# XAI-Based Framework for Protocol Anomaly Classification and Identification to 6G NTNs with Drones
## 3 Threat Model
### Protocol Tampering
#### 3.2.2 Sequence Number Desynchronization  
As with the other attack cases involving protocol tampering, sequence number desynchronization [67] involves exploiting vulnerabilities in the synchronization mechanism between the UE and 6G NTNs. To prevent replay during the registration procedure, the UE and 6G networks are synchronized by storing NAS counters for sending and receiving at the UE and AMF ends. An NAS counter is a 24-bit unsigned integer composed of a 16-bit overflow counter (oc) concatenated with an 8-bit sequence number (seq). The stored sequence numbers are denoted \(\mathrm{seq}_{\mathrm{ul}}^{\mathrm{UE}}\), \(\mathrm{seq}_{\mathrm{dl}}^{\mathrm{UE}}\), \(\mathrm{seq}_{\mathrm{ul}}^{\mathrm{AMF}}\), and \(\mathrm{seq}_{\mathrm{dl}}^{\mathrm{AMF}}\), indicating the numbers of uplink (ul) and downlink (dl) protocol messages at the ends of the UE and AMF. \(\mathrm{seq}_{\mathrm{ul}}^{\mathrm{UE}}\) and \(\mathrm{seq}_{\mathrm{dl}}^{\mathrm{AMF}}\) are local parameters obtained by counting the messages sent by the UE and AMF, respectively, and \(\mathrm{seq}_{\mathrm{dl}}^{\mathrm{UE}}\) and \(\mathrm{seq}_{\mathrm{ul}}^{\mathrm{AMF}}\) are the network parameters obtained via the received message at the UE and AMF ends, respectively. There is a vulnerability in refreshing \(\mathrm{seq}_{\mathrm{dl}}^{\mathrm{UE}}\) and \(\mathrm{seq}_{\mathrm{ul}}^{\mathrm{AMF}}\) with the received \(\mathrm{seq}_{\mathrm{dl}}^{\mathrm{AMF}}\) and \(\mathrm{seq}_{\mathrm{ul}}^{\mathrm{UE}}\) when the sequence number of the newly received message (for example, \(\mathrm{seq}_{\mathrm{dl}}^{\mathrm{AMF}}\)) is less than the sequence number of the last message that was accepted (\(\mathrm{seq}_{\mathrm{dl}}^{\mathrm{UE}}\)). Thus, a MitM relay attack may involve capturing and replaying the Sec_Mode_Command and Sec_Mode_Complete messages with the uplink and downlink sequence numbers being 0, as shown in Figure 5. Sequencenumber desynchronization attacks are performed according to the following four stages, as shown in Figure 5:  
* The adversary forces the victim UE to establish a connection with the MitM relay, and the MitM relay transmits unauthenticated initial broadcast messages at a higher signal strength.
* The MitM relay intercepts both the Sec_Mode_Command and Sec_Mode_Complete messages during the initial registration process.
* The adversary waits to capture and discard the subsequent Sec_Mode_Command and Sec_Mode_Complete messages during the RRC layer key refreshing process and then relays the intercepted Sec_Mode_Command and Sec_Mode_Complete messages and sets them to 0 to pass the integrity verification.
* The locally maintained seq\({}_{\text{dl}}^{\text{UE}}\) and seq\({}_{\text{ul}}^{\text{AMF}}\) are updated to 0 at the AMF, and the UE ends on the basis of the received seq\({}_{\text{dl}}^{\text{AMF}}\) and seq\({}_{\text{ul}}^{\text{UE}}\). Notably, with this attack, the adversary cannot reset the seq\({}_{\text{dl}}^{\text{UE}}\) and seq\({}_{\text{ul}}^{\text{AMF}}\) that are locally maintained by the UE and AMF, respectively.  
With this attack, the adversary can reset seq\({}_{\text{ul}}^{\text{AMF}}\) and seq\({}_{\text{dl}}^{\text{UE}}\), which the AMF and UE maintain remotely. This attack disrupts the connection between the UE and the network, leading to repeated reconnections that can block services and drain the battery. It also risks incurring excessive charges through continuously resending identical data packets.  
Figure 4: Messages involved in hijack UE capability attacks.