Explainable Ensemble Framework for Cyber Threat Detection in UAV Networks

Abstract

Unmanned Aerial Vehicles (UAVs) serve an essential function in various civilian, commercial, and military applications, but their reliance on wireless communication, onboard sensors, and ground control systems make them vulnerable to a comprehensive set of cyber threats. Existing security measures—ranging from cryptographic protocols to traditional intrusion detection—struggle to address evolving attack vectors such as GPS spoofing, man-in-the-middle (MITM), jamming, denial-of-service/distributed-denial-of-service (DoS/DDoS), and other advanced UAV-specific intrusions. This study proposes a lightweight ensemble machine learning framework integrating Light Gradient Boosting (LightGBM), Histogram-based Gradient Boosting (HGB), and Categorical Boosting (CatBoost) to detect both sensor-based and broader cyber-attack types in UAV environments. To enhance trust and operational transparency, Explainable AI (XAI) is embedded into the framework, enabling interpretability of detection outcomes for operators and stakeholders. The proposed model is evaluated on the UAV-GCS-IDS dataset capturing diverse attacks, including DoS/DDoS, brute force, reconnaissance, scanning, MITM, replay, fake landing, and evil twin intrusions. Results from the experiments indicate that the ensemble surpasses baseline machine learning models with 99.74% accuracy, 99.87% F1-score, 99.86% precision, and 99.88% recall. In addition, the model also achieves a robust ROC-AUC of 99.85% and PR-AUC of 100.0%, while maintaining low computational overhead—making it suitable for resource-constrained UAV systems. This work strengthens UAV cybersecurity by introducing an interpretable, high-performance detection framework capable of operating effectively in realworld, mission-critical scenarios.