# Internet of Drones Intrusion Detection Using Deep Learning
## 3 The Proposed Drone Intrusion Detection Framework  
The nature of the UAV network is different from other traditional networks since they have to communicate with the ground base station(s). Moreover, drones move from one place to another, depending on the application. That is why the proposed framework consists of two components, the drone and the base station. In addition, there is no need for different RNN modules where a centralized module is more than enough in traditional networks. On the other hand, the drones' networks might need more than one RNN module, one on the drone itself and another at the base station. The base station module handles all drone traffic and confirms the drone's RNN module's decision.  
This section introduces the proposed distributed framework for drone intrusion detection. This paper uses the LSTM-RNN version of RNN. The main idea is to have distributed modules of LSTM-RNN where each drone will have one module that tries to detect any attack on the drone itself. Another centralized module, known as the base station, resides on the ground with another LSTM-RNN, to confirm the attack and makes the decision notifying other drones. The base station is assumed to be able to communicate with all of the drones in the sky. It could be a single station or distributed stations. In this paper, we assumed that the base station is only one station, and it is able to communicate directly with all the drones.  
Drone intrusion detection could work in two different ways, batch or stream, depending on the used technology. For instance, if MapReduce is used as a centralized component for the decision-making process, the processing has to be run in batches, which takes some time in order to form the batch. On the other hand, if other frameworks, such as Storm, Spark, Flink, or Apache Kafka, are utilized, the detection process could be done at the runtime. Apache Kafka is preferred in this paper due to its distribution characteristics, especially when the big data stream is coming on. The paper emulates the real-time analysis  
\begin{table}
\begin{tabular}{c c c c c c c} \hline \hline \multirow{2}{*}{**Paper**} & \multicolumn{2}{c}{**Machine Learning Classifier**} & \multicolumn{3}{c}{**Intrusion Detection System Techniques**} & \multirow{2}{*}{**Technique Applied**} \\ \cline{2-2} \cline{4-7}  & **Ensemble** & **Hybrid** & **Hybrid IDS** & & **AIDS** & **SIDS** \\ \hline
[41] & x & \(\surd\) & x & x & \(\surd\) & Chi-square /multiclass \\
[42] & x & \(\surd\) & \(\surd\) & x & x & C4.5/One-class SVM \\
[44] & x & \(\surd\) & \(\surd\) & \(\surd\) & x & K-means/C4.5 \\
[25] & \(\surd\) & \(\surd\) & \(\surd\) & \(\surd\) & \(\surd\) & Stacking Ensemble of \\  & & & & & & C5.0/One-class SVM \\
[31] & \(\surd\) & x & x & \(\surd\) & \(\surd\) & Random Forest \\
[45] & x & \(\surd\) & x & x & \(\surd\) & One-Dependence \\  & & & & & & Estimator \\
[32] & \(\surd\) & x & x & \(\surd\) & x & Random Forest with \\  & & & & & & Feature Selection \\ \hline \hline \end{tabular}
\end{table}
Table 2: Detection model: hybrid machine learning approach.  
by feeding the data into a form of a stream to the RNN modules. The framework, shown in Figure 1, has two main components, drones and base station.  
As shown in the figure, the drone is assumed to have a simplified version of LSTM-RNN. In this context, the simplified version means a network with less traffic in terms of training and runtime traffic. In other words, the proposed framework is a generic framework that is designed to work on physical drones as we plan to do in our future work. Therefore, it is assumed that each drone will have light communication and less traffic than the base station. Thus, the drone LSTM-RNN module does not require the same amount of data analysis as the base station LSTM-RNN module, where the base station LSTM-RNN module is supposed to receive all of the drone traffic for analysis.