## 5 Experimental Analysis  
### Experiment Set-Up and Dataset Description  
In this work, we used the configuration of a processor consisting of an Intel Core i5-10400 CPU with 16 GB of RAM on a 64 bit operating system. Moreover, we also utilized the Google Colab environment, which gave us an extra 12 GB of RAM for implementation. We used the UAV attack dataset from [14]. The authors of this dataset used the ULOG file format in their research, which was utilized for the saving of flight logs by the autopilot function. Despite the fact that flight logs can have a variety of formats and contain a wide variety of information, standard characteristics are always recorded for post-flight analysis. In our numerical representation, we considered each kind of abnormal behavior, such as jamming and spoofing, which we represented with 1, and normal behaviors were represented by 0. Primarily, we set out to measure the attack segment of our data with the sensor measurements and measurement changes from the dataset through a correlation matrix or linear independence. In this work, we considered a UAM attitude control scenario to train the AI models for determining jamming or spoofing attacks. Figure 3 shows the working principle of the UAM attitude control mechanism with six degrees of freedom through yaw, pitch, and roll. Therefore, we used UAM attitude data that consisted of timestamped parameters, reference points, roll and longitudinal, transverse and pitch, and vertical and yaw motions, reference change, roll change, pitch change, and yaw change. We considered three distinct data for characterizing jamming (_ace-jamming-log_1_2033-8-19-16-46-46_vehicle_attitude_0.csv_), spoofing (_ace-spoofing-hackrf-log_5_2033-8-19-17-14-18_vehicle_attitude_0.csv_), and benign attacks (_ace-benign-log_0_2033-8-19-16-27-30_vehicle_attitude_0.csv_) in the considered dataset [14]. Then, we analyzed the impact of the detected cyber threats on the parameters of the switching state (pxdio) and radio status of the UAVs by using pxdio and radio status data. In particular, we con sidered _ace-spoo fing-hackrf-log_5_2033-8-19-17-14-18_px4 io_status_0.csv_ and _ace-spoo fing-hackrf-log_5_2033-8-19-17-14-18_radio_status_0.csv_ for spoofing, _ace-jamming-log_1_2033-8-19-16-46-46_px4 io_status_0.csv_ and _ace-jamming-log_1_2033-8-19-16-46-46_radio_status_0.csv_ for jamming, and _ace-benign-log_0_2033-8-19-16-27-30_px4 io_status_0.csv_ and _ace-benign-log_0_2033-8-19-16-27-30_radio_status_0.csv_ for benign cases. On the one hand, to find the impact of jamming, spoofing, and benign cases on the switching state (PX4 IO Status), we considered the servo rail voltage in volts and RSSI pin voltage in volts as parameters. On the other hand, the RSSI, remote RSSI, transmit buffer, noise, and remote noise were considered as the parameters for finding the impact of jamming, spoofing, and benign cases on the radio status of a UAV. We illustrate a correlation matrix between attacks and UAM attitude control parameters in Figure 4. Figure 4 shows a strong correlation among attacks and UAM attitude parameters such as yaw (72%), pitch changes (88%), and yaw changes (88%). Figure 4 also demonstrates a roughly 91% negative correlation between spoofing or jamming attacks and the timestamps. In summary, in Figure 4, we found that the attack data had a strong positive correlation with two measurement changes, which were the transverse and roll changes and the vertical and yaw changes, while the attack data had a strong correlation with one sensor measurement: yaw motion. Furthermore, we show the principal component analysis (PCA) of the considered dataset in Figure 5. Figure 5 also provides evidence of the prominent effects of pitch changes, yaw changes, and roll changes on spoofing or jamming attacks. Data preparation is a fundamental prerequisite for training a model, as the amount of training data is typically very high. In our case, we considered 7159 sessions as attacks and 4924 sessions as not attacks.