# XAI-Based Framework for Protocol Anomaly Classification and Identification to 6G NTNs with Drones
## 2 Related Work

Table 1: Related work of baseline and rule detection methods. explained through easily understandable proxy models, and the quantitative contributions of different inputs to the outputs are provided. A similar local rule-based explanations (LORE) approach was introduced in 2018. To improve the precision of the LIME approach, the high-precision model-agnostic explanations (Anchors) method was proposed in 2018. To further enhance the theoretical foundation of this approach, the Shapley additive explanations (SHAP) framework was designed in 2017, and an additive explanation model was used to determine the contributions of the inputs to the outputs. With respect to CNN models, class activation mapping (CAM) and gradient-weighted class activation mapping (Grad-CAM) were introduced in 2016 and 2019, respectively. In these methods, information from the last convolutional layer and gradients are utilized to highlight critical image areas using heatmaps, which can analyze 6G signal data or detect anomalous regions in drone images. These XAI frameworks offer explanations through proxy models, which map rules from inputs to outputs and quantify the contributions of inputs to outputs, as these proxy models and rules derived from DL models can provide consistent predictions and judgments, which is essential for protocol anomaly detection of the 6G NTN. These explanation capacities are useful in DL-based anomaly detection. To improve the transparency and trustworthiness of DL-based anomaly detection methods, research on XAI frameworks and heuristic methods applied in anomaly detection has been performed, which can help classify uncovered protocol attacks; however, these frameworks have difficulty identifying anomalous protocol sequences. The detection results can be explained by XAI methods to quantify the contributions of the inputs to the detection results. The LIME and SHAP frameworks have been deployed to analyze DNN-based [47] and LSTM network-based [48] anomaly detection models. The anomaly detection results of CNN-based models can be explained by the Grad-CAM framework [49]. In addition to XAI frameworks, heuristic adversarial-based [50] explanation methods have been developed to explain DNN-based anomaly detection results. These explanation methods were designed by combining approximate historical inputs, weighted random sampling, feature groups, and sparse group lasso methods to interpret the results of four DL-NIDS models, including the Kitsune, ODDS, RNN-IDS, and AE-IDS models [51]. These studies have provided the quantitative contributions of the inputs to the outputs, reflecting the degree of deviation. However, the use of quantitative contributions to extract the fingerprint features of uncovered protocol attacks and classify these attacks remains challenging. Explanations of the detection results are used to enhance the detection scheme of anomaly detection methods. With the quantified contributions of the inputs to the detection results, the fingerprint features are obtained for use in the detection scheme. Random forest-based anomaly detection results can be interpreted via SHAP frameworks, which provide fingerprint features of intrusion traffic [52], and SVM-based anomaly detection results can be interpreted by the LIME framework, which provides fingerprint features of normal traffic patterns [53]. The fingerprint features representing the contributions of the inputs to the detection results are thus obtained. With these explanations, feature-matching detection strategies are designed and applied in conjunction with DL models to reduce the anomaly detection time, where merely the features affected by the anomalies are processed to reduce the volume of processed data [52; 53]. However, using fingerprint features to classify uncovered protocol attacks remains challenging. Explanation of the detection model for optimization. BD-GNNExplainer can be used to interpret GNN-based anomaly detection results to evaluate the detection performance and interpretability of models with different layers and configurations.