arXiv CSopen access

UAV-CAS: A Calibrated Digital-Twin Dataset for Intrusion Detection in UAV Swarm Networks

arXiv:2606.17845v1 [cs.NI] 16 Jun 2026

UAV-CAS: A Calibrated Digital-Twin Dataset for Intrusion Detection in UAV Swarm Networks Sripath Mishra

Bharat Bhargava

Purdue University USA [email protected]

Purdue University USA [email protected]

Zizheng Liu

Shafkat Islam

Purdue University USA [email protected]

Purdue University Northwest USA [email protected]

Abstract Intrusion detection systems (IDS) trained on wired-network benchmarks degrade sharply in real-world unmanned aerial vehicle (UAV) swarms, where mobility, fluctuating link quality, and decentralized routing reshape traffic distributions. Existing UAV-specific datasets also do not systematically vary these conditions, leaving no way to train or test an IDS against the very shift that defeats it. We present UAV-CAS, a large-scale labeled flow dataset for UAV-network intrusion detection, generated by a Containernet digital twin that is systematically calibrated against AERPAW testbed measurements. We have a four-layer calibration pipeline spanning altitude-dependent path loss, mission-specific mobility, the link-level performance chain, and end-to-end trace fidelity. UAV-CAS comprises 99,492 flows drawn from 1,024 configurations that span five attack families (DoS, DDoS, blackhole, wormhole, replay) and nine collaborative attack compositions. A diversity analysis shows that high-rate attacks separate from benign traffic up to an order of magnitude more strongly than in any prior benchmark, while stealth attacks deliberately blend with benign traffic. Across ten baseline IDS, binary attack detection saturates above 0.98, confirming the dataset is learnable, whereas full attack-class identification remains hard— per-class 𝐹 1 ranges from near zero to 0.82 and falls into the single digits for stealth attacks. We release the dataset, simulator, and calibration data to support reproducible UAV intrusion-detection research.

Keywords UAV networks, intrusion detection, network traffic dataset, digital twin, AERPAW calibration, collaborative attacks, network simulation.

1

Introduction

Unmanned aerial vehicle (UAV) swarms are increasingly deployed for emergency response [21], precision agriculture [47], environmental monitoring [13], and logistics operations [32]. These missions demand reliable multi-hop wireless communication among UAVs and ground base stations (BSs), making the network a highvalue attack surface. Intrusion detection systems (IDS) trained on static, wired-network datasets—CICIDS2017 [39], UNSW-NB15 [31]— fail when deployed in UAV environments, where mobility-induced

topology changes, fluctuating link quality, and decentralized routing create traffic distributions that differ from those seen during training. The root cause is a dataset gap. Existing UAV-specific datasets— UAV Attack Dataset [14], UAV-NIDD [12], UAVIDS-2025 [46]— suffer from limited scale, fixed network conditions, absent mobility modeling, or missing attack families. Current datasets do not capture collaborative attacks where multiple adversaries coordinate different attacks (e.g., a Blackhole reroute combined with a DoS flood [45]), despite evidence that such compositions produce synergistic effects invisible to single-flow detectors. Furthermore, no existing UAV dataset provides a calibrated wireless channel model validated against real-world measurements. Collecting such a dataset on physical UAV hardware is prohibitively expensive and time-consuming, requiring sustained flight hours, dedicated spectrum and airspace, and the ability to safely execute attacks that physical testbeds cannot. This paper presents UAV-CAS, a large-scale, labeled network traffic dataset generated from a Containernet-based UAV swarm digital twin that is systematically calibrated against measurements from the NSF AERPAW testbed [27]. We make four contributions: (1) AERPAW-Calibrated Digital Twin Platform. We design a Containernet-based UAV network emulator with a four-layer calibration pipeline—altitude-dependent path loss, missionspecific mobility dynamics, link-level performance chain, and end-to-end trace fidelity—each validated against independent AERPAW measurement campaigns (Maeng et al. [26], Gürses–Sichitiu [11], AFAR [29], and AADM [16]). The emulator executes real Linux TCP/IP stacks inside Docker containers, producing genuine protocol artifacts. (2) Systematic Calibration Pipeline. We fit altitude-dependent log-distance and 3GPP TR 36.777 path loss models against AERPAW RSRP data, calibrate Gaussian–Markov mobility parameters against AFAR autonomous flight traces, validate the end-to-end link quality chain (path loss → signal-tonoise ratio (SNR) → bit error rate (BER) → packet error rate (PER) → effective throughput) against measured received signal strength (RSS) and throughput, and perform a three-way fidelity comparison showing that our digital twin achieves lower divergence from real-world traces than AERPAW’s own digital twin environment.

2.2

(3) UAV-CAS Dataset. We generate a labeled dataset spanning 1,024 configurations across 5 attack families (DoS, DDoS, Blackhole, Wormhole, Replay), 4 swarm sizes, 4 mission types, 2 path loss models, 2 transmit power levels, and 14 attack compositions including 9 complementary collaborative scenarios. We benchmark 10 IDS architectures on UAV-CAS and demonstrate that conventional detectors fail on collaborative attack compositions that produce flow patterns absent from any single-attack training data. (4) Diversity Analysis. We conduct a statistical diversity analysis using Hellinger Distance and Jensen–Shannon Divergence on inter-arrival time distributions, demonstrating that UAV-CAS exhibits significantly higher variability than all existing IDS benchmarks. This increased diversity is due to operational complexity: the same attack executed under different mobility patterns, link conditions, and topology configurations produces different flow signatures.

UAV-Specific Datasets

A small number of UAV-specific datasets exist. UAV Attack Dataset [14] collects benign and cyber-physical attack traffic but is limited in scale and lacks UAV-to-UAV interactions. UAV Physical Dataset [43] provides flight logs for GPS spoofing detection but covers only a single attack family. UAV-NIDD [12] uses three drones with varied attacks but is not parametrized over bandwidth, latency, or packet loss—conditions that change with UAV motion. UAVIDS-2025 [46] does not model mobility or topology changes and lacks raw packet captures needed for flow-windowed analysis. The flying ad-hoc grey hole dataset [17] covers a single attack family without network parameterization. None of these datasets represent collaborative attacks, provide calibrated wireless channel models, or offer the configurability needed to evaluate IDS robustness across diverse network conditions. Table 1 provides a structured comparison.

2.3

All code, calibration data, configuration files, and the complete UAV-CAS dataset are publicly released to enable reproducible research.1 The remainder of this paper is organized as follows. Section 2 reviews existing IDS datasets, UAV simulation platforms, wireless channel models, and dataset quality metrics. Section 3 details the digital twin architecture, including topology, wireless channel model, mobility, attack implementation, and labeling methodology. Section 4 describes the four-layer AERPAW calibration pipeline. Section 5 presents the UAV-CAS dataset statistics and format. Section 6 evaluates calibration fidelity, dataset diversity, attack separability, baseline IDS performance, and collaborative attack detection. Section 7 discusses scope limitations and future work.

Network Simulation for Dataset Generation

Simulation platforms for UAV network research span a fidelity– feasibility spectrum. Pure packet-level simulators (NS-3 [37], MATLAB) model TCP/IP through mathematical abstractions but do not execute real protocol implementations—TCP retransmission behavior under load, routing convergence timing, and congestion window dynamics are approximated rather than observed. GNS3 [9] emulates real router firmware but lacks wireless channel modeling and mobility support. Mininet [24] provides lightweight network emulation with real TCP/IP stacks but has no built-in mobility model, wireless propagation, or Docker container resource control support for resource-constrained node emulation. Containernet [34] extends Mininet with Docker container integration, enabling per-node resource constraints (CPU, memory) that model embedded UAV hardware. However, Containernet provides no wireless channel model; bridging this gap requires an physical-layer pipeline—which our calibration approach provides. Physical testbeds run real UAVs with real radios but cannot safely execute adversarial experiments, are limited in swarm size by cost and airspace regulation, and cannot cover the combinatorial parameter space required for ML-based IDS evaluation. AERPAW [27], the NSF-funded aerial experimentation platform at NC State, provides both a physical testbed and a digital twin (DT) environment. However, AERPAW’s own documentation states that its DT emulation “is not physically faithful to any particular radio or aerial environment” and that “no meaningful data can be usefully extracted about any physical aspect” [3]. Our Containernet-based digital twin occupies a deliberate middle ground: real TCP/IP stacks inside Docker containers, with wireless channel effects applied through a calibrated physical-layer model validated against AERPAW measurements.

2 Related Work 2.1 General-Purpose IDS Datasets Intrusion detection research has long relied on benchmark datasets collected in controlled environments. CICIDS2017 [39] and CICIDS2018 generate realistic attack scenarios—DDoS, brute force, botnet, web exploits—over wired infrastructure, providing over eighty flow-level features. UNSW-NB15 [31] extends attack coverage to include fuzzing, backdoors, worms, and reconnaissance using a hybrid testbed with real and synthetic traffic. CICIOT2023 [33] introduces wireless IoT devices and heterogeneous attack scenarios, providing broader protocol coverage but still lacking UAV-specific dynamics. Other widely used datasets—InSDN [8], WIDE [6]—are similarly wired-network-based. IoT-oriented datasets such as WSNDS [4], 5G-NIDS [38], and Bot-IoT [23] introduce wireless and resource-constrained elements but lack UAV-specific mobility, topology dynamics, and attack families. All of these datasets share a critical limitation: traffic is collected on static topologies with fixed link capacity and delay, making them fundamentally unable to represent the distributional shift that UAV mobility introduces.

2.4

Wireless Channel Modeling for UAV Communications

UAV air-to-ground channels differ fundamentally from wired links due to altitude-dependent propagation, 3D antenna radiation patterns, and elevation-angle-dependent line-of-sight probability. The ITU-R P.1411 model [19] provides urban propagation predictions but does not account for UAV-specific altitude effects. The 3GPP TR 36.777 specification [1] introduces altitude-dependent path

1 Repository URL: https://github.com/Sripathm2/Collaborative-UAV-Dataset, Dataset

Link: https://dx.doi.org/10.21227/zgrg-z865 2

loss and shadow fading for UAV-to-ground channels in Urban Macro cells, incorporating line-of-sight probability as a function of elevation angle. The log-distance path loss model with altitudedependent parameters has been validated against UAV measurement networks [11, 26] and captures the dominant propagation effects without requiring ray tracing or full electromagnetic simulation. More detailed approaches include the Enhanced Two-Ray model of Masrur and Güvenç [28], which demonstrated that careful propagation modeling can close the simulation-to-real gap (18.2 m average localization error on the AERPAW physical testbed), and ray-tracing methods that model individual multipath components at the cost of computational tractability for large-scale swarm simulation. Our digital twin adopts the log-distance and 3GPP models as complementary options: the log-distance model is fitted directly to AERPAW RSRP measurements and captures site-specific propagation, while the 3GPP model provides a standardized reference for environments beyond the calibration site. Both models operate implicitly at the AERPAW measurement frequency (∼3.5 GHz).

2.5

cores, while Basestations (BS) containers are unconstrained. The 56core host accommodates the concurrent execution of all simulated nodes: up to 20 UAV containers (each capped at 2 cores) plus BS containers, with remaining cores handling simulation orchestration, network emulation, and packet capture.

3.1

We adopt a switch-per-drone topology. Each node (UAV or BS) is paired with a dedicated Open vSwitch (OVS) instance treated as part of the node; all links to a node traverse its switch. BS switches are interconnected to avoid single points of failure. Nodes are placed within a 1000 × 1000 × [30–110] m three-dimensional grid. The altitude bounds [30, 110] m are chosen to match the range of AERPAW measurement data used for path loss calibration (Section 4.1), eliminating extrapolation. UAVs are assigned random (𝑥, 𝑦, 𝑧) positions with a per-mission anchor point and margin from the grid boundary. BSs are placed randomly at ground level (𝑥, 𝑦, 0). All possible switch-to-switch links are pre-created and held administratively DOWN; the routing algorithm toggles links UP or DOWN each simulation window. While setting the link characteristics when turned UP. Routing algorithm. At each window, links are established using a nearest-neighbor chain: each UAV connects to its nearest peer (UAV or BS) by Euclidean distance. If this produces disconnected components—UAV clusters unreachable from any BS—one UAV per isolated cluster is forced to connect directly to the nearest BS (bridge UAV). This power-aware bridge selection ensures full connectivity while preserving the nearest-neighbor structure.

Dataset Diversity and Quality Metrics

Evaluating dataset quality requires metrics that capture distributional differences between traffic classes and across network conditions. Hellinger Distance [15] and Jensen–Shannon Divergence (JSD) [25] are symmetric, bounded divergence measures well-suited for comparing probability distributions of flow-level features [20]. Both metrics quantify how distinguishable two distributions are: higher values indicate greater separation, implying that a dataset captures more diverse traffic patterns that an IDS must learn to discriminate. In the context of IDS evaluation, diversity serves as a proxy for the distributional shift challenge. A dataset with low diversity (all attack flows look similar regardless of network conditions) will yield high detection accuracy that does not transfer to operational environments. Conversely, a dataset where the same attack produces measurably different flow signatures under different conditions more faithfully represents the deployment challenge. We use Hellinger Distance and JSD computed on flow packet inter-arrival time distributions as our primary diversity metrics, following [20], because packet inter-arrival times are the flow features most directly affected by changing wireless conditions.

3

Network Topology and Routing

3.2

Wireless Channel Model

Container-based emulation does not inherently model radio frequency (RF) propagation. We address this through a calibrated physical-layer pipeline that translates 3D UAV positions into perlink network impairments applied via Linux Traffic Control (tc) inside each container. The pipeline operates implicitly at the AERPAW measurement frequency (∼3.5 GHz); frequency-dependent propagation effects are absorbed into the fitted reference path loss 𝑃𝐿0 (ℎ) at each altitude (Section 4.1). 3.2.1 Path Loss. We support two altitude-dependent path loss models, selectable per configuration: Log-distance model (fitted to AERPAW data):   𝑑 + 𝑋𝜎 (ℎ) (1) 𝑃𝐿(𝑑, ℎ) = 𝑃𝐿0 (ℎ) + 10 𝑛(ℎ) log10 𝑑0

Digital Twin Architecture

where 𝑛(ℎ) is the path loss exponent at altitude ℎ, 𝑃𝐿0 (ℎ) is the reference path loss at distance 𝑑 0 = 1 m, and 𝑋𝜎 (ℎ) ∼ N (0, 𝜎 2 (ℎ)) captures altitude-dependent shadow fading. Parameters are fitted via least-squares regression against Maeng et al. [26] RSRP measurements at five altitudes (30, 50, 70, 90, 110 m) after antenna gain compensation, and cross-validated against independent Gürses– Sichitiu [11] measurements at overlapping altitudes. 3GPP TR 36.777 Urban Macro model: Altitude-dependent path loss following the 3GPP specification for UAV-to-ground channels [1], with parameters derived from the same AERPAW altitude range. This model provides a standardized reference for environments beyond the calibration site.

Our digital twin generates labeled UAV network traffic by simulating swarm communication inside Containernet [34], a Dockerbased extension of Mininet. Each UAV and base station is instantiated as an Ubuntu 22.04 Docker container running a full Linux TCP/IP stack, producing genuine protocol behavior—TCP retransmission, congestion control, ARP resolution. The host system runs Ubuntu 22.04 with Linux kernel 6.5.0-27 on a 56-core Intel Xeon E52683 v3 at 2.00 GHz with 256 GB RAM, deployed on CloudLab [36]. To reflect onboard constraints—UAV companion computers (that are onboard the UAV and handle tasks like data collection, networking, etc.) typically use dual-core to quad-core ARM Cortex-A class processors [22, 30]—each UAV container is limited to two CPU 3

Dataset CICIDS2017 [39] UNSW-NB15 [31] CICIOT2023 [33] UAV Attack [14] UAV-NIDD [12] UAVIDS-2025 [46] Grey Hole [17] UAV-CAS

Year 2017 2015 2023 2020 2025 2025 2025 2026

Scale 2.8M flows 2.5M flows 46M flows Small 95k flows – – 99k flows

#Attacks 7 9 33 3 6 4 1 5

Mobility ✗ ✗ ✗ ✗ ✗ ✗ ✓ ✓

Wireless ✗ ✗ Partial ✓ ✓ ✗ ✗ ✓

Collaborative attacks ✗ ✗ ✗ ✗ ✗ ✗ ✗ ✓

Labeled ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓

Calibration N/A N/A N/A None None None None AERPAW

Config. ✗ ✗ ✗ ✗ ✗ ✗ ✗ ✓

Open ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓

Table 1: Comparison of UAV-CAS with existing IDS and UAV network datasets.

MCS 0 1 2 3 4 5 6

Modulation BPSK BPSK QPSK QPSK 16-QAM 16-QAM 64-QAM

Code rate 1/2 3/4 1/2 3/4 1/2 3/4 3/4

Data rate (Mbps) 6 9 12 18 24 36 54

sequence—the physically correct behavior for a multi-hop path— with no link shaped more than once per window. 3.2.5 Environmental Parameterization. The configuration axes of UAV-CAS are chosen to present distinct physical mechanisms that alter flow-level traffic characteristics: TX power (10 vs. 30 dBm) controls the SNR operating point. At 10 dBm, links at moderate distances may fall below the 64-QAM threshold, triggering lower MCS selections that reduce effective bandwidth and increase PER. At 30 dBm, most links operate at the maximum 54 Mbps rate. This axis produces diversity in throughput and packet loss distributions even when topology and attacks are held constant. Mission type (spiral, grid, hover-transit, random) determines how UAV positions evolve over time, directly affecting topology change rate, link duration distributions, and the frequency of bridgeUAV reassignments. Spiral and grid missions produce predictable, gradual link evolution; random walks produce abrupt topology changes; hover-transit produces alternating stable (hover) and dynamic (transit) phases. Swarm size (5, 10, 15, 20 drones) controls network density. Sparse swarms (5 drones) produce star topologies where most UAVs connect directly to a BS; dense swarms (20 drones) produce multihop chains where bridge UAVs become critical, congestion patterns emerge, and collaborative attacks have more surface area. Path loss model (log-distance vs. 3GPP) produces different SNR distributions for the same physical geometry, exercising the sensitivity of flow features to wireless channel assumptions. This axis directly tests whether IDS models are robust to propagation model uncertainty. These axes interact multiplicatively: a 5-drone spiral at 30 dBm produces a stable, high-SNR star topology, while a 20-drone random walk at 10 dBm produces a volatile, SNR-stressed multi-hop mesh. This combinatorial interaction is what drives the statistical diversity documented in Section 6.5.

Table 2: Supported modulation and coding scheme (MCS) levels.

3.2.2 Shadow Fading. Spatial correlation of shadow fading is modeled using the Gudmundson process [10] with decorrelation distance 𝑑 corr = 50 m. Each (UAV, peer) pair maintains an independent fading state with lag-1 autocorrelation: √︁ (2) 𝑋𝜎 [𝑘] = 𝜌 · 𝑋𝜎 [𝑘 − 1] + 1 − 𝜌 2 · N (0, 𝜎 2 (ℎ)) where 𝜌 = 𝑒 −Δ𝑑/𝑑corr and Δ𝑑 is the distance traveled between simulation windows. 3.2.3 Modulation and Bit Error Rate. Seven modulation and coding scheme (MCS) levels are supported, following the IEEE 802.11a/g OFDM PHY [18] and ranging from BPSK rate-1/2 (6 Mbps) to 64QAM rate-3/4 (54 Mbps), as listed in Table 2. In adaptive mode, the highest-rate MCS whose required SNR threshold is met with a 3 dB margin is selected per link per window. BER is computed using the Q-function formulation from Proakis [35]: !   √︂ 3 SNRlin 4 1 BERM-QAM = 1− √ 𝑄 (3) log2 𝑀 𝑀 −1 𝑀 The packet error rate (PER) for a packet of 𝐿 bits is PER = 1 − (1 − BER) 𝐿 . 3.2.4 Link Impairment Application. Per-link parameters (bandwidth, delay, packet loss) are derived from the path loss → SNR → MCS → BER → PER chain and are applied per link: when a link is brought UP for a simulation window, its computed bandwidth, delay, and loss are installed on that link via tc netem, using the channel characteristics of that specific (node, peer) pair. Each link is therefore impaired according to its own geometry, rather than sharing a single per-node value. The netem qdisc is installed through Containernet’s TCLink support. We verified placement via docker exec mn.<node> tc qdisc show dev <iface>: links carry the netem qdisc with their perwindow parameters, while interfaces that only switch traffic show noqueue (OVS handles switching, unimpaired). Because impairment is attached per link, a packet that traverses multiple links accumulates each link’s delay and loss once, in

3.3

Mobility Model

UAV positions evolve according to mission-specific mobility models calibrated against AFAR autonomous flight traces [29] (Section 4.2). Four mission types are supported: Spiral. An Archimedean spiral at fixed altitude, modeling circular area search. Fitted parameters: initial radius 𝑟 0 , pitch (inter-loop spacing), speed, and altitude. Grid. A boustrophedon (lawn-mower) pattern at fixed altitude, modeling systematic area coverage. Fitted parameters: bounding box (𝑥 0, 𝑦0, 𝑥 1, 𝑦1 ), lane spacing, speed, and altitude (clamped identically to spiral). 4

Attack DoS DDoS Blackhole Wormhole Replay

Mechanism hping3 SYN flood Multi-source SYN flood OVS flow-drop rule L2 switch reroute Scapy capture + replay

Parameters Rate (𝜇 s interval) Rate, #attackers Duration Duration Buffer, delay, rate, TTL, seq

Signature IP-level flood Multi-src flood Silent drop Extra hop Volume spike

# 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16

Table 3: Attack taxonomy with implementation details and configurable parameters.

Hover-transit. A sequence of waypoints with hover periods at each, modeling data-mule or inspection missions. Altitude forced to 50 m to keep UAVs within the operational envelope during hover periods. Random. A Gauss–Markov random walk [5] with fitted velocity parameters including a negative vertical mean (reflecting the tendency of UAVs to descend). The walk reflects on all six faces of the bounding box.

3.4

Composition Benign DoS (= 1000) DDoS (= 1000) Blackhole Wormhole Replay (conservative) Replay (aggressive) Blackhole + DoS Blackhole + DDoS DoS + Wormhole DDoS + Wormhole Blackhole + Wormhole Blackhole + Replay (cons.) DDoS + Replay (cons.) DoS + Replay (cons.) Replay (cons.) + Wormhole

Type — Single Single Single Single Single Single Complementary Complementary Complementary Complementary Complementary Complementary Complementary Complementary Complementary

Table 4: Attack compositions in UAV-CAS. All collaborative compositions are complementary.

UAV-CAS are complementary: attackers execute different attack types that produce synergistic effects. For example, Blackhole+DoS combines silent packet dropping with flooding, making the blackhole harder to detect amid the DoS noise; Wormhole+DoS reroutes traffic through the attacker while simultaneously flooding the network; Blackhole+Replay combines silent dropping with traffic inflation, producing contradictory flow-level signals. Table 4 enumerates all 16 attack compositions in the campaign.

Attack Implementation

Five attack families are implemented, each using tools executing inside Docker containers (Table 3): DoS. A single attacker UAV launches SYN floods against a randomly selected victim using hping3 with configurable inter-packet interval. Default is set at rate=1000 (∼1,000 packets/s), a low-rate attack intensity that blends with benign traffic more realistically than high-rate floods and better represents operational threat scenarios where attackers attempt to evade detection. DDoS. Identical to DoS but with 2 or more randomly selected attacker UAVs targeting a single victim, representing a synchronized collaborative attack. Blackhole. An OVS flow-drop rule is installed on the victim’s switch. The link remains UP—ARP functions normally, but data frames are silently dropped. This produces a realistic blackhole signature: the victim appears connected but experiences progressive throughput degradation. Wormhole. A Layer 2 reroute through the attacker’s switch. The victim’s traffic is redirected at the switch level to traverse the attacker’s switch before reaching the BS. IP headers remain untouched—no attacker↔victim IP flow exists. The observable effect is increased latency and reduced throughput for victims due to the additional hop. Replay. A Scapy-based packet capture and replay attack executing inside the attacker container. Packets are captured on the attacker’s eth0 interface, buffered, and replayed with modified TTL and sequence numbers. Replayed packets retain original source and destination IPs, producing elevated traffic volume at the victim without a distinct attacker IP signature. Two replay variants are included with different operational profiles: (i) conservative (buffer=50pkts, 200 ms delay, 10 pps, TTL−5, sequential increment) and (ii) aggressive (buffer=100pkts, 100 ms delay, 20 pps, TTL−3, random sequence), enabling evaluation of detection sensitivity to replay intensity.

3.5

Traffic Generation

Benign traffic is generated by running an NGINX [41] server (single worker) on each UAV container, which continuously transmits still images [42] to BSs via HTTP, emulating sensing and telemetry pipelines common in UAV surveillance and inspection missions. FTP transfers are distributed round-robin across BSs: drone 𝑖 transmits to BS𝑖 mod |BS| , ensuring balanced load.

3.6

Labeling Methodology

Ground truth labels are generated deterministically from the simulation configuration. Each run produces an attack_details log recording: the attack type(s), attacker and victim IP addresses, attack start time, attack duration, and all physical-layer parameters (SNR, path loss, MCS selection) for each simulation window. The log also records tc parameters applied to each container and routing topology changes. Flows are labeled by matching the 5-tuple (source IP, destination IP, source port, destination port, protocol) against the attacker/victim IPs from the attack log. A flow is labeled as an attack type if either its source or destination IP matches a known attacker or victim for that attack. Flows not matching any attack record are labeled Benign. For collaborative attack compositions, a flow may carry labels for multiple simultaneous attacks (e.g., a victim targeted by both blackhole and DoS receives both labels). This multi-label structure supports both binary (attack vs. benign) and multi-class evaluation.

3.7

3.4.1 Collaborative Attack Compositions. UAV-CAS includes both single-attack scenarios and collaborative compositions where two attacks execute simultaneously. All collaborative compositions in

Configuration Space

The full Dataset spans the Cartesian product of the parameter axes in Table 5. Each configuration is encoded as a hyphen-separated 5

Parameter Attack composition Number of drones Number of BSs Payload type Path loss model Modulation Mission type TX power (dBm) Noise floor

Values 16 combinations (Table 4) 5, 10, 15, 20 2 Image Log-distance (fitted), 3GPP Adaptive Spiral, Grid, Hover-transit, Random 10, 30 −95 dBm

Altitude (m) 30 50 70 90 110

Mission Spiral Grid Hover-transit Random

𝜎 (ℎ) (dB) 3.70 3.73 4.08 4.48 4.46

𝛼 – – – 0.629

𝑣¯ (m/s) 0.570 9.960 9.962 2.501

𝜎𝑣2 – – – 3.713

Altitude (m) 25.96 (clamped to 30) 26.06 (clamped to 30) 37.53 (forced to 50) Varies

Table 7: Fitted mobility parameters per mission type from AFAR/AADM traces.

string, enabling deterministic replay. The simulation executes 12 mobility windows of 5 seconds each, producing approximately 60 seconds of data collection per configuration plus overhead for topology setup, pingAll connectivity verification, FTP initialization, and attack dispatch. Configurations are deterministically shuffled (seeded pseudorandom permutation) before distribution across compute nodes to ensure that partial campaign completion yields proportional coverage of all parameter axes.

• AADM [16]: Multi-modal data-mule missions with SNR and throughput traces across multiple BSs, with paired DT and real-world evaluations.

4.1

Traffic Capture and Flow Extraction

Layer 1: Altitude-Dependent Path Loss Model

Real-world UAV channels exhibit altitude-dependent behavior— ground reflection, 3D antenna radiation pattern effects, and elevationdependent shadow fading. We fit the log-distance model (Eq. 1) via least-squares regression against Maeng et al. RSRP data after antenna gain compensation at each of the five calibration altitudes. Cross-validation. We cross-validate fitted parameters against the independent Gürses–Sichitiu [11] measurements at overlapping altitudes (40, 70, 100 m) (Table 6). This cross-validation across two campaigns with different hardware (USRP B205mini vs. B210), waveforms (LTE vs. channel sounder), and bandwidths (1.25, 2.5, 5 MHz) provides confidence that the fitted parameters generalize beyond a single measurement artifact.

Network taps at every switch capture all packets into pcap files. Pcaps are processed by tshark to extract per-packet fields: frame time_epoch, frame len, ip src, ip dst, tcp src port, tcp dst port, udp src port, udp dst port, and tcp flags. Packets are aggregated into bidirectional flows using the 5-tuple with no timeout—all packets sharing a 5-tuple within a configuration run belong to the same flow. Flows with fewer than 10 packets are dropped to filter noise, and flows are capped at 100,000 packets. Because packet capture uses tcpdump -i any, encapsulated packets may produce comma-separated multi-layer IP addresses; our processing takes the innermost (actual endpoint) IP.

4

𝑃𝐿0 (ℎ) (dB) 15.23 13.65 4.01 3.16 3.37

Table 6: Fitted path loss parameters from Maeng et al. RSRP data.

Table 5: Configuration parameter space. Total: 16 × 4 × 1 × 1 × 2 × 1 × 4 × 2 × 1 = 1,024 configurations.

3.8

𝑛 (ℎ) 1.541 1.593 1.849 1.881 1.860

Calibration Pipeline

4.2

The digital twin employs a four-layer calibration pipeline, where each layer tunes simulation parameters against measurements from the NSF AERPAW testbed [27]. Fidelity is assessed using distributional divergence (Hellinger Distance, Jensen–Shannon Divergence), temporal correlation (Pearson coefficient), error metrics (RMSE, median absolute error), and the Kolmogorov–Smirnov test. The pipeline draws on four complementary AERPAW measurement datasets:

Layer 2: Mobility and Topology Calibration

We calibrate Gaussian–Markov parameters (𝛼, 𝑣¯, 𝜎𝑣2 ) and missiondriven trajectory models against AFAR and AADM traces (Table 7). For each real-world trace, we extract velocity distributions, heading change-rate distributions, altitude profiles, spatial visit frequency maps, and link lifetime distributions computed via the Layer 1 calibrated path loss model. For Gaussian–Markov, we fit parameters by minimizing JSD against velocity distributions. For mission-driven patterns (spiral, grid, hover-transit), we match spatial visit frequency and heading change-rate distributions.

• Maeng et al. [26]: RSRP at 3.51 GHz across five UAV altitudes (30–110 m) with measured 3D antenna radiation patterns, enabling decoupling of antenna gain from propagation loss. • Gürses–Sichitiu [11]: Wideband channel sounding at 3.3 GHz across three altitudes and three bandwidths at five ground nodes, enabling independent cross-validation. • AFAR [29]: 14 real-world autonomous search flights with GPS, velocity, orientation, RSS, and RSQ, totaling ∼300,000 samples across diverse mobility patterns including spiral sweeps, grid searches, and Bayesian optimization-driven trajectories, plus 15 paired AERPAW DT datasets.

4.3

Layer 3: Link-Level Performance Validation

The digital twin computes link quality through the chain. Layer 3 validates this end-to-end chain by replaying real-world AFAR and AADM trajectories through the simulator and comparing simulated RSS, SNR, and throughput against measured values. We evaluate two propagation variants: our Layer 1 altitudedependent log-distance model and the 3GPP TR 36.777 Urban Macro model. We report median RSS error and the Pearson correlation 6

Class Benign DoS DDoS Blackhole Wormhole Replay Collaborative Total

Number of Flows 58,589 1,223 7,316 12,116 10,862 2,025 7,361 99,492

5.1

Table 8: UAV-CAS dataset statistics.

of the SNR time series. Replaying 30 AADM/AFAR testbed flights (1.8M paired link samples) through the calibrated log-distance variant yields a median absolute RSS error of 13.1 dB after correcting a −6.0 dB mean cross-sensor calibration bias (18.3 dB uncorrected); the error shrinks with altitude, from 18.5 dB below 40 m to 10.7 dB in the 60–80 m band. SNR time-series tracking is weak but statistically significant (median Pearson 𝑟 ≈ 0.09 across flights, up to 0.19 on the best-tracked flights, 𝑝 ≈ 0): the model reproduces coarse distancedriven trends but not the fine-grained temporal fluctuations of the measured link, an expected consequence of emulating rather than physically propagating the channel. We do not report throughput RMSE because none of the replayed AERPAW campaigns (AADM, AFAR, Maeng et al.) include measured end-to-end throughput.

4.4

Layer 4: End-to-End Trace Fidelity

Using paired DT and real-world traces from AFAR and AADM, we perform a three-way fidelity comparison. We configure our Containernet digital twin to match AERPAW experimental parameters, replay real-world trajectories, and compute per-feature Hellinger Distance across three pairs: (a) Our DT ↔ Real world (b) AERPAW DT ↔ Real world (c) Our DT ↔ AERPAW DT Features compared include RSS, inter-arrival time, packet size, link duration, and topology change rate distributions. The simulator reproduces its trajectory source’s RSS distribution far more closely than two independent real-measurement campaigns reproduce each other. On the winning log-distance+shadow variant, the Hellinger Distance between simulated and AFAR-derived RSS is 0.33, well below the 0.73 cross-sensor ceiling between the two real campaigns (Maeng ↔ AFAR). The simulation-to-Maeng distance is higher (0.92), but this is dominated by a population-sampling difference—Maeng’s fixed anchor-altitude bench measurements sample the channel very differently from full AFAR flights—rather than by a propagation-fidelity failure. This variant minimizes total simulation-to-real divergence across the four calibration sweeps.

5

Intended Use Cases

UAV-CAS is designed to support multiple evaluation paradigms: Binary detection (attack vs. benign): All five attack families are collapsed into a single “attack” class. This setting evaluates whether an IDS can distinguish any anomalous activity from normal UAV operations. Multi-class classification (benign + 5 attack types): Each flow is assigned one of six labels. This setting evaluates whether an IDS can not only detect but also identify the attack family—critical for selecting appropriate mitigation responses. Collaborative attack detection: Configurations with two simultaneous attacks produce flows with multi-label ground truth. This setting evaluates whether detectors trained on single-attack data can recognize emergent collaborative patterns. Cross-condition generalization: By partitioning UAV-CAS along configuration axes (e.g., train on spiral missions, test on random; train on 5-drone swarms, test on 20-drone), researchers can evaluate IDS robustness to distributional shift—the core challenge in operational UAV deployment. We recommend a 70/10/20 train/validation/test split with standard scaling applied to all features. For cross-condition experiments, we recommend holding out entire configuration axis values (e.g., all random-mission configs) rather than random sampling, to ensure the test set contains genuinely unseen network conditions.

6

Evaluation

We evaluate the UAV-CAS digital twin and dataset along five axes: calibration fidelity (Sections 6.2–6.4), dataset diversity (Section 6.5), attack separability (Section 6.6), baseline IDS benchmarking (Section 6.7), and collaborative attack detection (Section 6.8).

6.1

Evaluation Setup

Calibration experiments use AERPAW measurement datasets as ground truth (Section 4). Input: Maeng et al. RSRP data, Gürses– Sichitiu channel sounding data, AFAR/AADM paired real-world and DT traces. Output: RMSE, MAE, Pearson correlation, Hellinger Distance, JSD, and KS-test statistics for each calibration layer. Baselines: Enhanced Two-Ray model [28] and 3GPP TR 36.777 model (for path loss); AERPAW’s own DT traces (for end-to-end fidelity). Diversity experiments use the full UAV-CAS dataset alongside four benchmark datasets: CICIDS2017 [39], UNSW-NB15 [31], CICIOT2023 [33], and UAV-NIDD [12]. Input: per-flow inter-arrival time sequences from each dataset. Output: Hellinger Distance and Jensen–Shannon Divergence between benign and attack distributions within each dataset. Metric interpretation: higher scores indicate greater within-dataset diversity, implying that the same attack manifests differently across network conditions. Baseline IDS experiments evaluate 10 IDS architectures on UAV-CAS: Logistic Regression (LR) [14], Stochastic Gradient Descent (SGD) [14], Random Forest (RF) [14], MLP [14], 1DCNN [14], LSTM [14], LightGBM [7], ConvNet [2], TinyML [44], and CNN-BiLSTM [40]. Input features: aggregated flow-level statistics computed from each flow’s packet sequence—duration, total forward/backward packets, byte lengths (total, mean, std, min, max), inter-arrival time statistics (mean, std, min, max), and TCP

UAV-CAS Dataset

Table 8 summarizes the class distribution. Each flow record contains the following per-packet fields extracted by tshark: timestamp (frame.time_epoch), frame length (frame.len), source and destination IP addresses, source and destination TCP/UDP ports, and TCP flags. From these raw fields, flows are represented as ordered sequences of (timestamp, size, flags) tuples, enabling downstream extraction of inter-arrival time distributions, packet size distributions, burst statistics, and flag-based behavioral features. 7

flag counts (SYN, ACK, FIN, RST, PSH, URG). All inputs are standardscaled. Output: 6-class label (Benign, DoS, DDoS, Blackhole, Wormhole, Replay). Data split: 70% training, 10% validation, 20% testing, stratified by class. Neural baselines are trained for 50 epochs with Adam optimizer (learning rate 10−3 , batch size 128); architectures follow original reference implementations without further hyperparameter tuning. Metrics: weighted 𝐹 1 -score for overall performance and per-class 𝐹 1 for attack-specific analysis. The same experimental protocol is applied identically across CICIDS2017, UNSW-NB15, CICIOT2023, and UAV-CAS to enable fair cross-dataset comparison. Collaborative attack experiments evaluate whether baselines trained on single-attack configurations can detect collaborative compositions. Input: the same feature set and baselines as above. Training data: flows from single-attack configurations only (compositions 1–7 in Table 4). Test data: flows from collaborative configurations (compositions 8–16). Output: per-composition 𝐹 1 -score revealing which collaborative patterns evade single-attack-trained detectors. This protocol directly evaluates the emergent detection challenge that motivates UAV-CAS’s collaborative attack design. Hardware: All experiments are executed on the same CloudLab host described in Section 3.1 (56-core Intel Xeon E5-2683 v3 at 2.00 GHz, 256 GB RAM, Ubuntu 22.04); IDS training is CPU-only.

6.2

overlaid; the residual subplot confirms that errors are centered at zero with altitude-dependent variance matching the fitted 𝜎 (ℎ). Figure 1b shows the cross-validation against Gürses–Sichitiu independent measurements.

6.3

Mobility Calibration Fidelity

Fitted mission-specific mobility parameters reproduce real AFAR speed distributions to within JSD ≤ 0.66 on every heldout flight, with the Gauss–Markov random walk achieving the closest match (JSD = 0.16). Table 10 reports per-mission velocity-distribution Jensen–Shannon distance (JSD on speed histograms; lower is better) and spatial visitfrequency Kullback–Leibler divergence (KL on (𝑥, 𝑦) occupancy maps; lower is better) on AFAR test flights that were not used during fitting. Each mission’s parameters were fit on a hand-coded subset of AFAR flights (3–5 flights per mission, 70% training fraction, 0.2 s sample step) and tested on 1–2 held-out flights. The Gauss–Markov random walk produces the tightest velocity match (JSD = 0.16) because its three free parameters (𝛼, 𝑣¯, 𝜎𝑣2 ) are fitted directly against the empirical speed distribution. The deterministic mission models (spiral, grid, hovertransit) are fit against trajectory shape rather than the marginal speed distribution, so their JSD is higher (0.26–0.65)—this is expected: a fixed-speed boustrophedon scan cannot reproduce the entire empirical speed PDF, only its central tendency. Spatial KL is lower for area-coverage missions (grid: 4.28; spiral: 7.71) than for waypoint or random walks (hover-transit: 18.25; random: 18.87) because area-coverage missions explore (𝑥, 𝑦) space uniformly by design, while waypoint and random walks concentrate occupancy mass around start/end points or local attractor regions, producing a more peaked spatial distribution that yields larger KL when compared to the empirical AFAR map. Figure 2a visualizes simulated 3D trajectories for each mission type. Figure 2b compares simulated vs. measured velocity CDFs.

Path Loss Calibration Fidelity

The fitted log-distance model achieves the lowest overall error and the best held-out cross-validation, beating the 3GPP reference by ∼2.9 dB RMSE on Maeng test data and by ∼6.6 dB on Gürses–Sichitiu cross-validation, while remaining competitive with an Enhanced Two-Ray model fitted to the same data. Table 9 reports RMSE, MAE, and Pearson correlation per altitude on Maeng et al. held-out test data (17,043 samples; 70/30 train/test split per altitude), aggregate overall metrics, and a fully held-out cross-validation against Gürses–Sichitiu measurements (3,131 samples) collected with different hardware (USRP B210 vs. B205mini), waveform (channel sounder vs. LTE), and bandwidth. The largest gains over the 3GPP reference appear at low altitudes (30–50 m) where ground reflection and elevationdependent radiation pattern effects are strongest. At 30 m, our fitted log-distance model reduces RMSE from 7.21 dB (3GPP) to 3.69 dB—a 49% reduction—and MAE from 5.32 dB to 2.21 dB. The Enhanced Two-Ray model is competitive at 70–90 m where the two-ray ground-reflection geometry matches the measurement environment, but log-distance retains the overall edge thanks to its lower error at 30 m and 50 m, where the bulk of test samples lies. The ∼6.6 dB cross-validation gap between log-distance and 3GPP (7.04 dB and 13.63 dB) confirms that the fitted parameters generalize across measurement campaigns, hardware, and waveforms rather than memorizing artifacts of the Maeng data alone. Cross-validation Pearson correlation is uniformly low (𝑟 ≈ 0.38) across all three models, reflecting the inherent variability of the Gürses–Sichitiu campaign (1–5 MHz channel sounder over a different deployment site); the discriminating signal is in the absolute error, not in correlation. Figure 1a plots simulated path loss against Maeng et al. measurements at five altitudes with the Two-Ray and 3GPP references

6.4

Link-Level and End-to-End Fidelity

The simulator reproduces its trajectory source’s RSS distribution at Hellinger 0.33—well inside the 0.73 ceiling that separates two independent real-measurement campaigns. Three-way RSS fidelity. We compare the RSS distributions of three sources on the log-distance+shadow variant: the Maeng measured campaign (𝑁 = 95k, mean −51.1 dBm), the AFAR digital-twin traces that drive the trajectories (𝑁 = 292k, mean −5.1 dBm), and our simulator (𝑁 = 1.8M, mean −24.5 dBm). The pairwise Hellinger Distances are 𝐻 (Maeng, Sim) = 0.92, 𝐻 (Maeng, AFAR) = 0.73, and 𝐻 (AFAR, Sim) = 0.33. The 0.73 figure is the floor imposed by two real campaigns recorded with different hardware at different sites; our simulator matches its AFAR trajectory source at 0.33, less than half that ceiling, while the larger Maeng–Sim distance reflects the campaigns’ differing spatial sampling rather than a modeling error. Among the four calibration sweeps, log-distance+shadow attains the lowest total simulation-to-real divergence and is used throughout. Link-level validation. Replaying real AADM/AFAR trajectories through the digital twin, the calibrated log-distance variant attains a median absolute RSS error of 13.1 dB (bias-corrected; 18.3 dB 8

Altitude (m) 30 50 70 90 110 Overall (Maeng) Cross-val (Gürses-Sichitiu)

Log-Distance (fitted) RMSE MAE 𝑟 3.69 2.21 0.76 4.00 2.63 0.70 4.42 2.45 0.72 4.87 3.11 0.66 4.60 2.94 0.66 4.40 2.69 0.70 7.04 5.90 0.39

Two-Ray (fitted) RMSE MAE 𝑟 4.87 3.21 0.75 4.59 3.03 0.73 4.13 2.35 0.75 4.72 2.75 0.70 4.72 2.69 0.69 4.60 2.75 0.67 7.21 6.49 0.37

3GPP TR 36.777 RMSE MAE 𝑟 7.21 5.32 0.73 7.33 5.64 0.73 7.30 6.00 0.75 6.80 4.87 0.70 7.87 6.91 0.69 7.32 5.79 0.65 13.63 13.77 0.38

Table 9: Path-loss model accuracy on Maeng et al. held-out test set per altitude, plus aggregated overall metrics and held-out cross-validation against independent Gürses–Sichitiu measurements. RMSE / MAE in dB (lower is better); Pearson 𝑟 unitless (higher is better).

alt 50 m

alt 70 m

alt 90 m

(a) Log-Distance RMSE=12.83 dB bias=+12.13 r=0.492

alt 110 m

(b) Two-Ray RMSE=14.78 dB bias=+11.68 r=0.405

(c) 3GPP TR 36.777 RMSE=6.48 dB bias=+4.08 r=0.455

−RSRP (dB)

predicted −RSRP (dB)

alt 30 m

distance

distance Maeng

distance Log-distance

distance Two-Ray

distance

measured −RSRP (dB)

measured −RSRP (dB)

measured −RSRP (dB)

3GPP

(b) Cross-validation against independent Gürses–Sichitiu measurements.

(a) Path loss vs. distance at five AERPAW altitudes.

Figure 1: Path-loss model fidelity. (a) Fitted log-distance (solid), fitted Two-Ray (dashed), and 3GPP TR 36.777 reference (dotted) against Maeng et al. measurements (points) at five altitudes; bottom row shows residuals with ±𝜎 (ℎ) bands. (b) Held-out predictions vs. Gürses–Sichitiu independent measurements at 40, 70, and 100 m. Mission Spiral Grid Hover-transit Random (G–M) Mean (across all test flights)

#test flights 2 1 1 1 5

JSDspeed 0.32 0.65 0.26 0.16 0.34

KLspatial 7.71 4.28 18.25 18.87 11.36

Table 11 compares diversity across datasets. The diversity structure of UAV-CAS is strongly bimodal and tracks the attack mechanism rather than mere attack presence. High-rate attacks and their collaborative compositions separate sharply from benign traffic: Blackhole+DDoS reaches a Hellinger Distance of 276.17 and DDoS alone 248.65, far above the most diverse prior benchmark (UAV-NIDD DoS at 27.71, UNSW-NB15 Backdoors at 23.20, CICIOT2023 DoS-UDP_Flood at 21.44). Stealth attacks, by contrast, sit close to benign: Blackhole (1.20), Wormhole (1.26), Replay (1.32), and their compositions all fall below 1.4 Hellinger, beneath every prior dataset. This is by design—blackhole, wormhole, and replay manipulate routing and packet timing while preserving benign-like inter-arrival statistics, so their low IAT divergence is the quantitative signature of their stealth, not a defect. The twoorders-of-magnitude dynamic range within a single dataset arises from genuine operational variability: the same attack executed at different UAV-to-base-station distances produces different flow signatures through wireless channel effects, and mobility-induced topology changes route the same attack along different paths. Internal diversity confirms that each configuration axis contributes measurably distinct flow distributions, ruling out the possibility that high cross-dataset divergence is an artifact of a single dominant axis. Table 12 reports the divergence between flow distributions induced by each pair of extreme axis values, holding all other axes mixed. A non-trivial value on every row demonstrates that no single axis dominates the dataset’s diversity. Every configuration axis contributes non-zero divergence, confirming that the configurability of UAV-CAS produces genuine flow-level variability rather than nominal parameter changes. On benign flows,

Table 10: Mobility-model fidelity on held-out AFAR flights, per mission. JSD on speed distributions and KL on spatial visit-frequency maps; lower is better.

raw, −6.0 dB mean cross-sensor bias) over 1.8M paired samples, decreasing to 10.7 dB at 60–80 m altitude. The SNR time series correlates weakly but significantly with measurements (median Pearson 𝑟 ≈ 0.09, 𝑝 ≈ 0). Throughput RMSE is omitted: the source campaigns provide no measured end-to-end throughput. Figure 3 presents the three-way Hellinger Distance comparison. Figure 4 shows SNR and effective bandwidth evolution over time for representative links during an AFAR trajectory replay.

6.5

Dataset Diversity Analysis

UAV-CAS exhibits significantly higher statistical diversity than all existing benchmarks, confirming that the dataset captures genuine operational complexity rather than artificial noise. We quantify diversity using Hellinger Distance and Jensen– Shannon Divergence computed on inter-arrival time distributions, following the methodology of [20]. Each flow is represented as a time series of inter-arrival packet times, as these are most affected by changing network conditions. 9

570

x (m

585

)

600

(d) random

90

90

60

z (m)

90

z (m)

120

60

555

(c) hover_transit 120

60

120 90 60

30

30

30

30

0

0

0

0

850 840 ) 432 830 440 (m 820 448 y x

680 ) 880 660 960 1040 640 y (m 1120 x(

(m)

m)

start

600 560 ) 816 520 824 480 (m

y

x (m

)

832

z (m)

(b) grid 120

z (m)

(a) spiral

790 780 770 m) 760 y (

840

end

(a) Simulated UAV trajectories per mission type.

CDF

0.9

(a) spiral JSD=0.620

(b) grid JSD=0.692

(c) hover_transit JSD=0.386

(d) random JSD=0.172

0.6

0.3

0.0 0

5

10

15

0

speed (m/s)

3

6

9

0

3

speed (m/s)

6

9

0

speed (m/s)

sim

4

8

12

speed (m/s)

AFAR

(b) Velocity-distribution validation: simulated (dashed) vs. AFAR measured (solid) CDFs.

Figure 2: Mobility-model calibration. (a) Simulated UAV trajectories for the four mission types (spiral, grid, hover-transit, random). (b) Per-mission velocity CDFs, simulated vs. AFAR measurements.

0.12

(a) RSS PDFs

an artifact of one over-weighted parameter. Figure 5 shows the per-axis feature distributions underlying these divergences.

(b) pairwise H 0.9

Hellinger

density

0.18

Maeng (measured) AFAR DT Sim

0.06

0.73

6.6

0.6

0.3

0.00

0.92

Attack families produce distinct but partially overlapping feature distributions, with stealth attacks (blackhole, wormhole) being hardest to separate from benign traffic. Table 13 reports per-class summary statistics on three flow-level features that an IDS would commonly use. Each cell shows mean ± standard deviation across all flows of that class. Standard deviations on each feature are larger for stealth attacks (blackhole, wormhole) than for floods (DoS, DDoS), reflecting the design intent of stealth attacks to mimic the natural variability of benign UAV traffic. This makes stealth attacks hard for static-feature classifiers and motivates the use of multi-feature and temporal-context detectors. Figure 6 shows the per-family distributions of these features. The embedding reflects the separability structure of Table 13. Figure 7 shows a t-SNE projection of the flow features. High-rate DoS and DDoS flows form compact clusters, set apart by their subsecond inter-arrival times and elevated packet rates, while benign flows spread broadly across the embedding. Blackhole, wormhole,

0.33

0.0 −120

−90

−60

RSS (dBm)

−30

Attack Separability Analysis

MaengMaeng AFAR ↔ ↔ ↔ Sim AFAR Sim

Figure 3: Three-way RSS fidelity (Hellinger Distance, lower is better) for the log-distance+shadow variant.

swarm size dominates (5 vs. 20 drones, JSD 13.18), followed by transmit power (10 vs. 30 dBm, 8.65), mission type (spiral vs. random, 8.58), and path-loss model (log-distance vs. 3GPP, 8.30). No single axis accounts for the dataset’s diversity, which rules out the possibility that the high cross-dataset divergence in Table 11 is 10

Dataset UAV-CAS

RSS (dBm)

(a) RSS 0 −30 −60 measured

−90

(b) SNR

40

SNR (dB)

sim

0 −40

UNSW-NB15

BW (Mb/s)

−80 (c) throughput (sim)

50 40

CICIOT2023

30 20 0

200

400

600

time (s)

Figure 4: Link-quality evolution for a representative flight (testbed 866, flight 23) under the log-distance+shadow variant: simulated vs. measured RSS and SNR over time, with simulated effective throughput.

UAV-NIDD

Hellinger 276.17 260.76 248.65 167.83 136.89 113.61 81.49 81.47 1.32 1.32 1.30 1.26 1.20 1.19 23.20 21.65 21.53 21.46 21.38 21.28 21.14 21.44 11.07 5.45 4.88 4.59 4.41 4.27 4.12 4.06 3.97 3.89 3.73 27.71

JSD 18.98 20.53 19.58 15.30 13.48 19.12 15.39 15.25 9.08 9.09 8.91 8.43 7.96 7.88 8.26 7.29 6.46 7.23 6.87 6.53 7.22 13.93 9.29 9.48 12.45 9.47 21.03 9.00 9.51 9.21 9.14 8.52 8.71 17.53

Table 11: Statistical diversity comparison (Hellinger Distance / JSD) on inter-arrival time distributions.

Axis (low vs. high) 5 vs. 20 drones Log-distance vs. 3GPP path loss Spiral vs. random mission TX power 10 vs. 30 dBm

and replay flows overlap the benign region, consistent with their near-benign inter-arrival, duration, and packet-size statistics. This overlap is the intended difficulty: stealth attacks are designed to blend with normal traffic, so a dataset in which they were trivially separable would be unrealistic. The embedding thus visualizes why UAV-CAS poses a genuinely hard detection problem rather than a separable toy task.

6.7

Attack Blackhole+DDoS DDoS+Replay DDoS DoS+Replay DoS DDoS+Wormhole DoS+Wormhole Blackhole+DoS Blackhole+Replay Replay Replay+Wormhole Wormhole Blackhole Blackhole+Wormhole Backdoors Fuzzers Generic Reconnaissance DoS Exploits Worms DoS-UDP_Flood DDoS-UDP_Flood DDoS-UDP_Fragmentation DDoS-SlowLoris DDoS-ICMP_Flood DoS-TCP_Flood DDoS-ICMP_Fragmentation DDoS-SYN_Flood Mirai-greip_flood Mirai-greeth_flood DDoS-RSTFINFlood DoS-SYN_Flood DoS

JSD 13.18 8.30 8.58 8.65

Table 12: Internal diversity by configuration axis. Computed on benign flows to isolate the axis effect from class-mix confounding. Higher values indicate the axis produces measurably different flow distributions.

Baseline IDS Benchmarking

All ten baselines saturate on binary attack detection across every dataset, including UAV-CAS, confirming the data is cleanly learnable; the genuine difficulty appears only in the full multi-class taxonomy. Table 14 reports binary Benign-vs-DoS weighted 𝐹 1 across four datasets (flow-statistics features, standard scaling). Binary detectability is a learnability floor, not the operational task; the difficulty is fine-grained attack identification. On binary Benign-vs-DoS detection every architecture saturates— nine of ten exceed 0.99 weighted 𝐹 1 on UAV-CAS and the lowest (LSTM) reaches 0.989—mirroring the high scores on the legacy benchmarks. This confirms the dataset is well-formed and learnable, but binary detection does not exercise the operational task. The discriminating signal lies in the full multi-class setting (Table 15), where the same ten architectures must separate fifteen overlapping benign and attack classes. All three scalers (standard, min–max, robust) were evaluated and agree closely for most models, with the

Class Benign DoS DDoS Blackhole Wormhole Replay

IAT (ms) 1,666 ± 642 43.2 ± 50.9 219.5 ± 257.5 1,647 ± 564 1,671 ± 652 1,890 ± 1,181

Pkt rate (pps) 0.63 ± 0.09 176.0 ± 253.8 500 ± 8,570 0.63 ± 0.17 0.63 ± 0.08 0.60 ± 0.12

Pkt size (B) 103.7 ± 26.6 71.6 ± 13.6 74.2 ± 13.2 104.4 ± 52.0 103.4 ± 2.0 102.6 ± 3.6

Table 13: Per-class summary statistics on key separability features. Mean ± standard deviation across all flows in UAVCAS.

recurrent and hybrid architectures (LSTM, CNN-BiLSTM) the most scaler-sensitive. In the full 15-class native setting, per-class 𝐹 1 spreads enormously, and the low-rate stealth and replay classes are the primary source of difficulty. 11

log10 (mean IAT, s)

(a) 5 vs 20 drones

(b) logdist vs 3GPP

(c) spiral vs random

(d) TX 10 vs 30 dBm

0

−2

−4

5

20

logdist

3gpp

spiral

random

10

30

Figure 5: Feature distributions across configuration axes: (a) 5 vs. 20 drones, (b) log-distance vs. 3GPP, (c) spiral vs. random, (d) TX power 10 vs. 30 dBm.

ac k W ho le or m ho l Re e pl ay

oS D

UNSW 98.71 87.95 99.11 97.96 98.67 98.65 99.13 98.48 98.86 98.70

UAV-CAS 99.98 98.86 99.99 99.98 99.99 99.98 99.96 99.99 99.98 99.99

Benign Blackhole Blackhole+DDoS

Blackhole+DoS

Blackhole+DoS Blackhole+Replay Blackhole+Wormhole

DDoS

DDoS

DDoS+Replay

DDoS+Replay

DDoS+Wormhole

DDoS+Wormhole

0.4

DoS

0.2

Replay

Wormhole

Replay+Wormhole

DoS

DoS+Replay

DoS+Wormhole

DDoS

DDoS+Replay

0.0 DDoS+Wormhole

Wormhole

Replay+Wormhole

Replay

DoS+Replay

DoS

predicted MLP (best)

DoS+Wormhole

DDoS

DDoS+Replay

DDoS+Wormhole

Blackhole+Replay

Blackhole+Wormhole

Benign

Wormhole Blackhole

Replay Replay+Wormhole

Wormhole Blackhole+DoS

Replay Replay+Wormhole

Blackhole+DoS

DoS+Replay DoS+Wormhole

Blackhole+Replay

DoS+Replay DoS+Wormhole

Blackhole+DDoS

0

0.6

Blackhole+Wormhole

DoS

0.8

Benign

true

Blackhole+Replay Blackhole+Wormhole

1.0

row-normalized

Benign Blackhole Blackhole+DDoS

Blackhole

Blackhole Wormhole Replay

50

t-SNE 2

CICIOT 93.14 83.38 97.57 87.99 88.20 92.41 97.67 91.30 97.07 94.35

Blackhole+DDoS

Figure 6: Distribution of key flow features across attack families: (a) mean inter-arrival time, (b) packet rate, (c) flow duration, (d) mean packet size. Benign DoS DDoS

CICIDS 97.31 92.15 99.92 91.98 92.24 97.35 99.84 96.59 99.89 95.63

Table 14: Binary Benign-vs-DoS weighted 𝐹 1 (%) of IDS models across datasets (flow-statistics features, standard scaling). All architectures approach the learnability ceiling on UAV-CAS; min–max and robust scalers give closely matching results.

Bl

D

ni Be

oS

0

gn

ac k W ho le or m ho l Re e pl ay

oS

oS D

D

2

Bl

Be

ni

gn

−4

4

D

−2

Model 1D-CNN LSTM RF SGD LR MLP LightGBM ConvNet TinyML CNN-BiLSTM

(b) packet rate log10 (packet rate (pps))

0

D

log10 (mean IAT (s))

(a) mean IAT

predicted CNN-BiLSTM (worst)

−50

Figure 8: Confusion matrix for the best-performing baseline on UAV-CAS. −50

0

50

t-SNE 1

Figure 8 shows the confusion matrices for the best- (LightGBM) and worst-performing (LSTM) baselines.

Figure 7: t-SNE embedding of UAV-CAS flows colored by attack type. Stealth attacks (blackhole, wormhole) overlap with benign traffic.

6.8

Collaborative Attack Detection

Out-of-distribution generalization to unseen collaborative compositions is mixed: most compositions remain detectable, but blackhole-paired stealth combinations resist every baseline.

Table 15 reports per-class 𝐹 1 in the 15-class native multi-class setting on UAV-CAS (flow-statistics features, standard scaling); 12

Model 1D-CNN LSTM RF SGD LR MLP LightGBM ConvNet TinyML CNN-BiLSTM

Be 22.03 12.80 42.91 53.00 62.44 18.42 55.59 31.46 51.17 40.67

DoS 15.53 5.85 36.17 27.21 26.85 10.56 67.49 11.56 36.66 4.15

DDoS Bh Wh 40.35 7.11 7.79 6.30 8.59 0.00 47.77 21.45 24.42 27.84 9.24 6.97 38.21 19.00 18.97 17.79 12.64 5.61 68.13 53.04 55.63 45.65 16.19 15.33 52.91 32.24 36.32 9.48 4.54 0.00

Rp 3.24 0.81 7.55 3.32 3.93 3.16 14.34 4.05 9.05 2.53

Bh+Do 5.67 0.91 37.09 11.87 12.54 2.54 78.65 2.31 37.98 0.51

Bh+DD 16.24 0.00 58.15 29.26 33.72 11.03 81.52 12.37 62.79 2.72

Bh+Rp 0.72 0.16 3.05 2.11 3.24 1.00 7.48 0.77 3.55 0.27

Bh+Wh 4.32 1.57 20.87 4.72 16.11 4.95 38.21 4.42 28.70 0.57

DD+Rp 10.34 3.64 28.58 20.60 27.77 11.04 33.62 11.61 27.57 2.61

DD+Wh 11.81 9.52 61.05 28.98 37.78 8.18 81.85 13.29 59.50 20.17

Do+Rp 5.03 0.94 28.64 32.22 21.34 2.91 40.58 3.66 16.95 1.63

Do+Wh 7.09 2.93 39.42 11.88 20.16 4.70 77.06 8.18 35.38 1.40

Rp+Wh 0.79 0.07 6.86 7.22 4.25 0.99 7.61 1.65 4.26 0.42

Table 15: Per-class 𝐹 1 (%) on UAV-CAS in the 15-class native multi-class setting.

1000

To probe generalization, we train all ten baselines on singleattack flows only (compositions 1–7 in Table 4) and test on the nine collaborative compositions (8–16). Table 16 reports per-composition AUROC. Flood-bearing compositions are recovered well—LightGBM, ConvNet, and TinyML exceed 0.93 AUROC on every DoS- or DDoScontaining pairing, because the high-rate component dominates the flow signature even when the specific combination was never seen during training. The two blackhole+stealth compositions are the exception: Blackhole+Wormhole and Blackhole+Replay fall to 0.51–0.86 across all ten models, since neither component perturbs flow statistics enough to be recognized out of distribution. The residual gap on stealth-paired compositions motivates dedicated multi-flow and context-aware detection. Single-flow classifiers process each flow independently and cannot exploit cross-flow correlations; when both components of a composition are individually near-benign, no single-flow feature suffices. Detecting these cases requires multi-flow features that capture network-wide behavior or temporal context across windows.

6.9

(b) t=20s (10 links)

y (m)

500

100

80 0 1000

(c) t=40s (10 links)

(d) t=60s (10 links) 60

altitude (m)

250

y (m)

750

40

500

250

0 0

250

500

x (m)

750

1000 UAV

0 BS

link

250

500

750

1000

x (m)

Figure 9: Topology evolution for a 10-drone random-mission configuration (2 base stations, seed 42): snapshots at windows 1, 4, 8, and 12 (𝑡 = 5, 20, 40, 60 s).

against real AERPAW measurements, the emulation cannot capture fine-grained physical-layer phenomena such as fast fading, frequency-selective multipath, or Doppler shift. Path loss and correlated shadow fading are modeled; small-scale fading is not. TCP/IP protocol stack. Benign traffic uses HTTP (nginx/curl) rather than MAVLink or other UAV-specific protocols. The traffic volume and burstiness patterns are realistic for sensing/telemetry payloads, but application-layer semantics differ from operational UAV protocols. No physical-layer attacks. The five attack families target the network and routing layers. GPS spoofing, jamming, and other physical-layer attacks are not included. No energy model. Battery drain and energy-constrained behavior are not simulated. UAV mission duration and resource allocation are fixed per configuration. Flow-level cap. Flows are capped at 100,000 packets. For sustained high-rate attacks, this preserves rate-based features but truncates volume-based features. Downstream models should rely on rate and distributional features rather than raw packet counts. Single attack rate. The campaign uses a single DoS/DDoS rate (∼1,000 pps). While this low-rate intensity is more operationally realistic than high-rate floods, future work should include multiple rate points to evaluate detection sensitivity across attack intensities. Future directions. We plan to extend UAV-CAS with: (i) fast fading and frequency-selective channel models, (ii) MAVLink protocol integration, (iii) GPS spoofing and jamming attacks, (iv) larger swarm sizes (50–100 UAVs), (v) heterogeneous UAV platforms with different radio capabilities, (vi) multiple attack rate points, and

Topology Characterization

Mobility-induced topology changes produce measurable variation in flow statistics across simulation windows. Figure 9 traces one configuration—a 10-drone random mission with two base stations—across four time windows. Over 60 s the swarm reorganizes substantially: individual UAVs traverse hundreds of meters, their altitudes cycle through the full 30–110 m band (marker color), and each UAV’s serving base station changes as it crosses the midline between bs1 and bs2. The active-link count remains 10 throughout, but the identity and length of those links turn over from window to window, so the per-flow distance, path loss, and achievable rate that each flow experiences are continually re-sampled. This topology churn within a single fixed configuration is the mechanism behind the inter-window flow-statistic variation, and—aggregated over the 1,024 configurations—behind the dataset-level diversity quantified in Section 6.5.

7

(a) t=5s (10 links)

750

Limitations and Future Work

We explicitly acknowledge the following scope limitations to guide appropriate use of UAV-CAS: Emulated wireless channel. The digital twin applies wireless channel effects (delay, bandwidth, loss) via Linux tc netem inside Docker containers rather than through actual RF propagation. While our four-layer calibration pipeline validates fidelity 13

Composition Blackhole+DoS Blackhole+DDoS DoS+Wormhole DDoS+Wormhole Blackhole+Wormhole Blackhole+Replay DDoS+Replay DoS+Replay Replay+Wormhole

1D-CNN 96.73 97.01 97.39 95.13 60.67 73.42 94.68 94.36 84.30

LSTM 77.32 80.93 75.68 78.56 52.65 53.88 74.71 75.08 57.79

RF 96.42 93.40 90.23 92.62 85.80 78.32 93.06 94.69 86.05

SGD 92.96 72.24 94.06 78.72 50.75 62.58 81.03 87.19 88.03

LR 95.67 94.26 96.98 92.87 51.31 83.50 91.87 93.29 96.24

MLP 94.26 96.92 94.03 94.59 70.95 82.68 94.51 92.22 93.92

LightGBM 98.60 99.69 99.52 99.43 84.97 81.74 99.99 99.58 81.42

ConvNet 98.50 98.58 99.34 96.74 57.44 52.99 93.97 94.78 57.15

TinyML 92.61 92.59 90.56 93.35 86.37 77.50 88.51 89.48 86.30

CNN-BiLSTM 95.66 93.61 95.69 88.09 69.14 72.97 88.30 94.74 95.03

Table 16: Out-of-distribution AUROC (%) on collaborative compositions. All three scalers agree closely; standard-scaler results are shown.

(vii) validation against additional AERPAW campaigns as new measurement data becomes available.

8

overview/1-5-experiment-environment-types-and-execution?authuser=0. [4] Iman Almomani, Bassam Al-Kasasbeh, and Mousa Al-Akhras. 2016. WSN-DS: a dataset for intrusion detection systems in wireless sensor networks. Journal of Sensors 2016, 1 (2016), 4731953. [5] Tracy Camp, Jeff Boleng, and Vanessa Davies. 2002. A survey of mobility models for ad hoc network research. Wireless communications and mobile computing 2, 5 (2002), 483–502. [6] Kenjiro Cho, Koushirou Mitsuya, and Akira Kato. 2000. Traffic data repository at the { WIDE } project. In 2000 USENIX Annual Technical Conference (USENIX ATC 00). [7] Leandro Marcos Da Silva, Isadora Garcia Ferrao, Catherine Dezan, David Espes, and Kalinka RLJC Branco. 2023. Anomaly-based intrusion detection system for in-flight and network security in uav swarm. In 2023 International Conference on Unmanned Aircraft Systems (ICUAS). IEEE, 812–819. [8] Mahmoud Said Elsayed, Nhien-An Le-Khac, and Anca D Jurcut. 2020. InSDN: A novel SDN intrusion dataset. IEEE access 8 (2020), 165263–165284. [9] GNS3 Technologies. 2024. GNS3: The Software That Empowers Network Professionals. https://www.gns3.com. Network emulation software; accessed 2025. [10] Mikael Gudmundson. 1991. Correlation Model for Shadow Fading in Mobile Radio Systems. Electronics Letters 27, 23 (1991), 2145–2146. doi:10.1049/el:19911328 [11] Anıl Gürses and Mihail L. Sichitiu. 2024. Air-to-Ground Channel Modeling for UAVs in Rural Areas. In 2024 IEEE 100th Vehicular Technology Conference (VTC2024-Fall). 1–6. doi:10.1109/VTC2024-Fall63153.2024.10757825 [12] Hassan Jalil Hadi, Yue Cao, Muhammad Khurram Khan, Naveed Ahmad, Yulin Hu, and Chao Fu. 2025. UAV-NIDD: A dynamic dataset for cybersecurity and intrusion detection in UAV networks. IEEE Transactions on Network Science and Engineering (2025). [13] Hassan Jalil Hadi, Yue Cao, Sifan Li, Yulin Hu, Juan Wang, and Shoufeng Wang. 2024. Real-time collaborative intrusion detection system in UAV networks using deep learning. IEEE Internet of Things Journal 11, 20 (2024), 33371–33391. [14] Samuel Chase Hassler, Umair Ahmad Mughal, and Muhammad Ismail. 2023. Cyber-physical intrusion detection system for unmanned aerial vehicles. IEEE Transactions on Intelligent Transportation Systems 25, 6 (2023), 6106–6117. [15] Ernst Hellinger. 1909. Neue Begründung der Theorie quadratischer Formen von unendlichvielen Veränderlichen. Journal für die reine und angewandte Mathematik 136 (1909), 210–271. doi:10.1515/crll.1909.136.210 [16] Md Sharif Hossen, Cole Dickerson, Ozgur Ozdemir, Anil Gurses, Mohamed Rabeek Sarbudeen, Thomas Zajkowski, Ahmed Manavi Alam, Everett Tucker, William Bjorndahl, Fred Solis, Sadaf Javed, Anirudh Kamath, Xiangyao Tang, Joarder Jafor Sadique, Kevin Liu Hermstein, Kaies Al Mahmud, Jose Angel Sanchez Viloria, Skyler Hawkins, Yuqing Cui, Annoy Dey, Yuchen Liu, Ali Gurbuz, Joseph Camp, Rizwan Ahmad, Jacobus van der Merwe, Ahmed Ibrahim Mohamed, Gil Zussman, Mehmet Kurum, Namuduri Kamesh, Zhangyu Guan, Dimitris Pados, George Sklivanitis, Ismail Guvenc, Mihail Sichitiu, Magreth Mushi, and Rudra Dutta. 2026. Collection: UAV-Based Wireless Multi-modal Measurements from AERPAW Autonomous Data Mule (AADM) Challenge in Digital Twin and Real-World Environments. arXiv:2602.16163 [cs.NI] https: //arxiv.org/abs/2602.16163 [17] Charles Hutchins, Leonardo Aniello, Enrico Gerding, and Basel Halak. 2025. A flying ad-hoc network dataset for early time series classification of grey hole attacks. Scientific Data 12, 1 (2025), 1431. [18] IEEE. 2021. IEEE Standard for Information Technology—Telecommunications and Information Exchange between Systems—Local and Metropolitan Area Networks— Specific Requirements—Part 11: Wireless LAN Medium Access Control (MAC) and Physical Layer (PHY) Specifications. Technical Report IEEE Std 802.11-2020 (Revision of IEEE Std 802.11-2016). IEEE. doi:10.1109/IEEESTD.2021.9363693 [19] ITU-R. 2021. Propagation Data and Prediction Methods for the Planning of ShortRange Outdoor Radiocommunication Systems and Radio Local Area Networks in the Frequency Range 300 MHz to 100 GHz. Recommendation ITU-R P.1411. International Telecommunication Union.

Conclusion

We presented UAV-CAS, a large-scale labeled network traffic dataset for intrusion detection in UAV swarm networks, generated from a Containernet-based digital twin systematically calibrated against NSF AERPAW testbed measurements. The digital twin employs a four-layer calibration pipeline—altitude-dependent path loss, mission mobility, link-level performance chain, and end-to-end trace fidelity—each validated against independent measurement campaigns. The resulting dataset spans 1,024 configurations across 5 attack families, 4 mission types, 2 path loss models, and 16 attack compositions including 9 complementary collaborative scenarios. Our evaluation demonstrates four key findings. First, the calibration pipeline achieves 4.40 dB overall RMSE path loss and 0.34 mean JSD mobility fidelity, and the digital twin reproduces its real trajectory source’s RSS distribution at Hellinger 0.33—within the 0.73 cross-sensor ceiling that separates two independent real campaigns. Second, UAV-CAS exhibits significantly higher statistical diversity than all existing IDS benchmarks, with Hellinger scores up to an order of magnitude higher for high-rate attacks (276 vs. 28 for the most diverse prior dataset). Third, while ten standard baselines detect attacks near-perfectly in the binary setting (weighted 𝐹 1 above 0.98), their accuracy collapses in the full 15-class native taxonomy—per-class 𝐹 1 ranges from near zero to 0.82 and stealth attacks fall into the single digits—confirming that fine-grained attack identification under mobility-induced distributional shift is the real challenge. Fourth, when baselines trained only on single-attack flows are tested on unseen collaborative compositions, out-of-distribution generalization is mixed: most compositions remain detectable (AUROC above 0.9 for the strongest models), but blackhole-paired stealth combinations (Blackhole+Wormhole, Blackhole+Replay) stay difficult for all ten, indicating that these emergent patterns require dedicated multi-flow or temporal-context detection. All code, calibration data, and the complete dataset are publicly released to enable reproducible research in UAV network security.

References [1] 3GPP. 2017. Study on Enhanced LTE Support for Aerial Vehicles. Technical Report TR 36.777. 3rd Generation Partnership Project (3GPP). Release 15, V15.0.0. [2] Qasem Abu Al-Haija and Ahmad Al Badawi. 2022. High-performance intrusion detection system for networked UAVs via deep learning. Neural Computing and Applications 34, 13 (2022), 10885–10900. [3] AERPAW Team. 2024. AERPAW User Manual and Platform Documentation. https://sites.google.com/ncsu.edu/aerpaw-user-manual/1-aerpaw14

[20] Xi Jiang, Shinan Liu, Aaron Gember-Jacobson, Arjun Nitin Bhagoji, Paul Schmitt, Francesco Bronzino, and Nick Feamster. 2024. Netdiffusion: Network data augmentation through protocol-constrained traffic generation. Proceedings of the ACM on Measurement and Analysis of Computing Systems 8, 1 (2024), 1–32. [21] Wenbo Jin, Jixing Yang, Yudong Fang, and Wenchuan Feng. 2020. Research on application and deployment of UAV in emergency response. In 2020 IEEE 10th international conference on electronics information and emergency communication (ICEIEC). IEEE, 277–280. [22] Vemema Kangunde, Rodrigo S Jamisola Jr, and Emmanuel K Theophilus. 2021. A review on drones controlled in real-time: V. Kangunde et al. International journal of dynamics and control 9, 4 (2021), 1832–1846. [23] Nickolaos Koroniotis, Nour Moustafa, Elena Sitnikova, and Benjamin Turnbull. 2019. Towards the development of realistic botnet dataset in the internet of things for network forensic analytics: Bot-iot dataset. Future Generation Computer Systems 100 (2019), 779–796. [24] Bob Lantz, Brandon Heller, and Nick McKeown. 2010. A Network in a Laptop: Rapid Prototyping for Software-Defined Networks. In Proc. 9th ACM SIGCOMM Workshop on Hot Topics in Networks (HotNets-IX). 1–6. doi:10.1145/1868447. 1868466 [25] Jianhua Lin. 1991. Divergence Measures Based on the Shannon Entropy. IEEE Transactions on Information Theory 37, 1 (1991), 145–151. doi:10.1109/18.61115 [26] Sung Joon Maeng, Hyeokjun Kwon, Ozgur Ozdemir, and İsmail Güvenç. 2023. Impact of 3-D Antenna Radiation Pattern in UAV Air-to-Ground Path Loss Modeling and RSRP-Based Localization in Rural Area. IEEE Open Journal of Antennas and Propagation 4 (2023), 1029–1043. doi:10.1109/OJAP.2023.3322145 [27] Vuk Marojevic, Ismail Guvenc, Rudra Dutta, Mihail L. Sichitiu, and Brian A. Floyd. 2020. Advanced Wireless for Unmanned Aerial Systems: 5G Standardization, Research Challenges, and AERPAW Architecture. IEEE Vehicular Technology Magazine 15, 2 (2020), 22–30. doi:10.1109/MVT.2020.2979494 [28] Saad Masrur and Ismail Guvenc. 2025. Bridging Simulation and Reality: A 3D Clustering-Based Deep Learning Model for UAV-Based RF Source Localization. arXiv:2502.13969 [eess.SP] https://arxiv.org/abs/2502.13969 [29] Saad Masrur, Ozgur Ozdemir, Anıl Gurses, Ismail Guvenc, Mihail L Sichitiu, Rudra Dutta, Magreth Mushi, C Dickerson, G Reddy, SV Villar, et al. 2025. Collection: Datasets from AFAR Challenge. arXiv preprint arXiv:2505.06823 (2025). [30] Luis Mejias, Jean-Philippe Diguet, Catherine Dezan, Duncan Campbell, Jonathan Kok, and Gilles Coppin. 2021. Embedded Computation Architectures for Autonomy in Unmanned Aircraft Systems (UAS). Sensors 21, 4 (2021). doi:10.3390/ s21041115 [31] Nour Moustafa and Jill Slay. 2015. UNSW-NB15: a comprehensive data set for network intrusion detection systems (UNSW-NB15 network data set). In 2015 military communications and information systems conference (MilCIS). Ieee, 1–6. [32] Chase C Murray and Amanda G Chu. 2015. The flying sidekick traveling salesman problem: Optimization of drone-assisted parcel delivery. Transportation Research Part C: Emerging Technologies 54 (2015), 86–109. [33] Euclides Carlos Pinto Neto, Sajjad Dadkhah, Raphael Ferreira, Alireza Zohourian, Rongxing Lu, and Ali A Ghorbani. 2023. CICIoT2023: A real-time dataset and benchmark for large-scale attacks in IoT environment. Sensors 23, 13 (2023), 5941. [34] Manuel Peuster, Holger Karl, and Steven Van Rossem. 2016. MeDICINE: Rapid prototyping of production-ready network services in multi-PoP environments. In 2016 IEEE Conference on Network Function Virtualization and Software Defined Networks (NFV-SDN). IEEE, 148–153. [35] John G Proakis and Masoud Salehi. 2001. Digital communications. Vol. 4. McGrawhill New York. [36] Robert Ricci, Eric Eide, and CloudLab Team. 2014. Introducing CloudLab: Scientific infrastructure for advancing cloud architectures and applications. ; login:: the magazine of USENIX & SAGE 39, 6 (2014), 36–38. [37] George F. Riley and Thomas R. Henderson. 2010. The ns-3 Network Simulator. In Modeling and Tools for Network Simulation. Springer, 15–34. doi:10.1007/9783-642-12331-3_2 [38] Sehan Samarakoon, Yushan Siriwardhana, Pawani Porambage, Madhusanka Liyanage, Sang-Yoon Chang, Jinoh Kim, Jonghyun Kim, and Mika Ylianttila. 2022. 5g-nidd: A comprehensive network intrusion detection dataset generated over 5g wireless network. arXiv preprint arXiv:2212.01298 (2022). [39] Iman Sharafaldin, Arash Habibi Lashkari, Ali A Ghorbani, et al. 2018. Toward generating a new intrusion detection dataset and intrusion traffic characterization. ICISSp 1, 2018 (2018), 108–116. [40] Jay Sinha and M Manollas. 2020. Efficient deep CNN-BiLSTM model for network intrusion detection. In Proceedings of the 2020 3rd International Conference on Artificial Intelligence and Pattern Recognition. 223–231. [41] Sysoev, Igor. [n. d.]. nginx. https://nginx.org/en/. [42] Jinghao Wang, Xichao Teng, Zhang Li, Qifeng Yu, Yijie Bian, and Jiaqi Wei. 2022. VSAI: A multi-view dataset for vehicle detection in complex scenarios using aerial images. Drones 6, 7 (2022), 161. [43] Jason Whelan, Thanigajan Sangarapillai, Omar Minawi, Abdulaziz Almehmadi, and Khalil El-Khatib. 2020. UAV attack dataset. IEEE Dataport 167, 1 (2020),

1561–1573. [44] Yixuan Wu, Lin Yang, Long Zhang, Laisen Nie, and Li Zheng. 2024. Intrusion detection for unmanned aerial vehicles security: A tiny machine learning model. IEEE Internet of Things Journal 11, 12 (2024), 20970–20982. [45] Chang Wu Yu, Tung-Kuang Wu, Rei Heng Cheng, and Shun Chao Chang. 2007. A distributed and cooperative black hole node detection and elimination mechanism for ad hoc networks. In Pacific-Asia conference on knowledge discovery and data mining. Springer, 538–549. [46] Qingli Zeng, Abdalrahman Bashir, and Farid Nait-Abdesselam. 2025. Uavids-2025: A benchmark dataset for intrusion detection in uav networks using machine learning techniques. In 2025 IEEE Conference on Communications and Network Security (CNS). IEEE, 1–9. [47] Qingli Zeng, Semire Olatunde-Salawu, and Farid Nait-Abdesselam. 2024. Fga-ids: A federated learning and gan-augmented intrusion detection system for uav networks. In 2024 IEEE 10th International Conference on Collaboration and Internet Computing (CIC). IEEE, 50–59.

15