A Comparative Analysis of Ensemble‐Based Machine Learning Approaches With Explainable <scp>AI</scp> for Multi‐Class Intrusion Detection in Drone Networks

ABSTRACT The growing integration of drones into civilian, commercial, and defense sectors introduces significant cybersecurity concerns, particularly with the increased risk of network‐based intrusions targeting drone communication protocols. Detecting and classifying these intrusions is inherently challenging due to the dynamic nature of drone traffic and the presence of multiple sophisticated attack vectors such as spoofing, injection, replay, and man‐in‐the‐middle (MITM) attacks. This research aims to develop a robust and interpretable intrusion detection framework tailored for drone networks, with a focus on handling multi‐class classification and model explainability. Initially, the ISOT Drone Anomaly Detection Dataset was used for model training, followed by validation on the UAVIDS‐2025 dataset to assess generalizability. We present a comparative analysis of ensemble‐based machine learning models trained on a labeled dataset comprising benign traffic and nine distinct intrusion types. Comprehensive data preprocessing was performed, including missing value imputation, scaling, and categorical encoding, followed by model training and extensive evaluation using metrics. Random Forest achieved the highest performance with an F1‐macro score of 0.9998 and ROC‐AUC of 1.0000, improving detection performance by over 2%–5% compared to other ensembles. To validate the superiority of the models, statistical tests including Friedman's test, Wilcoxon signed‐rank test with Holm correction, and bootstrapped confidence intervals were applied. Furthermore, explainable AI methods, SHAP and LIME, were integrated to interpret both global and local feature importance, enhancing model transparency and decision trustworthiness. The proposed approach not only delivers near‐perfect accuracy but also ensures interpretability, making it highly suitable for real‐time and safety‐critical drone operations. This work contributes a novel blend of high‐performing classification and explainability to the domain of UAV cybersecurity, offering a promising pathway for secure, transparent deployment of drone‐based systems in complex environments.