# XAI-Based Framework for Protocol Anomaly Classification and Identification to 6G NTNs with Drones
## 2 Related Work
Second, these methods fail in identifying specific anomalous protocol sequences, focusing on outputting Boolean detection results and classification labels. The related work of baseline and rule detection methods is summarized in Table 1.  
Several methods have been developed to classify uncovered attacks by establishing new categories through retraining using meta-learning [39] or adding detection conditions inefficiently using tree models [40; 41; 42]. In meta-learning-based anomaly detection methods, models for multiple tasks are iteratively trained to extract attack features continuously, enabling the adaptive classification of uncovered attacks [39]. However, this iterative training process introduces detection delays because of the time consumed during training, which is unacceptable for 6G NTN services owing to their high communication availability requirements [40; 41; 42]. To address this issue, a real-time detection method based on the Hoeffding tree (HT) algorithm has been designed [43]. In this method, a new online branch is added to classify uncovered attacks when the cumulative deviations or other dynamic thresholds are met. This method can establish a new online protocol for attack classification in a 6G NTN. However, simply adding new branches for different detection conditions can degrade the detection performance because of the failure to leverage the precise fingerprint information of uncovered attacks. In fact, the DL model can capture fingerprint information during the baseline and rule detection processes, but this information remains incomprehensible and inaccessible because of the model's black-box nature and high-dimensional mapping. To identify the anomalies of the detected attacks, existing methods have been applied to localize anomalous NFs or communication processes in 5G core networks (5 GCs) on the basis of logs [44]. However, these methods cannot provide the original protocol data at a finer granularity. To solve this problem, the protocol data interaction process between NFs is modeled as a graph to identify paths by which NFs interact with the corresponding anomalous protocol process [45]. However, anomalous protocol sequences or fields cannot be provided. In fact, these anomalous sequences or fields have already been captured and mapped to a high-dimensional space during the internal matching process by the DL-based baseline detection method. However, the captured anomalous protocol data are usually represented by intermediate information, such as instantaneous envelopes and statistical features, rather than the original protocol sequence, and the high-dimensional mapping process is irreversible. To develop more understandable artificial intelligence (AI) models while maintaining high prediction accuracy, XAI technology represents a promising approach for obtaining internal fingerprint information and tracing it back to the original anomalous 6G NTN protocol sequences. Several popular XAI frameworks have been proposed to analyze the activities of DL models [46]. In the local interpretable model-agnostic explanations (LIME) approach, which was introduced in 2016, the local behaviors of AI models are \begin{table}
\begin{tabular}{c c c c c c c} \hline \hline \multirow{2}{*}{**Reference**} & \multirow{2}{*}{**Scenarios**} & \multirow{2}{*}{**Models**} & \multicolumn{3}{c}{**Capabilities**} \\ \cline{3-6}  & [20] & & RNN & & **Detection** & **Classification** & **Identification** \\ \cline{2-6} \multirow{3}{*}{Rule detection} & [21] & UAV & CNN & & & \\ \cline{2-6}  & [22] & & DNN & & & \\ \cline{2-6}  & [24] & IoUAV & CNN & & & \\ \cline{2-6}  & [25] & 6G & RNN & & & \\ \hline \multirow{3}{*}{Baseline detection} & [26] & YOLOv8 & & & & \\ \cline{2-6}  & [27] & UAV & OC-SVM & & & \\ \cline{2-6}  & [28] & & LSTM & & & \\ \cline{2-6}  & [29] & IoUAV & B-LSTM & & & \\ \hline Rule and & [30] & IoUAV & AE and DNN & & & \\ \cline{2-6}  & [31] & UAV & RNN-LSTM & & & \\ \cline{2-6}  & [32] & IoT & CNN-LSTM & & & \\ \hline \hline \end{tabular}
\end{table}