FlowRAG: A Two-Stage Retrieval-Augmented Intrusion Detection System for Adaptive UAV Network Security

Existing IDS approaches assume centralized, resource-rich environments and miss three requirements of edge-deployed UAV security: adaptability to flow drift caused by mobility and changing topology, near real-time detection under UAV compute and energy constraints, and continuous monitoring as traffic evolves mid-mission.

FlowRAG is a two-stage edge–cloud architecture built on the finding that on-device latency, not accuracy, is the binding constraint. A fast path (random forest, on-device) screens every flow window in 4.78 ms mean / 6.16 ms P99 on a Raspberry Pi 4B with the process pinned to two cores. Only ambiguous windows escalate to a slow path (BallTree retrieval at the base station), and an escalation fits within a single MTU (~800 bytes per window).

Escalating 10% of flows leaves ~90% resolved on-device and reaches 97.5% of the maximum achievable F1 — deliberately not the accuracy-maximizing operating point, chosen to preserve link bandwidth for mission telemetry. Against the strongest baseline under mobility-induced drift, FlowRAG gains +16% F1.

Retrieval here regenerates training sets, not text: no language model is in the loop. That lets the detector absorb new attack variants as the traffic distribution moves — +7–10 F1 points over baselines (0.81–0.82 vs. 0.72–0.75) across 5–20-UAV swarms.

Authors: Sripath Mishra, Shradha Awasthi, Bharat Bhargava, Zizheng Liu, Shafkat Islam
Venue: IEEE EDGE 2026

Links

• IEEE Xplore: to be added once the proceedings are published

Recommended citation: Sripath Mishra, Shradha Awasthi, Bharat Bhargava, Zizheng Liu, Shafkat Islam. "FlowRAG: A Two-Stage Retrieval-Augmented Intrusion Detection System for Adaptive UAV Network Security." IEEE International Conference on Edge Computing and Communications (EDGE), 2026.