# XAI-Based Framework for Protocol Anomaly Classification and Identification to 6G NTNs with Drones
## 6 Online Identification Method
### Intrinsic Identification via a Dual-DNN Approach  
With images serving as inputs, sufficient information is provided to trace the inputs back to the anomalous 6G NTN protocol sequences. However, the tracing method still needs to be designed, which can be achieved through the intrinsic explainable baseline detection process. This approach should simultaneously identify anomalous protocol sequences and provide explainable detection results. Additionally, the intrinsic explainable detection method must efficiently process the inputs, which contain information about the 6G NTN protocol that is richer than the abstracted information, such as statistical data or envelopes. Therefore, we design a dual-DNN model to detect anomalies in 6G NTN protocol sequences efficiently. The proposed dual-DNN consists of two DNN models: the first DNN model is the prediction model, and the second model is the detection model. The first model predicts the corresponding normal data for the data under detection. Among them, static fields can be obtained during training. Firstly, training the historical protocol data can acquire static information, which remains consistent across different terminals and network infrastructures. Secondly, the static data vary between various terminals and network infrastructures but remain unchanged within the same UE, and the infrastructure is obtained by training protocol data collected from the corresponding terminals and networks in the 6G network under detection. These static fields can be accomplished during training. But the dynamic fields varying across different communication protocol processes and even sequences still need to be predicted based on the information of the protocol data under detection. This prediction is completed during the online inference process. To reduce computational complexity, the dual-DNN model predicts only the dynamic information of protocol sequences, whereas static information is directly obtained from the trained model. The dynamic baseline information predicted by the 1 st DNN is then input into the 2 nd DNN, at which point the information is combined with the static prediction results to generate a comprehensive representation of the normal baseline information. For the 6G NTN protocol sequences, more than 95% of the fields are static. For example, in the NG application protocol (downlink NASTransport) signal sequence used during the registration process, as shown in Figure 9, only the information about the encryption algorithm identifier, integrity protection algorithm identifier, message authentication code, and sequence number is dynamic. Thus, the dual-DNN model can process the protocol signals efficiently. In the second DNN model, convolutional computations are replaced with XOR operations. By comparing the predicted normal sequence with the sequence under detection, mismatched portions are identified as anomalous fields. If there is no attack, the detection matrix will be zero. Otherwise, there will be elements in the detection matrix that are one, corresponding to the anomalous signal fields. Lastly, the anomalous signal fields can be obtained by reversing the matrix to derive the protocol information. This approach not only detects anomalies but also localizes the exact positions of the anomalous fields. To identify the anomalous protocol fields, they are usually local, such as tampering with the sequence number, which is a specific protocol field. Therefore, the interpretable ability can be local or global, but it is necessary to target those anomalous protocol fields specifically. The proposed dual-DNN model is globally interpretable because the detection matrix includes the anomalous or normal state of all the protocol data. To design the dual-DNN model, there is one base DNN model consisting of the input, output, and hidden layers, and the number of hidden layers is denoted by \(L\). The activation function is Sigmoid. The first DNN model uses the base DNN model directly.