## 3 The Proposed SP-IoUAV Model
### Intrusion Detection System (IDS)
#### 3.3.2 Intrusion Detection Engine
The MaxPooling operation picks the largest value inside a particular window, while the Average Pooling operation computes the average value. The MaxPooling procedure can be represented as follows:  
\[y_{ij}=\max(x_{(i+m)(j+n)}) \tag{19}\]  
where \(y_{ij}\) represents the pooled output, and \(x_{(i+m)(j+n)}\) represents the input data in the pooling window. Algorithm 6 summarizes the functionality of CNN in our proposed model. ```
Data: Preprocessed data \(X_{\text{preprocessed}}\) Result: Anomaly Detection using CNN Initialize CNN architecture with convolutional layers, pooling layers, and fully connected layers; Input preprocessed data \(X_{\text{preprocessed}}\) into the CNN; for each Convolutional Layerdo Apply convolution operation using Equation (17); Apply ReLU activation function using Equation (18);

endfor each pooling layerdo Perform pooling operation to reduce spatial dimensions using Equation (19);

end

Flatten the feature maps into a vector; Feed the vector into the fully connected layers for classification; Output the detection results for anomalies; End
```  
**Algorithm 6** Convolutional Neural Network (CNN) Algorithm  
The CNN is largely in charge of recognizing and differentiating anomalies from routine UAV operations. It is particularly good at learning spatial features and patterns from preprocessed data. As a result, by evaluating geographical information, it may detect unexpected or abnormal patterns in data, indicating potential security threats or breaches. * **Long Short-Term Memory (LSTM):** The LSTM is a recurrent neural network (RNN) variant designed to handle sequential data, making it well-suited for time-series analysis and capturing temporal dependencies. It is important in the context of our proposed IDS as it takes detected anomalies from the convolutional neural network (CNN) and classifies them into specific categories or types based on their temporal characteristics. The LSTM is composed of memory cells that accumulate information over time, allowing it to remember and learn patterns that span multiple time steps. Its unique ability to retain long-term dependencies enables it to recognize complex temporal patterns in the sequence of detected anomalies, facilitating accurate anomaly classification. The LSTM computationally processes sequential data by employing a set of gating mechanisms that regulate the flow of information. The input gate, forget gate, and output gate are examples of these mechanisms. The LSTM's cell state stores information over time, while the gates determine how much information is retained or discarded at each time step. The following are the LSTM equations:  
**Input Gate:**  
\[i_{t}=\sigma(W_{xi}\cdot x_{t}+W_{hi}\cdot h_{t-1}+b_{i}) \tag{20}\]
**Forget Gate:**  
\[C=\frac{1}{n-1}\sum_{i=1}^{n}(x_{i}-\bar{x})(x_{i}-\bar{x})^{T} \tag{10}\]0
**Output Gate:**  
\[C=\frac{1}{n-1}\sum_{i=1}^{n}(x_{i}-\bar{x})(x_{i}-\bar{x})^{T} \tag{10}\]1
**Candidate Cell State:**  
\[C=\frac{1}{n-1}\sum_{i=1}^{n}(x_{i}-\bar{x})(x_{i}-\bar{x})^{T} \tag{10}\]2
**Cell State Update:**  
\[C=\frac{1}{n-1}\sum_{i=1}^{n}(x_{i}-\bar{x})(x_{i}-\bar{x})^{T} \tag{10}\]3
**Hidden State Update:**  
\[C=\frac{1}{n-1}\sum_{i=1}^{n}(x_{i}-\bar{x})(x_{i}-\bar{x})^{T} \tag{10}\]4  
where \(x_{t}\) is the input at time step \(t\), \(h_{t}\) is the hidden state at time step \(t\), \(C_{t}\) is the cell state at time step \(t\), \(i_{t}\), \(f_{t}\), and \(o_{t}\) are the input, forget, and output gates' activations at time step \(t\), respectively, \(\bar{C}_{t}\) is the candidate cell state at time step \(t\), \(W\) and \(b\) are weight matrices and bias vectors, and \(\sigma\) is the sigmoid activation function, and \(\odot\) represents element-wise multiplication. Algorithm 7 summarizes the functionality of LSTM in our proposed model.