# XAI-Based Framework for Protocol Anomaly Classification and Identification to 6G NTNs with Drones
## 1 Introduction
Baseline detection methods, which are trained on attack-free 6G NTN traffic data, can detect deviations from normal behavior and are thus useful for detecting uncovered attacks; however, these methods provide only Boolean results and cannot be used to classify or identify specific anomalous sequences. In recent research, these methods have been designed for unmanned aerial vehicles (UAVs) [23; 24; 25; 26; 27; 28], the internet of unmanned aerial vehicles (IoUAVs) [29; 30; 31], 6G networks [30; 32], internet of thing (IoT) networks [22], and other networks, improving the detection of both covered and uncovered attacks [20; 21; 22; 23; 24; 25; 26; 27; 28; 29; 31; 32] and the classification of known attacks [20; 21; 22; 23; 24; 25; 30; 31; 32]. However, these combined methods still fail in classifying uncovered attacks without new classifications and identifying specific anomalous protocol sequences, focusing instead on Boolean detection and classification labels. The internal information and processes of DL models could be utilized to address these limitations. DL models can capture fingerprint information during the detection process, which is useful in classifying uncovered attacks, but this information is often obscured by the black-box nature of these models and high-dimensional mappings. Similarly, anomalous data captured via baseline detection methods are represented by intermediate features, making tracing these data back to the original protocol sequences difficult. In recent studies, explainable artificial intelligence (XAI) techniques have been used to elucidate the processes underlying DL models, facilitating the extraction and utilization of internal information and processes in DL-based detection methods. The aim of XAI-based anomaly detection research and other communication networks is to make the detection process more transparent, thereby providing more credible results and optimizing accuracy. However, a significant gap remains in applying these explanations for classification and identification, posing substantial challenges. Lack of explainability and collaboration. The objectives of existing interpretable detection methods are to provide credible results and optimize accuracy; however, these methods do not output the internal information of the DL model necessary for classification and identification, hindering the utilization of this information in classifying uncovered attacks and identifying anomalous protocol sequences of 6G NTNs. An explainable detection framework is needed to support the extraction of internal process information during the baseline and rule detection processes for classification and identification. Furthermore, this framework should enable real-time collaboration during the baseline and rule detection processes to ensure that the internal process information can be fully utilized. The key challenges are determining what information from the baseline and rule detection processes should be provided and how this information should be collaboratively utilized by the baseline and rule detection methods to improve classification and identification performance. Extracting and improving black-box models with internal information. While baseline detection methods primarily provide Boolean outputs, they also capture deviations from normal behavior; these deviations contain critical fingerprint features of uncovered attacks but are not explicitly output. In DL-based rule detection methods, new classifications are established by retraining the model on the basis of new data to extract these fingerprint features, but this process can introduce delays in both training and deployment. The key challenges are determining how to extract internal fingerprint features from black-box baseline detection methods and how to establish a new online rule detection classification of 6G NTNs using the external fingerprint features captured during the baseline detection process. Capturing original anomalous protocol sequences in the internal irreversible mapping process.