# Machine-Learning-Enabled Intrusion Detection System for Cellular Connected UAV Networks
## 3 System Model
### Intrusion Detection System  
Using IDS has several benefits, including attack detection and protection against violations, and recording existing threats to protect satellite networks. Moreover, it acts as high-quality control for safe format and administration, furnishes useful records about intrusions that occur. There are two main approaches to detect the intrusion, and they are based on signature and statistical anomaly as shown in Figure 10. The signature-based IDS is able to evaluate the data traffic in the behavior of signature, known identity, or patterns that have similarity with existing signatures. There are many definite and distinguished signatures, which are known for attackers; thus this method can broadly be applied. The statistical anomaly-based technique can be applied for new kinds of attacks; thus much greater overhead and processing capability is required in comparison to the signature-based approach. However, the anomaly-based technique defines and characterizes accurate static form and ideal dynamic behavior of the system. It is popular among researchers due to its potential in detecting new types of attacks efficiently. Basically, there are three types of IDS, and they are classified as network-based, host-based, and application-based.  
The network- based IDS (NIDS) can reside on computer or appliances, which are connected to a segment of an organization's network and search for attack patterns when examining packets. Another advantage of NIDS is that it can be installed at a specific place, where it controls incoming and outgoing traffic. The Host-based IDS (HIDS) detects those types of attacks where the intruder creates, modifies, or eliminates the authentic system files or log files. In comparison to NIDS, it can usually be installed at any place, so it provides encrypted information access when transmitting over the network. Application-based IDS (AppIDS) investigated applications consisting of database management systems, content management systems, and accounting systems for abnormal events. In addition, AppIDS can be designed to block requests such as file system, network, configuration and execution space. One of the significant advantages of AppIDS is that it can interact with users and applications as well as operate on incoming encrypted data.  
In this paper, we use network-based anomaly detection techniques to detect any new types of intrusion in the UAV networks. The UAVs fly in groups and communicate with each other by sharing critical information such as route information, traffic payload (such as multimedia and images), command and control information, and location information. As a result, it is critical to protect these information exchanges against malicious attackers by using IDS, who might try to leverage the vulnerabilities of wireless networks to disrupt the UAV operations. The anomaly-based technique used in this paper is an attempt to detect all the malicious traffics that harm the networks as well as the UAVs as early as possible to decrease the number of adverse effects. In the next section, we discuss the different types of machine learning techniques to detect various types of attacks in UAV system.