Source-Rate Representations and Attention Autoencoders for Leakage-Safe Zero-Day Sybil Detection in UAV Networks

Machine learning intrusion detection for unmanned aerial vehicles (UAVs) reports extremely high accuracy on public benchmarks, but such figures depend critically on how models are evaluated, and they are often inflated by identifier leakage or collection artifacts. We study the harder, more realistic problem of leakage-safe zero-day detection of identity-based attacks, using the Sybil attack as the representative case. When evaluating every attack in a UAV benchmark as an unseen target, we find that point-wise novelty detectors detect volumetric and routing attacks but fail for Sybil attacks because a single Sybil flow lies inside the region occupied by the known attacks; adding model capacity does not help. We propose a leakage-safe, split-invariant representation of per-source behavioral rates—derived from identity fields without using their values—and score novelty against the benign profile rather than extrapolating a known attack direction. Under a source-disjoint leave-one-attack-class-out protocol, both a hyperparameter-free Mahalanobis detector and an attention autoencoder recover unseen-source Sybil flow (ROC of 0.91 and 0.98, respectively), where per-flow autoencoding fails and the known attack direction inverts. That two different model families succeed once the representation is right shows the representation, not the model complexity, to be decisive. We further find that a public UAV benchmark records device identities too degenerately to evaluate identity-based attacks, motivating identity-preserving benchmarks.