Network Monitoring and Reporting

  • Monitoring 5G and IoT must address large volumes of traffic across heterogeneous services and devices, including ensuring network slices meet their performance standards.The survey describes LLMs as potential tools for interpreting logs and metrics and detecting deviations such as unexpected latency.Source: A. LLM for Network Monitoring and… · p. 18

1) Network intrusion/threat detection:

The survey reviews LLM applications across network intrusion detection, analysis and forecasting, planning, configuration, and deployment. The approaches include prompt-based detection and intent translation as well as domain-adapted models and automated resource decisions.

1) Network intrusion/threat detection:

  • The wireless IDS framework [134] uses feature selection, data collection, prompt building, and decision extraction, with in-context learning that needs no additional training or fine-tuning.The survey also describes LLM-based wireless-symbol demodulation [139], which surpassed traditional DNN approaches and produced confident predictions with calibration.Source: 1) Network intrusion/threat detection · pp. 19–20, Figure 7 · p. 20
  • On a real network intrusion-detection dataset, GPT-4 achieved over 90% improvement in testing accuracy and F1-score, exceeding 95% on various attack types using only 10 in-context learning examples.PLLM-CS attained 100% accuracy on UNSW NB 15; IoT-based traffic datasets including UNSW NB 15 and TON IoT were used to train the model.Source: 1) Network intrusion/threat detection · pp. 19–20

2) Network analysis and forecasting:

  • Mobile-LLaMA supports 5G packet, IP-routing, and performance analysis, while TimesLM enables zero- and few-shot time-series analytics and improves accuracy and latency in real-world applications.LLMs are also presented as an alternative for forecasting VNF resource consumption from real-world data.Source: 2) Network analysis and forecasting · p. 20

B. LLM for AI-powered Network Planning

  • For mobile-network planning, LLMs can translate high-level intents into network configurations and policies, addressing adaptation, complexity, scaling, and manual-work challenges.Intent-based networking lets operators specify objectives such as minimizing latency or maximizing bandwidth, with the network autonomously configuring and reconfiguring to meet them.Source: B. LLM for AI-powered Network Planning · p. 20

1) Intent-based networking:

  • LLM-based intent networking translates natural-language objectives into executable policies, supports user-facing intent interactions, and can incorporate deployment descriptors into configuration files.Examples include chatbot interfaces, custom 5G-and-beyond intent models, modular configuration frameworks, and multimodal management for 6G.Source: 1) Intent-based networking · pp. 20–21

2) Network configuration management:

C. LLM for Network Deployment and Distribution

  • LLMs are proposed for network deployment and distribution using real-time and historical data to select configurations, allocate resources, and scale infrastructure as traffic and service demands change.The survey highlights mobile network deployment, telecom tasks, and assistance with DRL decision selection as focus areas.Source: C. LLM for Network Deployment and… · p. 21

1) Network deployment/development:

The survey describes LLM use in mobile-network deployment and telecom tasks, assistance for DRL decisions, and continuous network support. Reported examples span coverage optimization, telecom-specific models, slicing and power control, and spectrum sensing.

1) Network deployment/development:

  • LLM-assisted urban deployment models [126] achieved superior or comparable performance to CNN-based models while an RL agent searched for network parameters maximizing coverage.Other deployment examples include base-station siting [145] and LLM-assisted code refactoring and validation for wireless hardware development [146].Source: 1) Network deployment/development · pp. 21–22

2) Telecom task execution:

  • TelecomGPT adapts general-purpose LLMs through continual pre-training, instruction tuning, and alignment tuning, and outperformed GPT-4 and LLaMA-3 on telecom benchmarks.Tele-LLMs and Tele-Eval target domain-specific telecom question answering [147], while TeleRoBERTa supports 3GPP-standards question answering and CommLLM combines retrieval, planning, and evaluation for communication tasks.Source: 1) Network deployment/development · p. 22, Figure 9 · p. 22, 2) Telecom task execution · p. 22

3) DRL decision selection assistance:

  • LLMs assist DRL decision selection by adding contextual insights; examples include explaining 6G slicing decisions and selecting and weighting specialized DRL experts.The cited MoE approach was evaluated on maze navigation and network-service-provider utility maximization tasks.Source: 3) DRL decision selection assistance · p. 22

D. LLM for Continuous Network Support

  • For continuous support, LLMs are presented as tools for real-time resource adjustment, proactive reconfiguration, and anticipating traffic imbalances to maintain service quality and continuity.The survey links these capabilities to adapting mobile and IoT networks to changing demands.Source: D. LLM for Continuous Network Support · pp. 22–24

1) Network optimization and management:

  • WirelessAgent [149] manages slice resources from user intent, while an LLM in-context power-control method [150] performed on par with conventional DRL techniques.The surveyed slicing framework [129] translates user intent into technical requirements and maps network functions across administrative domains.Source: 1) Network optimization and management · p. 24

2) Network intelligence and control:

  • WirelessLLM organizes network intelligence around knowledge alignment, fusion, and evolution, and illustrates prompt engineering for spectrum sensing.The survey also notes LLM applications to control in integrated terrestrial and non-terrestrial 6G networks.Source: 2) Network intelligence and control · p. 24, Figure 10 · p. 24

V. LLM FOR VEHICULAR NETWORKS-BASED NSM

The survey reviews LLM-based NSM in vehicular networks, where network-level work remains limited relative to application-level uses. It covers monitoring and reporting alongside traffic prediction, including intrusion detection approaches for vehicle and network traffic.

V. LLM FOR VEHICULAR NETWORKS-BASED NSM

  • Most surveyed vehicular LLM applications operate at the application level, while fewer works address network-level monitoring, planning, deployment, and continuous support.The section surveys vehicular networks spanning vehicle, roadside, cellular, and cloud components and their V2X communications.Source: §V · pp. 24–25

A. LLM for Network Monitoring and Reporting

  • A masked-language CAN approach [165] trains on normal CAN-ID sequences and flags sequences when masked IDs cannot be recovered; it outperformed AutoEncoders and PCA by F1 score.CAN-LLAMA2 [161] outperformed existing benchmarks while trained on 10% of the data, and a bidirectional GPT approach improved true-positive rate and F-measure.Source: A. LLM for Network Monitoring and… · p. 26
  • IoV-BERT-IDS converts network traffic into byte sequences and outperformed traditional IDS approaches; a collaborative threat-data framework adds local differential privacy before sharing.The collaborative framework fine-tuned Qwen2-1.5B-Instruct for threat detection using CSE-CIC-IDS-2018 data.Source: A. LLM for Network Monitoring and… · pp. 26–27
  • MistralBSM [87] runs a quantized, fine-tuned Mistral-7B at edge RSUs to classify vehicle safety messages and outperformed LLAMA2-7B and RoBERTa on the VeReMi dataset.CANBERT learns CAN syntax before fine-tuning for intrusion classification and outperformed conventional ML techniques.Source: A. LLM for Network Monitoring and… · pp. 25, 27

1) Network traffic prediction:

  • TrafficLLM [170] uses GPT-4 in-context learning without parameter fine-tuning and outperformed LSTM-based methods and base GPT-3.5 on V2I traffic prediction.It prompts with historical traffic data and uses self-refinement through feedback.Source: 1) Network traffic prediction · pp. 27–28

B. LLM for AI-powered Network Planning

The survey reviews LLM applications in vehicular network planning and related deployment and support tasks. The examples span intent translation, network configuration, resource allocation, node placement, and refinement using feedback.

1) Intent-based communications:

  • The MAIN architecture uses an LLM-powered knowledge-learning module to translate mission intents into tasks across space, air, and ground agents, but remains conceptual.Its use case concerns task-driven satellite-UAV-ship networking.Source: 1) Intent-based communications · p. 28

2) Network nonfiguration:

  • For 6G IoV networks, an LLM maps channel, vehicle, and environmental data to RIS resource configurations, including RB allocation and signal decoding order.The work reports system sum-rate analysis across vehicular environments but does not specify the LLM model or training.Source: 2) Network nonfiguration · p. 28

C. LLM for Network Deployment and Distribution

  • Vehicular network deployment and distribution include allocating resources and placing infrastructure nodes to improve coverage, reduce latency, and use resources effectively.The survey frames LLMs as adaptive methods for analyzing real-time data in these tasks.Source: C. LLM for Network Deployment and… · p. 28

1) Resource allocation:

  • A GPT-based DRL method uses auction attributes to guide Vehicle Twin migration between RSU-based providers, with simulated social-welfare results outperforming existing methods [182].A separate LLM-plus-DDQN method uses LLM-generated driving decisions in simulated V2I scenarios; LLM-enabled graph methods recommend UAV trajectories and resource allocations, but their analysis focuses on the graph-to-text encoder [183], [184].Source: 1) Resource allocation · p. 29

2) Node placement:

  • For UAV placement, GPT-4-turbo prompt-based optimization uses prior coordinates and scores, while LEDMA uses GPT-3.5-Turbo as a search operator for multi-objective deployment and power control [185], [186].The studies assess data-rate scores and Hypervolume, respectively.Source: 2) Node placement · p. 31

D. LLM for Continuous Network Support

  • The survey identifies feedback-based refinement as a way to adapt vehicular-network LLMs over time, noting that only a few reviewed works use refinement strategies.The stated motivation is to improve performance as network conditions change.Source: D. LLM for Continuous Network Support · p. 31

1) Adaptive network traffic prediction:

The survey reviews feedback-based traffic prediction and LLM applications in cloud monitoring and reporting, including incident root-cause analysis and anomaly detection. It describes reported benefits alongside limitations involving data access, evaluation, feedback, and computational cost.

1) Adaptive network traffic prediction:

  • TrafficLLM [170] iteratively refines wireless traffic predictions using feedback on prediction performance and format, significantly outperforming base GPT-4 on MSE/MAE.The method is designed for dynamic 6G networks and receives feedback after its initial prediction.Source: 1) Adaptive network traffic prediction · p. 31

2) Adaptive resource allocation:

  • For adaptive UAV networking, iterative graph-to-text transformations use updated network data to refine trajectory and resource-allocation predictions [184].The survey describes this as supporting adjustments to changing conditions.Source: 2) Adaptive resource allocation · p. 31

VI. LLM FOR CLOUD-BASED NSM

  • The cloud-based NSM review organizes LLM applications into monitoring and reporting, AI-powered planning, deployment and distribution, and continuous support.It presents these categories as an overview of LLM use across cloud network management.Source: §VI · p. 31

A. LLM for Network Monitoring and Reporting

  • Cloud monitoring and reporting covers root-cause analysis, anomaly detection, and network-load analysis, as well as natural-language reports that turn complex data into actionable insights.The survey frames these applications as processing real-time network data for issue identification and decision-making.Source: A. LLM for Network Monitoring and… · p. 31

1) Root cause analysis:

  • Cloud incident studies use lifecycle context for root-cause and SLO analysis, calibrated confidence estimation for LLM analyses, and ReAct with retrieval and chain-of-thought.The confidence-estimation study reports superior reliability and accuracy across evaluation metrics; the ReAct study reports effectiveness against retrieval and chain-of-thought baselines. RCACopilot is also evaluated with F1-score and inference time.Source: 1) Root cause analysis · p. 32
  • Cloud root-cause studies are constrained by limited dataset availability and lack clear analysis of inference overhead or LLM-generated resolutions.The survey identifies these as gaps across the reviewed works.Source: 1) Root cause analysis · p. 33

2) Anomaly detection:

  • MonitorAssistant combines configuration recommendations, alert generation, and feedback for cloud anomaly detection, while another fine-tuning approach lacks comprehensive evaluation.MonitorAssistant was deployed in Microsoft cloud services, but its dataset and source code are not provided.Source: 2) Anomaly detection · p. 33
  • BERT consistently outperformed other models on precision, recall, and F1 in CloudLab log anomaly tasks, while reviewed systems face limited setup details, costly similarity scoring, and challenges with new metrics.The survey also notes dependence on manual feedback and potential difficulty with real-time processing and generalization across metrics.Source: 2) Anomaly detection · p. 33

3) Vulnerability detection & analysis:

The survey covers cloud vulnerability analysis, intent-based network planning, and incident mitigation with LLMs. It reports a vulnerability-detection result and describes intent-handling approaches and research limitations, including gaps in evaluation and reproducibility.

3) Vulnerability detection & analysis:

  • LLM-CloudSec combines RAG and CWE-based detection and analysis, achieving over 70% accuracy across 60 CWE vulnerability types on Juliet and D2A datasets.The work also reports detailed analysis and vulnerability localization; its scope is code-based and may face challenges with incomplete or ambiguous snippets.Source: 3) Vulnerability detection & analysis · pp. 33–34

B. LLM for AI-powered Network Planning

1) Intent-based network management:

  • A multi-domain intent handler decomposes natural-language intents, translates them into infrastructure-level intents, negotiates unmet requirements, activates agreed actions, and assures operational alignment,.The few-shot and in-context framework incorporates human feedback into its knowledge base; real-world evaluations report a 4.5 average rating for decomposition and above 3.5 for translation, with accurate NSD generation.Source: 1) Intent-based network management · p. 34
  • Intent-based network management proposals include works without formal evaluation, while the survey notes gaps in feasibility testing, dataset availability, computing power, and interoperability standards, [204].The survey states that network control investigation lacked a proper testing or simulation environment at the time of writing.Source: 1) Intent-based network management · pp. 34–35

2) Cloud incident mitigation:

  • Cloud incident mitigation research includes fine-tuned models trained on 57,520 root causes and 8,300 mitigations, with GPT-3.x outperforming baselines on most metrics and Code-Davinci-002 leading in correctness and readability.The dataset is not shared, limiting reproducibility; a separate proposal outlines iterative prediction, risk assessment, and confidence measures but provides no formal architecture or evaluation results.Source: 2) Cloud incident mitigation · p. 35

3) Security enhancement:

The survey describes LLM applications across cloud network security, intent-based deployment, dynamic service placement, and adaptive load balancing. These approaches automate policy handling and network configuration, while validation, scalability, and real-time adaptability remain challenges.

3) Security enhancement:

  • Hackphyr is a locally fine-tuned 7-billion-parameter red-team agent; GPT-4 outperformed the other models, while all agents degraded on three-subnet scenarios, where GPT-4’s win rate fell 20%.Hackphyr performed robustly in the small and full scenarios, outperforming other LLM agents.Source: 3) Security enhancement · pp. 35–36

C. LLM for Network Deployment and Distribution

  • LLMs can translate high-level business objectives into network configurations and distribute services across cloud and edge environments, reducing manual intervention and misconfiguration risk.The survey identifies this as a network deployment and distribution application.Source: C. LLM for Network Deployment and… · p. 36

1) Intent-based network deployment:

  • Emergence translates user intents into executable policies through intent classification, progressive policy generation, and validation before deployment.Its policy model represents actions, constraints, and metadata, then converts them into APIs for execution.Source: 1) Intent-based network deployment · p. 36

2) Dynamic service placement:

  • ECO-LLM adapts edge-cloud microservice placement to workload demand, matching manual workload-threshold detection and differing by at most 1.45% in placement accuracy across two days.It supports natural-language customization and automatic code generation for task placement.Source: 2) Dynamic service placement · p. 37

3) Adaptive load balancing:

  • LLM integration is proposed for cloud load balancing to improve real-time processing, predictive analytics, and workload distribution beyond static configurations and limited metrics.The cited work presents this as a way to improve performance, scalability, and resource utilization.Source: 3) Adaptive load balancing · p. 37

D. LLM for Continuous Network Support

The section surveys LLM-supported network configuration, infrastructure repair, and fog/edge management. Reported approaches include a semantic digital twin, code-repair pipelines, and edge-focused optimization, alongside concerns about hallucinations, computational demands, and deployment security.

1) Network topology design and optimization:

  • LLM-Twin uses a semantic representation of network components, protocols, and performance metrics; against federated-learning digital twins, it requires less computation and achieves better communication efficiency.The evaluation used a fine-tuned LLaMA 7B model in a smart-home digital-twin case study.Source: 1) Network topology design and… · pp. 37–38

2) Infrastructure-as-code reparation & security mitigations:

  • GPT-4 fixed 18–34% more Terraform misconfigurations than GPT-3.5 in the first pass and up to 57% more in the second, but 20.4% of generated outputs were invalid or hallucinated.The process uses scanner-identified issues, code blocks, structured prompts, and a second pass for unresolved issues.Source: 2) Infrastructure-as-code reparation &… · p. 38
  • ADARMA combines microservice anomaly detection, LLM root-cause analysis, and generated countermeasures; fine-tuned playbooks reached 95.83% remediation correctness, and the system achieved 96% accuracy in anomaly detection and root-cause analysis.The evaluation injected anomalies in Kubernetes environments.Source: 2) Infrastructure-as-code reparation &… · p. 38

VII. LLM FOR FOG/EDGE-BASED NSM

  • Fog and edge networks bring computation and storage closer to users, and the survey organizes their LLM-management literature around monitoring, planning, deployment, and continuous support.The section identifies resource allocation, security, and fault management as areas of application.Source: §VII · p. 40

A. LLM for Network Monitoring and Reporting

  • Edge/fog monitoring covers device and service health, resource availability, issue detection, cause analysis, and resource consumption, but network complexity and task diversity make it challenging.Source: A. LLM for Network Monitoring and… · p. 40

1) LLM for network optimization:

  • NetLLM uses task-specific encoder modules with Llama2-7B for viewport prediction, adaptive bitrate streaming, and cluster-job scheduling; networking heads reduce fine-tuning costs and mitigate hallucinations.The section also describes ECO-LLM as dynamically adjusting edge or cloud microservice placement based on latency, workload, and task performance.Source: 1) LLM for network optimization · p. 40

2) Security of LLM in Edge Networks:

  • Edge deployment can keep sensitive data on-device, but LLM architecture confidentiality also matters; a non-intrusive fingerprinting method identifies architecture using runtime system information, especially RAM usage.A separate framework learns device-characterizing embeddings directly from raw IoT text.Source: 2) Security of LLM in Edge Networks · p. 40

B. LLM for AI-powered Network Planning

The survey reviews LLM planning and deployment approaches for edge and fog environments, where limited memory and computation constrain deployment. It also covers data generation, configuration automation, model interpretability, and resource-efficient continuous support.

B. LLM for AI-powered Network Planning

1) Optimization of LLM deployment:

  • Edge-deployment strategies include INT4 quantization, memory and software optimization, batching, teacher-to-student knowledge transfer, caching, and distributing model shards across edge and cloud devices.The distributed approaches schedule inference across devices; one incorporates renewable energy to support continuous inference.Source: 1) Optimization of LLM deployment · pp. 40–41

2) Data generation:

  • GenG combines Cog-LLM self-training on selected unlabeled documents with Gen-LM time-series generation, linked through a diffusion model.Source: 2) Data generation · p. 41

C. LLM for Network Deployment and Distribution

  • For edge/fog deployment and configuration management, the survey presents LLMs as a means to improve automation, adaptability, and efficiency while positioning resources nearer to end users.The stated aims include lower latency, data privacy, and QoS optimization.Source: C. LLM for Network Deployment and… · p. 41

1) LLM for network deployment:

  • LLM-based approaches translate natural-language intents into Network Service Descriptors, suggest fixes to Ansible scripts, and use RAG and chain-of-thought techniques to refine microservice-deployment code [103],,.Source: 1) LLM for network deployment · p. 43

2) LLM for model interpretability in edge networks:

  • XDELTA uses an LLM layer to explain differences in feature representation and accuracy between high-accuracy base models and computationally efficient edge models [110].The explanations are intended to be readable and help practitioners assess edge-model adaptations.Source: 2) LLM for model interpretability in… · p. 43

D. LLM for Continuous Network Support

1) LLM optimization:

  • EDGE-LLM reduces redundancy through compression and skip connections, combines exit-layer predictions by voting, and recommends scheduling and offloading for inference throughput; SpeziLLM places execution near users in decentralized fog settings, [231].Knowledge Pruning is another approach described for removing unnecessary knowledge while keeping computational costs low [230].Source: 1) LLM optimization · p. 43

2) Edge computing security:

The section reviews LLM applications in edge security and fault-tolerance management, then outlines challenges for deploying LLMs across communication-network domains. These include cross-domain adaptation, resource and latency constraints, evaluation, and security and privacy.

2) Edge computing security:

  • Edge security work uses local ML analysis of logs for real-time responses, a centralized LLM threat-intelligence server, and LLM honeypots that simulate Linux access to mislead attackers.ShelLM is a fine-tuned open-source framework that allows an LLM to run as a Linux shell.Source: 2) Edge computing security · p. 43

3) Fault tolerance management:

  • LLM variants can act as automated schedulers overseeing fault-tolerance models, using fault indicators and current conditions such as congestion and link interruptions to detect, diagnose, and recover faults.Source: 3) Fault tolerance management · p. 43

A. Challenges and Open Issues

  • Cross-domain LLM adaptation remains open because network data, protocols, and constraints differ, while building domain-specific models from scratch requires costly data collection, pre-training, and fine-tuning.The passage notes that a mobile-network model trained on 5G data improved IP-routing analysis, but adapting it to vehicular or cloud environments is challenging.Source: A. Challenges and Open Issues · p. 44
  • LLM training and inference demand substantial compute and energy, straining battery-limited devices and resource-constrained fog or edge deployments; LoRA can reduce overhead but is not widely adopted for communication NSM.Source: A. Challenges and Open Issues · p. 44
  • Real-time NSM is constrained by large-model latency, limited edge and fog hardware, preprocessing bottlenecks, and batch-oriented inference; quantization speeds inference but raises an accuracy trade-off.The passages note that vehicular tasks may require substantial image and video data, complicating prioritization and speed.Source: A. Challenges and Open Issues · pp. 44–45
  • Evaluation lacks standardized benchmarks because domains require different metrics, and BLEU and ROUGE are not tailored to NSM tasks such as resource allocation and anomaly detection.The survey calls for cross-domain benchmarks and metrics for bias, fairness, and explainability.Source: A. Challenges and Open Issues · p. 45
  • LLM security and privacy remain open concerns: adversarial inputs can disrupt NSM decisions, sensitive or partially released datasets face exposure, and distributed deployments complicate consistent protection.Fog and edge processing can increase exposure where devices have weaker security protocols; scalable, lightweight security frameworks remain an open issue.Source: A. Challenges and Open Issues · pp. 45–46

B. Future Research Directions

The survey proposes directions for adapting LLMs across network domains, reducing resource demands, improving real-time inference, standardizing evaluation, and strengthening security and privacy. It concludes that adaptable, robust, and energy-efficient solutions are needed for communication NSM.

B. Future Research Directions

  • Cross-domain LLMs could use modular, mixture-of-experts architectures alongside transfer or meta-learning and parameter-efficient fine-tuning to share knowledge while retaining domain-specific adaptations.The proposed modules could be tailored to tasks such as vehicular routing or edge energy-efficient scheduling.Source: B. Future Research Directions · p. 46
  • Resource-efficient deployment directions include lightweight models, local processing of initial layers with offloading, distributed workloads, and techniques such as quantization-aware training, low-rank approximations, and distillation.The survey emphasizes balancing resource efficiency with model accuracy, particularly for latency-sensitive tasks.Source: B. Future Research Directions · p. 46
  • Real-time inference research could prioritize urgent tasks through asynchronous pipelines, provide approximate results quickly and refine them later, and tailor compression and hardware acceleration to NSM applications.Source: B. Future Research Directions · p. 46
  • The survey calls for comprehensive, standardized benchmarks combining general metrics with domain-specific measures and simulation environments that assess LLMs under varied network conditions.Source: B. Future Research Directions · p. 46
  • Security directions include adversarial training and robustness evaluation, privacy-preserving federated learning and cryptography, distributed security standards, and responsible-AI frameworks.The proposed federated setup uses fog nodes as clients whose model weights are aggregated on a central server.Source: B. Future Research Directions · pp. 46–47

IX. CONCLUSION

  • The survey synthesizes LLM fundamentals, a four-part NSM application taxonomy, domain-specific work, challenges, and future directions toward adaptable, robust, and energy-efficient solutions.Its conclusion anticipates opportunities for smarter, more resilient network ecosystems.Source: §IX · p. 47

Related papers

Loading 2412.19823v1…