# Machine-Learning-Enabled Intrusion Detection System for Cellular Connected UAV Networks
## 3 System Model  
There will be a large number of UAVs, terrestrial vehicles, and smart devices in urban cities in the near future, and there are already millions of smart phones. It is important to ensure security of UAVs against attackers: if the attackers compromise UAVs, then they might crash into urban locations, causing serious damage. We need to provide an efficient security mechanism to the UAV system, and there are some requirements to be fulfilled. Thus, the potential requirements of the 5G-satellite system can be defined as follows:  
* A 5G system supporting satellite access and massive Machine-Type Communications (mMTC) should also support UAV communication based on the 5G-satellite access network.
* A 5G system should have multiple access points including satellite networks and terrestrial access mobile networks, combined with a machine learning based firewall. In 5G Core (5 GC), a machine learning-based, intelligent Next Generation Firewall (NGFW) provides protection across all these access points. Thus, NGFW helps to achieve multiple network slices, as shown in Figure 7.
* One of the requirements is the selection of satellite and terrestrial access networks. The selection should be based on operator policy, subscription settings, QoS settings, and security policies.  
The description of our security system model is shown in Figure 7 and is discussed below. In this approach, different types of traffic from various devices/services can be divided into slices, from slice 1 to slice n. As the 5G core and RAN are software-defined, it is feasible to implement NGFW based on machine learning techniques and AI. The AI enabled software-defined help to examine network packet flows for anomalies. In this model, traffic is fed into the firewall component and analyzed with various machine learning techniques. The flows that are identified as anomalies, i.e., the packet flows that behave abnormally, are flagged as malicious, and the policies are updated to terminate these flows. The policy updates are then sent to the SDN controller to terminate the appropriate flows or drop packets. The SDN controller then provides proper routing and management of traffic entering into virtualized core network components.  
Some of the key threats based on DDoS and DoS attacks that impact the 5G networks security (including data integrity protection, and data encryption) can be mitigated by using this model. By using a slice-based approach, security policies can be customized and configured based on the sensitivity of the data within the slice. This approach can assist in providing a greater degree of protection for a large variety of services that are expected to operate on 5G networks. The threats and vulnerabilities in 5G and UAV networks are shown in Figure 8. Additionally, by looking at lower-level network traffic such as flow-based statistics and not using deep packet inspection, network traffic can be analyzed in an encrypted state, removing the overhead and additional complexity of decrypting data for analysis and then re-encrypting, which will reduce latency as well. The effectiveness of flow-based analysis using machine learning is demonstrated in the results section.