# XAI-Based Framework for Protocol Anomaly Classification and Identification to 6G NTNs with Drones
## 5 Self-Evolving Classification Method
### Baseline Detection with Explainable Results  
The baseline detection method is made transparent on the basis of the explainable results. This method includes the baseline detection model, which matches the detected protocol features with the normal baseline, and an XAI mechanism applied to the detection results, which captures the deviation between the protocol traffic and the baseline, as shown in Figure 7. The baseline detection model is designed on the basis of an AE DL model to form the baseline of normal protocol behavior. With this approach, attacks can be efficiently detected, including uncovered protocol attacks. The SHAP-based XAI mechanism is applied to the detection results to make the baseline detection model transparent; this model provides the quantitative contributions of the protocol features to the detection results. The features with significant contributions are considered fingerprint features. The fingerprint features will be sent to the rule detection process, where attention is adjusted based on their quantitative contributions.  
To obtain the quantitative contributions, the anomalous protocol feature flows detected by the baseline detection model are first consolidated; these flows are referred to as attack flows. The quantitative contributions of each attack flow are obtained, normalized, and fed back into the rule detection model. First, the SHAP model interprets local anomalous protocol data that deviate from the baseline. Then, the quantitative contributions of the features for each attack flow are calculated with the SHAP model. For attack flow \(k\), the quantitative contribution of the \(n\)th feature \(x_{k,n}\) is represented by \(\lambda_{k,n}\), which is given by its Shapley value as follows:  
Figure 7: Self-evolving classification method.  
\[\lambda_{k,n}=\sum_{S\subseteq\frac{X_{k}}{X_{k}}\backslash x_{k,n}}\frac{|S|!(|X_{ k}|-|S|-1)!}{|X_{k}|!}[f(S\cup x_{k,n})-f(S)], \tag{1}\]  
where \(S\) is the set of all the features except the \(n\)th feature. \(|\cdot|\) indicates the number of elements. The function \(f\) represents the prediction probability. Equation (1) provides the marginal contribution, which is the variation in the prediction value of the baseline model when the \(n\)th feature is input. With Equation (1), the quantitative contributions of each feature can be normalized among the attack flows. The contribution of feature \(n\) is calculated as  
\[\lambda_{n}=\mathcal{E}(\lambda_{n,k},k=1,\ldots,K), \tag{2}\]  
where \(\mathcal{E}(\cdot)\) is the expectation function, and \(\lambda_{n}\leq 1\). The contribution values reflect the fingerprint features of the uncovered attacks. Larger positive values indicate that the features significantly deviate from the normal baseline values, whereas larger negative values indicate that the features closely match the normal baseline values. The explanation results of the baseline need to be expressed as feature weights properly to support the adjustment of the rule detection's focus. Thus, the weight of feature \(n\) is denoted \(w_{0,n}\) and is calculated as  
\[w_{0,n}=\left\{\begin{aligned} \frac{1}{\lambda_{n}},& \lambda_{n}{>}0,\\ -\lambda_{n},&\lambda_{n}\leq 0.\end{aligned}\right. \tag{3}\]  
Define the weight set \(w_{0}\). Let \(w_{0}=\{w_{0,n}\}\) with \(w_{0}\in\mathcal{R}^{N}\).  
With Equation (3), it can be seen that the weights are calculated by the contributions. The negative contributions of the features indicate no anomalous trends of those features. Including these contributions will decrease the probability of the classification, where the probability of being the classification is calculated by adding the contributions of the features. For the features indicating no anomalous trends, their contributions are negative. Including these contributions will decrease the probability of the classification. Therefore, the attention of the positive contribution features can be enhanced, and the attention of negative contribution features will be decreased in rule detection.