Research
My work sits at the intersection of three constraints that are usually studied separately: a detector has to be accurate under distribution shift, cheap enough to run where the data is, and explainable enough that an operator will act on it. Optimizing any one of these in isolation is well understood. The interesting problems live where they conflict.
Latency is the binding constraint, not accuracy
The standard framing of edge intrusion detection asks how much accuracy you give up by shrinking the model. Profiling the actual deployment inverts the question: on a Raspberry Pi 4B with the process pinned to two cores, the model was never the bottleneck the literature assumed — the end-to-end per-window budget was.
FlowRAG is built around that finding. It splits detection into a fast path and a slow path. A random forest on-device screens every flow window in 4.78 ms mean / 6.16 ms P99; only ambiguous windows escalate to a BallTree retrieval stage at the base station, and an escalation is compact enough to fit in a single MTU (~800 bytes per window).
The operating point matters as much as the architecture. Escalating 10% of flows — leaving ~90% resolved on-device — is not the accuracy-maximizing choice; escalating 30% scores higher. But 10% reaches 97.5% of the maximum achievable F1 while leaving the radio link free for mission telemetry, which is what a real UAV operator is actually optimizing. Against the strongest baseline under mobility-induced drift, FlowRAG gains +16% F1.
Retrieval that regenerates training sets, not text
FlowRAG is retrieval-augmented, but it is not the LLM pattern and the distinction is load-bearing. Nothing is generated as text and no language model is in the loop. Retrieval selects historical flow evidence that regenerates the training set for the current operating regime, so the detector absorbs new attack variants as the swarm’s traffic distribution moves — adaptation without catastrophic forgetting in this setting, rather than a claim about the phenomenon in general. Across 5–20-UAV swarms this yields +7–10 F1 points over baselines (0.81–0.82 vs. 0.72–0.75).
FlowRAG: A Two-Stage Retrieval-Augmented Intrusion Detection System for Adaptive UAV Network Security. IEEE EDGE, 2026.
Benchmarks that make the hard case visible
Paper · Dataset · Code · Dataset page
Most UAV intrusion datasets do not systematically vary the conditions that actually break a detector, which makes it impossible to train or test against the shift that defeats it. UAV-CAS was built to fix that: 99,492 flows drawn from 1,024 configurations, spanning five attack families (DoS, DDoS, blackhole, wormhole, replay) and nine collaborative compositions.
The credibility question for any simulated dataset is how far it sits from reality. UAV-CAS answers it with a four-layer calibration pipeline against the NSF AERPAW testbed — altitude-dependent path loss, mission-specific mobility, the link-level performance chain, and end-to-end trace fidelity. Simulated-to-real RSS divergence lands at 0.33 Hellinger, comfortably under the 0.73 ceiling that separates two independent real measurement campaigns from each other. The simulation is closer to the hardware than two hardware runs are to one another.
Benchmarking 10 baseline IDS on it surfaced the result that reframed the rest of my work: binary attack detection saturates above 0.98, which is why the field looks solved — but stealth-paired collaborative compositions (blackhole+wormhole, blackhole+replay) collapse to 0.51–0.86 AUROC. The headline metric was hiding the failure mode.
Dataset, simulator, and calibration data are publicly released. → UAV-CAS dataset page
Explainability that ends in an action
“Explainable” is a claim that usually stops one step short of being useful. A saliency map tells an operator which features moved the score; it does not tell them what to do at 3 a.m. with a swarm mid-mission. The question every XAI claim eventually gets is so what does the operator actually do with the explanation — and my most recent work is an attempt to answer it end to end.
The detector works at two levels. Per flow, it builds a multi-perspective interpretable feature space and pairs it with a learned raw-timing block feeding a gradient-boosted tree head. Per run, it recovers the set of attack components in a coordinated campaign from scenario-level labels only, using cross-flow synchrony and destination-convergence features — reaching 0.88 set-precision (0.875 ± 0.021) on UAV-CAS.
The rules are not hand-written. A depth-5 surrogate tree is distilled from the trained ensemble, and for each class the highest-precision leaf is extracted and validated against true labels on held-out test data. Each surviving rule is a conjunction of at most five named thresholds, and each is paired with a concrete mitigation:
| Class | Rule F1 | Mitigation the rule triggers |
|---|---|---|
| DDoS | 0.990 | Rate-limit sources sharing the detected burst pattern |
| DoS | 0.943 | Throttle the single-source high-determinism flow |
| Blackhole | 0.291 | Check route advertisements from the flagged node; reroute |
| Wormhole | 0.206 | Inspect tunnel endpoints; verify hop counts on flagged routes |
The honest reading is in the second column. The flood classes get rules strong enough to act on directly. Blackhole and wormhole do not — their per-flow signatures are diffuse, and a rule at 0.29 F1 is a hypothesis, not a verdict. Reporting per-rule precision alongside the mitigation is the point: it tells an analyst how far to trust each rule, which is the difference between an explanation and a decision aid.
Detection also holds up early. 10-packet prefixes land within 2 points of full-flow accuracy, so a decision does not have to wait for a flow to finish.
Under submission.
Does any of this leave UAV networks?
The fair criticism of this body of work is that it is all one domain, one traffic type, one lab. The direct counter-evidence is a cross-dataset test on CICIOT23, an IoT intrusion benchmark that ships raw PCAPs rather than pre-aggregated flow records — which means the same feature pipeline can run on it unmodified.
It transfers. Weighted F1 rises from 0.826 at a 10-packet prefix to 0.866 at 100 and 0.882 at 250, ahead of the strongest baselines at the 100-packet point (LightGBM 0.837, random forest 0.836) and well clear of the convolutional, linear, and TinyML baselines. The descriptors were designed against UAV traffic; they were not tuned for IoT, and they still lead.
That is one dataset, not a generalization claim. But it is the concrete evidence that what is being learned here is how to characterize a flow under adversarial coordination, not how UAVs happen to look.
Earlier work
Robust traffic classification under distribution shift (IEEE IPCCC 2025) — a testbed that isolates one network factor at a time across ten Dockerized services and five application classes, from video streaming and conferencing down to email and FTP. The finding: trace augmentation is method-specific. The identical augmentation that improves packet-size-sequence classifiers measurably degrades timestamp-based ones, which means “does augmentation help?” is the wrong question — it depends entirely on which signal the classifier reads.
NetEye: near-switch network telemetry — hybrid telemetry systems trade accuracy against the number of concurrent queries. Replaying a near-switch window through every query, rather than iteratively refining a single stream, breaks that tradeoff across 15+ concurrent queries. An FPGA Delta+Huffman+LZ78 pipeline makes replay affordable by cutting header storage, and moving monitoring logic near-switch drops data-plane update latency by more than an order of magnitude.
CAM2: automated network camera discovery (ACM TOIT 2021, IEEE COMPSAC 2020) — automated discovery of real-time camera feeds across heterogeneously structured web pages, extracting 57,364 cameras from 237,257 pages.