## 3 The Proposed SP-IoUAV Model
### Intrusion Detection System (IDS)
#### 3.3.2 Intrusion Detection Engine
```
Data: Detected anomalies from CNN: \(X_{\text{anomalies}}\) Result: Anomaly Classification using LSTM
1 Initialize LSTM architecture with input layer, hidden layer, and LSTM cells; for each time step \(t\) in \(X_{\text{anomalies}}\)do
2 Input Gate:
3 Compute input gate activation \(i_{t}\) using Equation (20);
4 Forget Gate:
5 Compute forget gate activation \(f_{t}\) using Equation (21);
6 Output Gate:
7 Compute output gate activation \(o_{t}\) using Equation (22);
8 Candidate Cell State:
9 Compute candidate cell state \(\bar{C}_{t}\) using Equation (23);
10 Cell State Update:
11 Update cell state \(C_{t}\) using Equation (24);
12 Hidden State Update:
13 Update hidden state \(h_{t}\) using Equation (25);
14
15 end for
16
17 Extract temporal features from the sequence of hidden states;
18 Feed the temporal features into the output layer for classification;
19 Output: Classification results for different anomaly types;LSTM is chosen in our proposed model for classifying intrusions due to its exceptional ability to capture temporal dependencies within sequential data. Its unique architecture analyzes the temporal dynamics of anomalies over time, recognizing recurrent patterns and sequential behaviors crucial for accurate anomaly classification. By leveraging LSTM, our IDS effectively identifies and categorizes diverse intrusion scenarios, enhancing UAV operations' security in a smart-city environment. Categorizing intrusions offers benefits such as improved response strategies, focused investigation, enhanced situational awareness, adaptive anomaly detection, and simplified forensic analysis, enhancing overall system reliability and safety in a dynamic smart-city environment. Figure 2 illustrates the hybrid CNN-LSTM Model for intrusion detection and classification in our proposed SP-IoUAV model. #### 3.3.3 Real-Time Decision Mechanism

The real-time decision mechanism, a critical component of our proposed model, comprises blacklist management and real-time alert provision. * **Blacklist Management**: Blacklist management is a crucial part of the real-time decision mechanism in our proposed model. It involves maintaining and updating a blacklist that contains identified malicious entities, such as unauthorized intruders or suspicious activities. The primary goal of blacklist management is to prevent future interactions with known threats and enhance the security of the unmanned aerial vehicle (UAV) network. We can represent the blacklist as follows:

\[C=\frac{1}{n-1}\sum_{i=1}^{n}(x_{i}-\bar{x})(x_{i}-\bar{x})^{T} \tag{10}\]5

where \(e_{i}\) represents the \(i\)-th entity or intrusion identified as a threat. Algorithm 8 summarizes the blacklisting functionality in our proposed model. The blacklist management algorithm first checks if a new intrusion, \(e_{\text{new}}\), is already present in the current blacklist. If not, it adds the new intrusion to the blacklist. If \(e_{\text{new}}\) is already present, the algorithm updates its entry with any new information. Finally, the algorithm returns the updated blacklist, \(\text{Blacklist}_{\text{updated}}\), which is then used to prevent any future interactions with known threats. By continuously updating the blacklist with newly identified threats, the blacklist management component ensures that the UAV network remains protected from previously

\[C=\frac{1}{n-1}\sum_{i=1}^{n}(x_{i}-\bar{x})(x_{i}-\bar{x})^{T} \tag{10}\]6 Hybrid CNN-LSTM Model for Intrusion Detection and Classification. encountered malicious entities, significantly reducing the risk of security breaches and enhancing the overall security posture of the system.