UAV-CAS: A Calibrated Digital-Twin Dataset for Intrusion Detection in UAV Swarm Networks

2026-06-16

AI Summary

Existing wired-network-based intrusion detection systems exhibit significantly degraded performance in unmanned aerial vehicle (UAV) swarm networks, largely due to the absence of labeled datasets that capture their dynamic characteristics. To address this gap, this work proposes a calibration-driven digital twin approach that leverages the Containernet platform and real-world measurements from AERPAW to construct a large-scale UAV network traffic dataset. Through a four-level calibration process—encompassing path loss, task-driven mobility, link performance, and end-to-end trajectories—the dataset achieves systematic environmental fidelity, covering five attack types and nine collaborative attack combinations, yielding 99,492 labeled flows. Experimental results demonstrate binary classification detection accuracy exceeding 0.98; however, fine-grained identification—particularly of stealthy attacks—remains challenging, with F1 scores dropping to single-digit levels.

Abstract

Intrusion detection systems (IDS) trained on wired-network benchmarks degrade sharply in real-world unmanned aerial vehicle (UAV) swarms, where mobility, fluctuating link quality, and decentralized routing reshape traffic distributions. Existing UAV-specific datasets also do not systematically vary these conditions, leaving no way to train or test an IDS against the very shift that defeats it. We present UAV-CAS, a large-scale labeled flow dataset for UAV-network intrusion detection, generated by a Containernet digital twin that is systematically calibrated against AERPAW testbed measurements. We have a four-layer calibration pipeline spanning altitude-dependent path loss, mission-specific mobility, the link-level performance chain, and end-to-end trace fidelity. UAV-CAS comprises 99,492 flows drawn from 1,024 configurations that span five attack families (DoS, DDoS, blackhole, wormhole, replay) and nine collaborative attack compositions. A diversity analysis shows that high-rate attacks separate from benign traffic up to an order of magnitude more strongly than in any prior benchmark, while stealth attacks deliberately blend with benign traffic. Across ten baseline IDS, binary attack detection saturates above $0.98$, confirming the dataset is learnable, whereas full attack-class identification remains hard -- per-class $F_1$ ranges from near zero to $0.82$ and falls into the single digits for stealth attacks. We release the dataset, simulator, and calibration data to support reproducible UAV intrusion-detection research.

Problem

• UAV swarm networks
• intrusion detection
• dataset
• traffic distribution shift
• calibration

Innovation

• digital twin
• calibrated dataset
• UAV swarm security
• intrusion detection
• distribution shift