A Two‐Stage Intrusion Detection Ensemble Model for Airborne Networks

ABSTRACT Modern aircraft are advancing toward intelligent development, but this connectivity exposes them to new cyber‐security threats. Most existing intrusion detection methods are designed for closed‐set scenarios and often perform poorly in open‐set environments with unknown attacks. We propose a novel open‐set intrusion detection system with an undetermined attack detector and a predefined attack classifier. In the first stage, a conditional Gaussian discriminative model is trained using known information and the added conditional Gaussian distribution. Reconstruction error distribution helps distinguish between known and unknown attacks. In the second stage, a gated recurrent unit network integrated with a temporal pattern attention mechanism is used to extract time‐series features from the airborne network data. By applying multi‐scale convolution operations to the hidden states of the Gated Recurrent Unit, the model effectively captures temporal dependencies and dynamic patterns within network traffic. The proposed method demonstrated promising detection results on MIL‐STD‐1553 and CICIDS2017, with experimental findings showing that it can detect both known and unknown attacks, thus serving as a viable solution for securing airborne networks.