# XAI-Based Framework for Protocol Anomaly Classification and Identification to 6G NTNs with Drones
## 1 Introduction
During the baseline detection process, deviations between attacks and the baseline process are extracted by DL models from protocol data containing anomalies. To trace these protocol attacks of 6G NTNs back to the original anomalous data points, the deviation capture process must be reversed. However, this process involves high-dimensional abstractions within the black-box DL model, which are not explicitly provided and are challenging to reverse. The protocol sequences must be transformed into images so that deep learning models can process them while ensuring this conversion retains sufficient information for the reverse conversion of the DL model, which needs to be explainable. To address these challenges and enhance the security of 6G NTN protocols, the explanation requirements and applications of classification and identification methods must be explored. Therefore, in this paper, we propose an XAI-based interpretable anomaly classification and identification method for 6G NTN protocols. In the proposed method, the rule and baseline detection processes are elucidated through XAI techniques. These methods operate synergistically to classify uncovered protocol attacks and identify specific anomalous protocol sequences. The contributions of this paper can be summarized as follows:  
* We introduce an interpretable and collaborative detection framework for 6G NTN protocols. This framework analyzes in detail the interpretability demands of baseline and rule detection methods and their collaboration. Result and process explanations for the baseline and rule detection processes are integrated, fostering collaboration between these methods and supporting the classification of attacks and identification of anomalies with robust explanatory and collaborative capabilities. * We design a self-evolving classification method for uncovered protocol attacks within the proposed framework. The rule and baseline detection processes are clarified, enabling synergistic extraction and learning of attack fingerprint features to classify uncovered protocol attacks. * We design an online identification method to detect anomalous protocol sequences within the proposed interpretable framework. In this method, protocol sequences are transformed into images for DL-based detection, ensuring the traceability of the original anomalous protocol sequences after identifying the anomalous image section. To identify the anomalous image section, a two-layer architecture consisting of a prediction model and a detection model is designed, where traditional deep neural network (DNN) convolutions are replaced with exclusive OR (XOR) operations. This enables efficient and synchronized identification and detection of anomalies. Thus, the capturing of original anomalous protocol sequences in the internal irreversible mapping process is achieved. The remainder of this paper is organized as follows. In Section 2, the current research on DL- and XAI-based anomaly detection methods and other communication networks is summarized. In Section 3, the protocol threat models for 6G NTNs and representative attack cases are introduced. In Section 4, the interpretable anomaly detection framework for 6G NTN protocols is designed. With the proposed interpretable framework, a self-evolving classification method for uncovered protocol attacks and an online identification method for anomalous protocol sequences are designed in Sections 5 and 6. In Section 7, the simulation results are discussed, demonstrating the effectiveness of the proposed classification and identification methods. Finally, the conclusions of the paper are presented in Section 8.