# XAI-Based Framework for Protocol Anomaly Classification and Identification to 6G NTNs with Drones
## 1 Introduction  
Nonterrestrial networks (NTNs) for sixth-generation (6G) systems are becoming increasingly popular owing to their comprehensive coverage, mobility, and resilience to severe natural disasters [1]. With the rapid advancement of drones and cost-effective low-altitude platform aerial vehicle manufacturing methods [2], drone swarming has emerged as a promising solution to address various issues for 6G NTNs, enabling information flowthrough interconnections, cooperative control, and resource sharing among base stations (BSs) and core networks (CNs) [3; 4; 5; 6]. Drone swarming techniques for 6G NTNs have been designed for both BSs and CNs in 3 rd generation partnership project (3 GPP) standards and ongoing research. Drone swarming techniques involving BSs in low-altitude airspace, as defined by 3 GPP standards, can be used to forward signals, as shown in Figure 1a, or act as BSs cooperatively, as shown in Figure 1b, thereby achieving continuous ground coverage [7; 8; 9; 10; 11]. Drone swarming techniques involving CNs in low-altitude airspace are still being developed on the basis of 3 GPP standards, with options for deploying some or all functions of CNs through drone swarming [11; 12; 13]. The CNs in 6G NTNs are based on service-based architectures (SBAs) and have multiple network functions (NFs), including the user plane function (UFF) and various control plane NFs, such as the access and mobile management function (AMF). Drone swarming techniques involving CNs can be used to deploy the UPF or AMF, as shown in Figure 1c, or all NFs, as illustrated in Figure 1d. In this type of deployment, low-altitude airspace and ground NFs cooperate to facilitate the transmission of spatial information to ground stations and support the long-range transfer of terminal information, significantly reducing ground transmission latency [14]. 6G NTN with drones will serve as an essential communication infrastructure [15]. The scenarios for 6G NTNs encompass global seamless connectivity, IoT services, emergency communications, disaster recovery, and autonomous driving, which require the available communication service [15; 16; 17]. In 6G NTNs, protocols are crucial for defining communication rules among NFs, ensuring efficient and reliable data transmission. However, low-altitude airspace NFs are particularly vulnerable to malicious protocol traffic from terrestrial user equipment (UE) and NFs in areas with unprotected coverage. This malicious protocol traffic can, for example, infiltrate CNs in low-altitude airspace through drone swarming involving BSs, resulting in paralysis of the entire low-altitude airspace network [5; 18]. To prevent malicious protocol traffic [19; 20; 21], it is essential to detect, classify, and identify protocol attacks. Specifically, detection involves monitoring the presence of protocol attacks in 6G NTNs. Classification involves matching the detected attacks with predefined attack categories, which aids in selecting appropriate prevention strategies. Identification involves determining the anomalous protocol sequences associated with the detected attacks and the targets that must be protected with prevention strategies. Recently, deep learning (DL)-based anomaly detection methods have shown exceptional performance in capturing complex patterns in drone and terrestrial mobile communication networks [22; 23; 24; 25; 26]. These methods can be categorized into rule-based and baseline  
Figure 1: Drone swarming of 6G NTNs. -based detection methods, known as rule detection and baseline et aldetection [24; 25; 26]. In rule detection methods, covered attacks are effectively detected by comparing the attacks with threat features extracted from historical data; however, these methods have difficulty detecting uncovered attacks and identifying anomalous protocol sequences.