# XAI-Based Framework for Protocol Anomaly Classification and Identification to 6G NTNs with Drones
## 7 Simulation Results  
The efficiency of the proposed XAI-based detection framework for 6G NTN drones is validated from two aspects: the self-evolving classification of uncovered attacks and the online identification of anomalous protocol sequences.  
The protocol data for simulation include the data for the UPF DoS case proposed in Section 3 and the open-source dataset CICIDS2017, as described in Table 3.  
The attack protocol data in the attack cases described in Section 3 are collected, which will be used to validate the designed methods. Thus, an experimental platform is established on one x86 computer with a simulated UE, a simulated RAN, and a 5G CN running on two virtual machines. One virtual machine hosts the simulated UE and RAN via UERANSIM, whereas the other is used to run the 5G CN using Open5 GS software v2.6.4. We assume that the gNB is intruded and that the attacker delivers the MitM relay tool to the intruded gNB. The air interface between the MitM relay and the gNB is omitted. Then, the UPF DoS attack, protocol sequence tampering, and a normal case are implemented on the simulation platform. During the implementation of the three threat cases, the protocol data of the Ng interface are collected to verify the effectiveness of the proposed methods. The parameters are provided in Table 4, where \(n_{\text{UE}}^{\text{no}}\), \(n_{\text{UE}}^{\text{at}}\), \(n_{\text{CN}}\) and \(n_{\text{gNB}}\) represent the numbers of normal users, attacker users, CNs and BSs, respectively. To ensure that the input data are balanced, the undersampling method randomly selects an equal number of data samples from each case. More than 3,000,000 labeled flows are collected from the Ng interface via Wireshark, consisting of normal traffic data (806,205), UPF DoS data  
\begin{table}
\begin{tabular}{c c c c c c} \hline \hline \multicolumn{1}{c}{**Data**} & **Roles** & **Features** & **Source** & **Scale** \\ \hline \multirow{2}{*}{CICIDS 2017} & BENIGN & Normal behavior & \multirow{2}{*}{78 features [68]} & Open-source & 150,000 \\ \cline{2-5}  & DoS & Covered attack & & Open-source & 70,000 \\ \hline \multirow{2}{*}{UPF DoS} & Uncovered attack & \multirow{2}{*}{} & Collected & 33,494 \\ \cline{2-5}  & & & & \\ \end{tabular}
\end{table}
Table 3: Simulation data.  
(1,595,999), hijack UE capacity data (6404), and sequence number desynchronization data (4384). With these data, the proposed methods are validated in Sections 7.1 and 7.2  
This article evaluates the self-evolving classification and the online identification methods with the basic metrics, including the accuracy (denoted \(r_{\text{ACC}}\)), precision (denoted \(r_{\text{PRE}}\)), recall (denoted \(r_{\text{RE}}\)), and F1 score (denoted \(r_{\text{F1}}\)), which are formulated as  
\[r_{\text{ACC}}=\frac{n_{\text{TP}}+n_{\text{TN}}}{n_{\text{TP}}+n_{\text{TN}} +n_{\text{FP}}+n_{\text{FN}}},\ r_{\text{PRE}}=\frac{n_{\text{TP}}}{n_{\text{TP }}+n_{\text{FP}}},\ r_{\text{RE}}=\frac{n_{\text{TP}}}{n_{\text{TP}}+n_{\text{ FN}}},\ r_{\text{F1}}=\frac{2r_{\text{PRE}}r_{\text{RE}}}{r_{\text{PRE}}+r_{ \text{RE}}}, \tag{9}\]  
where the numbers of true positives, false positives, true negatives, and false negatives are denoted \(n_{\text{TP}}\), \(n_{\text{FP}}\), \(n_{\text{TN}}\), and \(n_{\text{FN}}\), respectively.