# XAI-Based Framework for Protocol Anomaly Classification and Identification to 6G NTNs with Drones
## 7 Simulation Results
### Self-Evolving Classification
The detection performance metrics of the SEC method are better than those of the CNN-BiLSTM and HATT methods because the SEC method utilizes the fingerprint features of the uncovered attacks extracted from the detection process. Thus, the SEC model can detect and classify uncovered attacks efficiently. Next, we evaluate the performance of the proposed SEC in extracting the fingerprint features. After the baseline model detects the uncovered protocol attacks, the XAI mechanism used in the baseline detection model is used to capture the fingerprint features of these attacks. Figure 10 illustrates the quantitative contributions of the protocol features for the detected UPF DoS attacks across our dataset when the system is under UPF DoS. The red and blue bars represent the positive and negative contributions to the detection results. The protocol features with positive and negative contributions to the detection results are defined as the positive and negative fingerprint features, respectively. In the case of the UPF DoS attack, the positive fingerprint features are numbered 2, 3, 8, 17, 42, 69, and 78 [68], which are Flow Duration, Total Fwd Packets, Fwd Packet Length Mean, Flow IAT Mean, Packet Length Std, Act Data Pkt Fwd, and Idle Min. The negative fingerprint features are numbered 39 and 48 [68], which are Min Packet Length and ACK Flag Count, with reduced attention to negative fingerprint features during the rule detection process, as described in the following subsection. \begin{table}
\begin{tabular}{c c c c} \hline \hline \multirow{2}{*}{**Models**} & \multicolumn{3}{c}{**UPF DoS**} \\ \cline{2-4}  & \(\mathbf{r_{\text{PRE}}}\) **(\%)** & \(\mathbf{r_{\text{REC}}}\) **(\%)** & \(\mathbf{r_{\text{F1}}}\) **(\%)** \\ \hline CNN-BiLSTM & 100 & 50.2 & 66.8 \\ \hline HATT & 75.3 & 78.2 & 76.8 \\ \hline SEC & **100** & **93.8** & **96.6** \\ \hline Improvement (SEC vs. CNN-BiLSTM) & 0 & \(\uparrow\) 86.8 & \(\uparrow\) 44.6 \\ \hline Improvement (SEC vs. HATT) & \(\uparrow\) 32.8 & \(\uparrow\) 19.9 & \(\uparrow\) 25.7 \\ \hline \hline \end{tabular}
\end{table} 
Table 6: Detection performance for uncovered attacks with “\(\uparrow\)” meaning increase. To assess the effectiveness of the self-evolving features in the rule detection method, we compared the attention maps before and after the self-evolving method based on the fingerprint characteristics was applied, as shown in Figures 11 and 12. The color intensity in these figures indicates the degree of attention: brighter colors represent greater attention and thus more significant influence on the prediction results, whereas darker colors signify less attention and thus less contribution to the prediction results. Based on these feature contributions revealed by Figure 10, we have adjusted our feature attention strategy by shifting focus from Figure 11 to Figure 12, increasing attention to positively contributing features while decreasing focus on negative contributors. Figure 11 shows the attention map for covered DoS attacks before the self-evolving method is applied. The rule detection model focuses the most on features numbered 4, 23, 39, 41, 55, and 78 [68], which are Total Backward Packets, Fwd IAT Std, Min Packet Length, Packet Length Mean, AvgBwdSegmentSize, and IdleMin, as highlighted by the brighter colors in the plots. After the self-evolving method is applied to classify UPF DoS attacks, the attention given to features numbered 39 and 48 [68]--which are Min Packet Length and ACK Flag Count--is reduced, as indicated by the darker colors, and the attention given to features numbered 2, 3, 8, 17, 42, 69, and 78 [68]--which are Flow Duration, Total Fwd Packets, Fwd Packet Length Mean, Flow IAT Mean, Packet Length Std, Act Data Pkt Fwd, and Idle Min,--is increased, as highlighted by the brighter colors, as shown in Figure 12. Thus, the rule detection method can dynamically reassign more attention to features with higher positive contributions and reduce the attention given to features with negative contributions.