# A Lightweight AI-Based Approach for Drone Jamming Detection
## 4 System Model
### Detection Algorithm  
When choosing the algorithm for the classification module, we first had to define its requirements. The algorithm has to have the ability to classify anomalous samples with a high detection rate (recall), while at the same time being lightweight enough in terms of memory usage and computational power to be run on a resource-constrained device like a drone. The training phase should also be fast, as this would allow the drone to quickly determine the normal transmission RSS values in a constantly changing environment. A periodic redefinition of normal RSS values would limit the number of false positives caused by drone mobility. The model should also require a small amount of storage to run effectively, as drones are usually very limited in internal memory.  
The algorithm that we found to be the best fit for these requirements is the Isolation Forest algorithm [26]. The Isolation Forest (IF) algorithm is a state-of-the-art unsupervised ML algorithm for anomaly detection, introduced by [PERSON] et al. in 2008. Unlike traditional anomaly detection algorithms, which require the definition of a normal class, IF is able to detect anomalies without explicitly defining their characteristics. This is achieved by leveraging the properties of anomalies themselves, i.e., being rare and separated from the majority of the data points.  
Figure 4: Normal network operation RSS values.  
Figure 3: Periodic jamming attack RSS values.  
Figure 2: Constant jamming attack RSS values.  
The algorithm works by building a forest of isolation trees. Each tree is built by randomly selecting one of the features and then splitting the data points based on a value randomly selected between the minimum and maximum value of the feature. This partitions the data into the left and right branches of the tree. The process is repeated recursively until all the data points are isolated. The height of a node, meaning the number of splits required to isolate it, is used to determine the anomaly score of the data point. The greater the number of splits, the more likely the data point is to be an anomaly. IF is an _ensemble_ algorithm, meaning that the final anomaly score is calculated by averaging the anomaly scores of all the trees in the forest. More trees result in greater accuracy but also more computational power required.  
The algorithm was chosen for its simplicity, low computational requirements (both in terms of memory and computational power) and proven effectiveness in the detection of anomalies [26]. While more complex solutions like Neural Networks or Support Vector Machines might prove more effective in certain scenarios, they are best suited in a situation where computation power is not a limiting factor. The unsupervised nature of the algorithm was also a determining factor in its selection, as it would allow for a periodical redefinition of the normal RSS values based on the current environment, without the need to rely on a fixed labeled dataset. Also, thanks to its ability to work on high dimensional data, the algorithm could potentially be scaled to work with more complex datasets in the future, if the drones were to be equipped with more advanced sensors.  
The chosen implementation for IF is the one provided by the _Scikit-learn_ library [27] for Python 3. The model was tested on both a Raspberry Pi 3 and a desktop processor, demonstrating effective performance in both environments with comparable trends. The presented graphs reflect results from the desktop processor, but the model's efficiency on resource-constrained devices has been validated.