XAI-Based Framework for Protocol Anomaly Classification and Identification to 6G NTNs with Drones

Although deep learning (DL) methods are effective for detecting protocol attacks involving drones in sixth-generation (6G) nonterrestrial networks (NTNs), classifying novel attacks and identifying anomalous sequences remain challenging. The internal capture processes and matching results of DL models are useful for addressing these issues. The key challenges involve obtaining this internal information from DL-based anomaly detection methods, using this internal information to establish new classifications for uncovered protocol attacks and tracing the input back to the anomalous protocol sequences. Therefore, in this paper, we propose an interpretable anomaly classification and identification method for 6G NTN protocols. We design an interpretable anomaly detection framework for 6G NTN protocols. In particular, we introduce explainable artificial intelligence (XAI) techniques to obtain internal information, including the matching results and capture process, and design a collaborative approach involving different detection methods to utilize this internal information. We also design a self-evolving classification method for the proposed interpretable framework to classify uncovered protocol attacks. The rule and baseline detection approaches are made transparent and work synergistically to extract and learn from the fingerprint features of the uncovered protocol attacks. Furthermore, we propose an online method to identify anomalous protocol sequences; this intrinsic interpretable identification approach is based on a two-layer deep neural network (DNN) model. The simulation results show that the proposed classification and identification methods can be effectively used to classify uncovered protocol attacks and identify anomalous protocol sequences, with the precision increasing by a maximum of 32.8% and at least 26%, respectively, compared with that of existing methods.