NeSySwarm-IDS: End-to-End Differentiable Neuro-Symbolic Logic for Privacy-Preserving Intrusion Detection in UAV Swarms

Abstract

Unmanned Aerial Vehicle (UAV) swarms operating in contested environments face a critical “semantic gap” between raw, high-velocity network traffic and high-level mission security constraints, compounded by the risk of privacy leakage during collaborative learning. Existing deep learning (DL)-based Network Intrusion Detection Systems (NIDSs) suffer from opacity, prohibitive resource consumption, and vulnerability to gradient leakage attacks in federated settings, while traditional rule-based systems fail to handle encrypted payloads and evolving attack patterns. To bridge this gap, we present NeSySwarm-IDS (Neuro-Symbolic Swarm Intrusion Detection System), an end-to-end differentiable neuro-symbolic framework that simultaneously achieves high accuracy, strong privacy guarantees, and built-in interpretability under resource constraints. NeSySwarm-IDS integrates an extremely lightweight 1D convolutional neural network with a differentiable Łukasiewicz fuzzy logic reasoner incorporating attack-specific rules. By aggregating only low-dimensional logic rule weights with calibrated differential privacy noise, we drastically reduce communication overhead while providing $(ϵ,\delta )$-DP guarantees with negligible utility loss. Extensive experiments on the UAV-NIDD dataset and our self-collected dataset demonstrate that NeSySwarm-IDS achieves near-perfect detection accuracy, significantly outperforming traditional machine learning baselines despite using limited training data. A detailed case study on GPS spoofing confirms the interpretability of our approach, providing axiomatic explanations suitable for autonomous mission verification. These results establish that end-to-end neuro-symbolic learning can effectively bridge the semantic gap in UAV swarm security while ensuring privacy and interpretability, offering a practical pathway for deploying trustworthy AI in contested environments.

1. Introduction

The proliferation of Unmanned Aerial Vehicle (UAV) swarms has transformed a wide range of domains, from disaster response and infrastructure inspection to tactical military operations [1,2]. However, as UAVs transition from remotely piloted units to autonomous swarms communicating via Mobile Ad Hoc Networks (MANETs), they become susceptible to sophisticated cyber-physical attacks [3,4,5]. Unlike traditional computer networks, UAV swarms operate under severe Size, Weight, and Power (SWaP) constraints, and their security breaches can lead to kinetic consequences, such as collisions or hijacking. Attacks targeting UAVs, such as GPS spoofing and jamming, are not merely data corruption events; they directly threaten the physical integrity and mission success of the swarm [6,7].

The communication architecture of UAV swarms typically relies on ad hoc networking with dynamic topologies, limited bandwidth, and heterogeneous protocols including MAVLink for telemetry and control, DroneID for identification, and proprietary command channels [8]. This complexity expands the attack surface significantly. Adversaries can exploit these channels to launch a variety of attacks, including port scanning, reconnaissance, DoS/DDoS, de-authentication, replay, man-in-the-middle, evil twin, GPS jamming/spoofing, brute-force, and fake landing packet attacks [9]. Detecting these attacks in real time while operating within limited resource budgets is a formidable challenge.

Designing a Network Intrusion Detection System (NIDS) for UAV swarms involves balancing a trilemma of accuracy, efficiency, and interpretability. Deep learning (DL) approaches [10,11] excel at uncovering complex attack patterns, but they operate as opaque “black boxes”. Their high computational demands often exceed the limited onboard resources of UAVs, causing significant inference delays that impede real-time threat response. In a mission-critical context, a neural network flagging “Malicious” without any explanation is not only untrustworthy but operationally dangerous. On the other hand, symbolic rule-based systems like Snort offer interpretability by design, yet they struggle to detect novel attacks or analyze encrypted traffic [12,13,14].

Furthermore, the distributed nature of UAV swarms necessitates collaborative learning. However, sharing raw traffic logs violates privacy regulations (e.g., GDPR) and Operational Security (OPSEC) protocols. Federated learning (FL) offers a partial solution but remains vulnerable to gradient leakage attacks [15] and imposes unsustainable communication overhead on bandwidth-limited UAV links [16]. Applying differential privacy (DP) to standard DL models often leads to a significant drop in utility due to the high dimensionality of the models [17].

To address these challenges, we introduce the neuro-symbolic (NeSy) paradigm to UAV security. As systematically reviewed by Colelough and Regli [18], NeSy AI, which combines the perceptual strengths of neural networks (System 1) with the reasoning capabilities of symbolic AI (System 2), has seen exponential growth since 2020. It aims to create hybrid systems with superior reasoning capabilities by integrating knowledge representation, learning and inference, logic and reasoning, and explainability [18,19]. By incorporating symbolic priors, NeSy models can achieve higher sample efficiency and lower computational footprint compared to purely data-driven approaches—they generalize well even with limited training data and require significantly fewer onboard resources, making them particularly suitable for resource-constrained edge deployments like UAV swarms. However, existing NeSy methods often treat neural and symbolic components separately or suffer from gradient saturation [20], preventing symbolic knowledge from effectively guiding the learning process [21]. Moreover, no prior NeSy system has been demonstrated to operate within milliwatt power budgets while providing formal privacy guarantees and tailored detection for the diverse set of attacks encountered in UAV networks.

In this paper, we propose NeSySwarm-IDS (Neuro-Symbolic Swarm Intrusion Detection System), a fully end-to-end differentiable neuro-symbolic framework that closes these gaps. Our main contributions are:

1.

Theoretical Unification of Attack-Specific Logic and Neural Learning: We formulate the NIDS problem as a constrained optimization task where 12 security rules (covering 10 attack types) act as differentiable regularizers via Łukasiewicz fuzzy logic. We provide a rigorous gradient analysis explaining why Łukasiewicz t-norm is uniquely suited for anomaly detection, empirically outperforming Gödel and Product t-norms by 3.4–4.0 percentage points in F1-score.

2.

SWaP-Optimized 1D CNN Architecture: We design a lightweight perception module based on a three-block 1D convolutional network with two fully connected layers, processing 54-dimensional flow features extracted from encrypted Wi-Fi traffic. The model comprises only 61k parameters, requires 162k FLOPs per inference (2.1 ms on Raspberry Pi 4B), and consumes 244 KB of memory—well within the constraints of resource-limited UAVs without requiring quantization.

3.

Privacy-Preserving Federated Neuro-Symbolic Learning (F-NSL): We introduce a novel FL protocol that aggregates only the low-dimensional logic rule weights (272 bytes per round), achieving $(ϵ,\delta )$-DP with negligible utility loss (an F1 drop lower than 1.2%) and reducing communication overhead by 98% compared to standard FL approaches.

4.

Interpretable, Verifiable Explanations: We demonstrate how NeSySwarm-IDS provides axiomatic explanations (e.g., “Attack detected because SignalAnomaly AND GPSJammingIndicator are true”), offering intrinsic interpretability in contrast to post hoc methods like LIME [22] and SHAP [23].

The remainder of this paper is organized as follows. Section 2 reviews related work. Section 3 details the NeSySwarm-IDS architecture. Section 4 describes the implementation on edge hardware. Section 5 presents experimental results and ablation studies. Section 6 discusses limitations, and Section 7 concludes the paper.

2. Literature Review

2.1. UAV Communication and Swarm Networks

As illustrated in the system architecture (see Figure 1), UAV swarms typically operate as Flying Ad Hoc Networks (FANETs), a specialized subset of Mobile Ad Hoc Networks (MANETs). These networks are characterized by high node mobility, a highly dynamic mesh topology, and intermittent connectivity [8]. The communication infrastructure is organized into a three-tier hierarchical model:

Figure 1. UAV swarm communication network architecture.

• Aerial Layer (V2V Communication): Drones form a decentralized mesh network using MANET routing protocols (e.g., AODV, OLSR) to maintain swarm cohesion. This layer predominantly relies on IEEE 802.11-based [24] Wi-Fi or proprietary RF links for low-latency peer-to-peer data exchange.
• Ground Layer (V2I/C2 Link): The Ground Control Station (GCS) manages the swarm via Command and Control (C2) channels, especially by leveraging data centers  [25]. This link often utilizes cellular (4G/5G) or long-range RF links, employing protocols like MAVLink for telemetry and DroneID for identification.
• Space Layer (V2S/S-Link): For beyond-line-of-sight (BLOS) operations, a satellite link (S-Link) provides global connectivity and backhaul for mission data.

The swarm’s cooperative nature necessitates the continuous exchange of high-fidelity telemetry (position, velocity, attitude) and mission-critical data. However, as depicted in the threat model (see Figure 2), this multi-tier architecture creates an extensive attack surface. Each communication interface—from the V2V mesh to the V2I control link—is vulnerable to sophisticated adversaries targeting the physical, network, and application layers through various cyber-physical attacks.

Figure 2. Typical threat scenarios of UAV swarm network.

2.2. Security Issues in UAV Swarms

UAV swarms are vulnerable to a range of cyber-physical attacks as illustrated in Figure 2, which can be categorized by their target and impact [26]:

• GPS Spoofing: Adversaries transmit counterfeit GPS signals to manipulate the UAV’s perceived position, potentially causing collisions or mission deviation. This attack exploits the lack of authentication in civilian GPSs.
• GPS Jamming: High-power noise is injected to overwhelm GPS receivers, leading to loss of positioning and navigation capability. Jamming can be carried out with low-cost software-defined radios.
• Command Injection: Attackers inject malicious MAVLink or C2 packets to override legitimate commands, potentially causing the UAV to land, return home, or engage in dangerous maneuvers.
• Denial of Service (DoS): Flooding the network with bogus traffic exhausts bandwidth and computational resources, disrupting swarm coordination.
• Sybil and Replay Attacks: Adversaries forge multiple identities or replay captured packets to deceive consensus mechanisms or authentication protocols.

The unique challenges of UAV swarm intrusion detection—dynamic topology, resource constraints, encrypted traffic, and the severe physical consequences of detection errors—directly translate into a set of design requirements: lightweight architectures that respect onboard resource limits such as P4 [27,28], adaptivity to handle evolving network conditions, the ability to detect anomalies without relying on decrypted payloads, and interpretability to enable human verification of alerts before acting. Moreover, the collaborative nature of swarm operations introduces additional privacy concerns, further motivating the need for privacy-preserving mechanisms during distributed learning.

2.3. Neuro-Symbolic AI in Cybersecurity

Neuro-symbolic (NeSy) AI aims to integrate neural learning with symbolic reasoning [19]. Colelough and Regli [18] provide a comprehensive taxonomy, categorizing NeSy research into five foundational areas: (1) knowledge representation, (2) learning and inference, (3) explainability and trustworthiness, (4) logic and reasoning, and (5) meta-cognition. Their systematic review of 158 papers (2020–2024) reveals that while learning and inference (63%) and logic and reasoning (35%) are well-explored, explainability and trustworthiness (28%) is less represented, and meta-cognition (5%) remains a significant gap. Our work, NeSySwarm-IDS, directly addresses the intersection of logic and reasoning, learning and inference, and explainability, contributing to these under-explored areas through design.

In cybersecurity, NeSy applications are emerging. Although algorithms such as XGBoost and neural network have achieved remarkable success across various domains [29,30,31,32,33,34,35,36] their propensity for overfitting often impedes practical deployment in UAV communication scenarios, suggesting that integrating neuro-symbolic methods can provide a balanced trade-off. A prominent example is MoCQ by Li et al. [37], which combines LLMs with static analysis for automated vulnerability detection. MoCQ uses LLMs to generate detection queries in domain-specific languages (DSLs) like CodeQL, and refines them via a feedback loop with a symbolic validator. This “neural generation + symbolic execution” paradigm is powerful but distinct from our approach: MoCQ uses LLMs as a pattern generator external to the detection loop, whereas NeSySwarm-IDS embeds a differentiable logic reasoner within the neural network, enabling end-to-end gradient-based learning.

Another closely related work is by Kalutharage et al. [38], who propose a neuro-symbolic framework for IoT attack detection. Their model integrates an autoencoder for anomaly detection with SHAP for feature explanation and a cybersecurity knowledge graph to validate attacks and map them to CIA principles and the MITRE ATT&CK framework. The work shares our goal of enhancing explainability and leveraging domain knowledge. However, key differences exist: (i) their symbolic component is a static knowledge graph queried post hoc, while ours is a differentiable logic layer that actively participates in training; (ii) their focus is on IoT networks in general, whereas we target the unique SWaP and communication constraints of UAV swarms; (iii) we provide formal privacy guarantees via federated learning on logic weights, which their work does not address.

A significant line of research utilizes Logic Tensor Networks (LTNs) for network intrusion detection. Onchis et al. [39] proposed an LTN-based classifier for monitoring security alerts, introducing the concept of interactive accuracy—the ability to query the model’s logical satisfaction levels at any time. Their model, tested on KDD99 and CIC-IDS2017, achieved 0.95 accuracy and demonstrated how logical constraints can mitigate overfitting. More recently, Bizzarri et al. [40] developed an NSAI NIDS specifically targeting the challenge of detecting unknown (zero-day) attacks. Their key innovation is a Hybrid Loss function that combines standard cross-entropy loss with a logical satisfiability (SAT) loss derived from LTN axioms. By training a 1D CNN within an LTN framework and using the SAT loss to penalize misclassifications between benign and malicious traffic at a high level, they demonstrated an 8–12% improvement in unknown attack detection accuracy over vanilla CNNs on the CIC-IDS2017 dataset. This work is methodologically closest to ours, as both use logical constraints to regularize neural network training.

However, our contributions extend beyond these LTN-based approaches in several crucial ways. First, we employ Łukasiewicz fuzzy logic instead of the product t-norm used by both Onchis et al. and Bizzarri et al. As analyzed by van Krieken et al. [20], the choice of t-norm critically affects gradient flow during end-to-end training:

• Gödel t-norm: $a\wedge b=min(a,b)$. Gradients vanish when $a>b$.
• Product t-norm: $a\wedge b=a·b$. Gradients can become extremely small.
• Łukasiewicz t-norm: $a\wedge b=max(0,a+b-1)$. It maintains non-zero gradients across a wider range, preventing vanishing gradients.

Our work is the first to apply Łukasiewicz logic to network intrusion detection and to empirically validate its advantage over product and Gödel t-norms in this domain. Second, our lightweight perception module is specifically optimized for SWaP-constrained UAVs, whereas prior LTN models are designed for general network traffic on server-class hardware. Third, we introduce a novel federated privacy-preserving protocol (F-NSL) that aggregates only low-dimensional logic weights with differential privacy—a feature not considered in any previous NeSy NIDS. Finally, our rules are explicitly mapped to UAV-specific attack types (e.g., GPS spoofing/jamming), whereas earlier axioms focus on the benign/attack dichotomy.

While server-grade NeSy implementations exist (e.g., DeepProbLog [41], LTN [42]), no prior work demonstrates a fully differentiable neuro-symbolic detector operating within milliwatt power budgets and delivering real-time, attack-specific explanations on UAV onboard computers with formal privacy guarantees. NeSySwarm-IDS bridges this gap by co-designing a lightweight perception frontend with a Łukasiewicz logic reasoner, with rules explicitly crafted for UAV-specific threats.

2.4. Federated Learning and Privacy-Preserving Mechanisms

Federated learning (FL) enables multiple UAVs to collaboratively train a model without sharing raw data [43]. However, standard FL requires each client to transmit the full gradient update, which for a deep NIDS can be several megabytes per round—a prohibitive overhead for congested UAV ad hoc networks [16]. Moreover, Zhu et al. [15] demonstrated that raw gradients can be inverted to reconstruct original training samples with high fidelity, rendering conventional FL vulnerable in OPSEC environments. Even aggregated gradients can leak sensitive information, especially when batch sizes are small or the model is overparameterized.

Recent advances in gradient leakage attacks show that defenses must go beyond simple aggregation. Defense mechanisms include:

• Differential Privacy (DP): Adds calibrated noise to gradients to bound the information leakage. DP-SGD [44] is the de facto standard, but it injects significant noise into hundreds of thousands of parameters, often degrading the F1-score by >10% under modest privacy budgets ($ϵ=2$) [17]. The high dimensionality of deep learning models is the fundamental cause of this utility collapse.
• Homomorphic Encryption (HE): Allows computation on encrypted gradients, but incurs massive computational overhead and is impractical for resource-constrained UAVs.
• Secure Multi-Party Computation (SMPC): Splits gradients among multiple servers, but requires high communication and coordination, unsuitable for dynamic swarm networks.

Our key insight is that the symbolic layer—the mapping from latent features to logical predicates and the subsequent rule evaluation—is orders of magnitude lower-dimensional (e.g., 16 predicates vs. 61k CNN weights) yet encodes the essence of the detection policy. By performing federated aggregation only on these logic weights and protecting them with calibrated Gaussian noise, we achieve strong $(ϵ,\delta )$-DP while incurring negligible accuracy loss and reducing communication cost by over 98%. This insight, tailored to the unique structure of NeSy models, has not been explored in prior FL or NeSy literature. Furthermore, the low-dimensional nature of the logic layer makes it amenable to lightweight cryptographic primitives if stronger security is needed in the future.

3. Methodology

3.1. System Overview

Figure 3 illustrates the NeSySwarm-IDS framework. The system is deployed on each UAV node, monitoring network traffic to detect attacks targeting the individual UAV or the swarm collectively. It consists of three trainable stages: (i) a lightweight perception module based on a 1D convolutional neural network (1D CNN) that processes tabular flow features; (ii) a semantic lifting layer mapping the latent representation to truth degrees of atomic predicates via sparse group lasso; (iii) a differentiable Łukasiewicz logic reasoner evaluating attack-specific rules. The system can be trained centrally or via our Federated Neuro-Symbolic Learning (F-NSL) protocol.

Figure 3. High-level architecture of NeSySwarm-IDS.

3.2. Lightweight 1D CNN Perception Module

Unlike raw packet processing approaches that require handling full payloads, our method operates exclusively on tabular flow features extracted from network traffic. This design choice significantly reduces computational overhead while preserving the statistical patterns necessary for accurate attack detection. For each 1 s window, we compute a set of 54 statistical features derived from the UAV-NIDD dataset fields (bidirectional flow mode), as detailed in Section 5.1.1.

These features are normalized to zero mean and unit variance. To capture local interactions among related features (e.g., groups of protocol-specific statistics), we design a lightweight 1D convolutional architecture that treats the feature vector as a 1D signal of length 54 with one channel. After empirical exploration balancing accuracy and efficiency, we settled on a three-block architecture (Table 1) that progressively increases the number of filters while reducing spatial dimensions via max-pooling, followed by two fully connected layers to produce the latent representation $\mathbf{z}\in {\mathbb{R}}^K$ (with $K=16$, matching the number of predicates).

Table 1. Detailed architecture of the 1D CNN perception module. Input: $54\times 1$ (54 features, 1 channel). Output: $\mathbf{z}\in {\mathbb{R}}^{16}$.

Layer	Type	Filters	Kernel	Stride	Output Size
Input	Reshape	-	-	-	$54\times 1$
Block1	Conv1D	32	3	1	$54\times 32$
	BatchNorm	-	-	-	$54\times 32$
	ReLU	-	-	-	$54\times 32$
	MaxPool1D	-	2	2	$27\times 32$
Block2	Conv1D	64	3	1	$27\times 64$
	BatchNorm	-	-	-	$27\times 64$
	ReLU	-	-	-	$27\times 64$
	MaxPool1D	-	2	2	$13\times 64$
Block3	Conv1D	128	3	1	$13\times 128$
	BatchNorm	-	-	-	$13\times 128$
	ReLU	-	-	-	$13\times 128$
	MaxPool1D	-	2	2	$6\times 128$
	GlobalAvgPool1D	-	-	-	128
	Dense	-	-	-	64
	Dense	-	-	-	16

Each convolutional block contains:

• A1D convolution with kernel size 3, stride 1, and same padding;
• Batch normalization;
• ReLU activation;
• A max-pooling layer of size 2 and stride 2 (downsampling by a factor of 2).

Starting from an input of size $54\times 1$, the three pooling operations reduce the spatial dimension to $6\times 128$ (since $54\to 27\to 13\to 6$). Global average pooling collapses the spatial dimension, producing a 128-dimensional vector, which is then passed through two fully connected layers (128 → 64 → 16) to obtain the latent representation $\mathbf{z}$.

The total number of trainable parameters is approximately 61k, and the model requires about 162k floating-point operations per inference—well within the capacity of a Raspberry Pi 4B’s Cortex-A72 CPU. Empirical measurements on the actual hardware show that inference completes in under 2.1 ms on a single core, consuming less than 35% of a CPU core during continuous operation. This leaves ample headroom for real-time packet capture, feature extraction, and other concurrent tasks. Consequently, the full-precision FP32 model can be deployed without quantization or pruning, maximizing detection accuracy while satisfying all SWaP constraints.

3.3. Semantic Lifting and Predicate Grounding

For instance, we define a set of $K=16$ atomic predicates $\mathcal{P}$ (Table 2), each representing a high-level property relevant to UAV security based on the attack types present in the UAV-NIDD dataset. The truth degree $I\left(p_i\left(x\right)\right)\in [0,1]$ for input x is computed as:

$$I\left(p_i\left(x\right)\right)=\sigma ({\mathbf{w}}_i^T\mathbf{z}+b_i),$$

(1)

where $\mathbf{z}\in {\mathbb{R}}^K$ is the latent representation from the perception module, ${\mathbf{w}}_i\in {\mathbb{R}}^K$, $b_i\in \mathbb{R}$, and $\sigma$ is the sigmoid function. Note that we reuse the same dimensionality K for both the latent space and the number of predicates, allowing the network to learn a compact representation directly optimized for predicate grounding.

Table 2. Typical atomic predicates used in NeSySwarm-IDS.

Predicate	Description
HighPacketRate(x)	Packet rate exceeds 3$\sigma$ threshold
HighByteRate(x)	Byte rate exceeds 3$\sigma$ threshold
PortScanIndicator(x)	SYN scan, TCP connect, or UDP scan pattern
SYNFloodPattern(x)	High ratio of SYN packets without ACK
UDPFloodPattern(x)	High volume of UDP packets to random ports
ICMPFloodPattern(x)	High rate of ICMP echo requests
ReplayIndicator(x)	Duplicate packet sequences with same timestamp
MITMIndicator(x)	ARP spoofing or rogue AP presence
EvilTwinIndicator(x)	Multiple APs with same SSID but different BSSID
SignalAnomaly(x)	Unusual radiotap signal strength fluctuations
GPSJammingIndicator(x)	Loss of GPS-like signal patterns
DeAuthFlood(x)	High rate of de-authentication frames
BruteForceIndicator(x)	Repeated failed login attempts (FTP/SFTP)
FakeLandingPacket(x)	Anomalous landing command packet pattern
UntrustedSource(x)	Packet from unauthorized MAC/IP
ConsensusDeviation(x)	Position differs from neighbors (if available)

To enforce that each predicate depends on only a few interpretable features, we apply a sparse group lasso penalty during training:

$${\mathcal{L}}_{\mathrm{sparse}}=\sum _{i=1}^K\left(\alpha {\parallel {\mathbf{w}}_i\parallel }_1+(1-\alpha ){\parallel {\mathbf{w}}_i\parallel }_2\right),$$

(2)

The parameter $\alpha =0.95$ was chosen after a small grid search over $\alpha \in \{0.9,0.95,0.99\}$ on a validation set, where $0.95$ gave the best trade-off between sparsity and accuracy. The threshold $0.01$ for hard thresholding was selected empirically: weights below $0.01$ contribute negligibly to the predicate output (since the sigmoid saturates) and can be safely pruned without affecting performance.

After training, we perform hard thresholding: any weight $|w_{i,j}| < 0.01$ is set to zero, and the corresponding latent dimension can be pruned. This yields compact, human-readable definitions.

The predicates were designed based on expert knowledge of UAV attacks and the characteristics of dataset. For example, SignalAnomaly captures unusual fluctuations in radiotap signal strength, which may indicate jamming or spoofing. HighPacketRate detects abnormally high packet rates characteristic of DoS floods. PortScanIndicator combines multiple port scan signatures. This mapping from low-level features to high-level concepts enables interpretability.

For example, the predicate SignalAnomaly is computed as $\sigma ({\mathbf{w}}_{\mathrm{sig}}^T\mathbf{z}+b_{\mathrm{sig}})$, where after sparse group lasso, the dominant contributions come from features such as “radiotap.dbm_antsignal mean deviation” and “radiotap.datarate variance”. This yields an interpretable mapping: SignalAnomaly is high when signal strength fluctuates abnormally. We elaborate these predicate computations in Appendix A, which provides the learned mapping from features to predicates.

3.4. Differentiable Łukasiewicz Logic Reasoner

We encode a knowledge base $\mathcal{K}$ of 12 rules derived from the attack types present in the UAV-NIDD dataset (Table 3). Each rule corresponds to one or more specific attack categories. For instance, R1 combines multiple scanning signatures to detect reconnaissance attempts. R2–R4 cover different DoS flooding variants. R5 detects de-authentication floods. R6 handles replay attacks. R7 and R8 address MITM and Evil Twin attacks. R9 targets GPS jamming/spoofing via signal anomalies. R10 detects brute-force attacks. R11 handles fake landing packets. R12 is a composite rule for suspicious activity involving untrusted sources.

Table 3. Attack-specific rules encoded in Łukasiewicz logic.

ID	Rule (First-Order Logic)	Attack Type
R1	PortScanIndicator → Attack	Port Scanning
R2	SYNFloodPattern → Attack	SYN Flood DoS
R3	UDPFloodPattern → Attack	UDP Flood DoS
R4	ICMPFloodPattern → Attack	ICMP Flood DoS
R5	DeAuthFlood → Attack	De-Authentication Flood
R6	ReplayIndicator → Attack	Replay Attack
R7	MITMIndicator → Attack	Man-in-the-Middle
R8	EvilTwinIndicator → Attack	Evil Twin Attack
R9	SignalAnomaly ∧ GPSJammingIndicator → Attack	GPS Jamming/Spoofing
R10	BruteForceIndicator → Attack	Brute-Force
R11	FakeLandingPacket → Attack	Fake Landing Packet
R12	(HighPacketRate ∨ HighByteRate) ∧ UntrustedSource → Attack	Suspicious Traffic

To enable gradient-based optimization, we relax the Boolean operators using Łukasiewicz t-norms and t-conorms:

$$\neg a = 1 - a,$$

(3)

$$a\wedge b = \max (0,a + b - 1),$$

(4)

$$a\vee b = \min (1,a + b),$$

(5)

$$a\to b = \min (1,1 - a + b).$$

(6)

For instance, consider a sample x where the perception module yields predicate truth values SignalAnomaly = 0.94 and GPSJammingIndicator = 0.89. The satisfaction of rule R9 (SignalAnomaly ∧ GPSJammingIndicator → Attack) is computed using Łukasiewicz operators:

$$\mathrm{Sat}\left(R9\right)=\min (1,1-(0.94\wedge 0.89)+1)=\min (1,1-\max (0,0.94+0.89-1)+1)=0.95.$$

This value contributes to the logical loss ${\mathcal{L}}_{\mathrm{logic}}$.

For a given input x, the satisfaction of a rule $\varphi$ is computed by recursively applying these operators. The overall logical loss is defined as the mean squared error between the desired satisfaction (1.0) and the actual satisfaction:

$${\mathcal{L}}_{\mathrm{logic}}={\displaystyle \frac{1}{\left|\mathcal{K}\right|}}\sum _{\varphi \in \mathcal{K}}{(1-\mathrm{Sat}\left(\varphi \right|x))}^2.$$

(7)

The total loss combines cross-entropy for classification, logical consistency, and sparsity regularization:

$${\mathcal{L}}_{\mathrm{total}}={\mathcal{L}}_{\mathrm{CE}}+{\lambda }_{\mathrm{logic}}{\mathcal{L}}_{\mathrm{logic}}+{\lambda }_{\mathrm{reg}}{\mathcal{L}}_{\mathrm{sparse}},$$

(8)

where ${\lambda }_{\mathrm{logic}}=0.1$ and ${\lambda }_{\mathrm{reg}}=1e-4$ balance the terms.

The values ${\lambda }_{\mathrm{logic}}=0.1$ and ${\lambda }_{\mathrm{reg}}=1\times {10}^{-4}$ were determined through a grid search on the validation set, balancing classification accuracy, logical consistency, and sparsity. We initially scanned ${\lambda }_{\mathrm{logic}}\in \{0.01,0.1,1.0\}$ and ${\lambda }_{\mathrm{reg}}\in \{{10}^{-5},{10}^{-4},{10}^{-3}\}$. The combination $(0.1,{10}^{-4})$ yielded the highest F1-score while maintaining logical satisfiability above $0.95$.

Our loss formulation parallels the Hybrid Loss approach of Bizzarri et al. [40], who also combine cross-entropy with a logical satisfiability term. However, we introduce two key innovations: (i) we use Łukasiewicz logic for superior gradient flow, whereas they use product t-norm; (ii) our logical loss operates over multiple attack-specific rules (Table 3), enabling fine-grained regularization tailored to UAV network threats.

3.5. Federated Neuro-Symbolic Learning with Differential Privacy

We propose a federated protocol that operates only on the logic weights $\Theta ={\{{\mathbf{w}}_i,b_i\}}_{i=1}^K$ (dimension $d=K\times (K+1)=16\times 17=272$ for $K=16$). The perception module weights are pre-trained on a public corpus and remain frozen during federation; they can also be fine-tuned locally without sharing. Algorithm 1 details the procedure.

Algorithm 1 Federated Neuro-Symbolic Learning (F-NSL) with differential privacy

1: Server: initialize global logic weights ${\Theta }_g$.   2: for each communication round $t=1,2,\dots$ do   3: sample a subset $\mathcal{C}$ of UAV clients   4: broadcast ${\Theta }_g$ to all clients in $\mathcal{C}$   5: for each client $c\in \mathcal{C}$ in parallel do   6: receive ${\Theta }_g$, initialize local model with ${\Theta }_g$   7: for each local mini-batch do   8: compute $\nabla ={\nabla }_{\Theta }{\mathcal{L}}_{\mathrm{total}}$ on local data   9: clip gradient: $\tilde{\nabla }=\nabla /\max \left(1,{\displaystyle \frac{{\parallel \nabla \parallel }_2}{C}}\right)$ 10: end for 11: accumulate average gradient $\overline{\nabla }$ over batches 12: add Gaussian noise: ${\tilde{\nabla }}_{\mathrm{DP}}=\overline{\nabla }+\mathcal{N}(0,{\sigma }^2{C}^2\mathbf{I})$ 13: send ${\tilde{\nabla }}_{\mathrm{DP}}$ to server 14: end for 15: aggregate: ${\Theta }_g\leftarrow {\Theta }_g-\eta {\displaystyle \frac{1}{\left|\mathcal{C}\right|}}{\sum }_c{\tilde{\nabla }}_{\mathrm{DP}}^{\left(c\right)}$ 16: end for

In Algorithm 1, we explicitly clip each gradient to have ${\mathsf{\ell }}_2$ norm at most C. Specifically, after computing ∇, we replace it with $\nabla /\max \left(1,{\parallel \nabla \parallel }_2/C\right)$. This ensures that the ${\mathsf{\ell }}_2$ norm of the clipped gradient is exactly C if ${\parallel \nabla \parallel }_2>C$, and remains unchanged otherwise. Thus, the condition ${\parallel {\nabla }_{\Theta }\parallel }_2\le C$ is enforced deterministically for every client before adding noise.

We apply the Gaussian mechanism with noise multiplier $\sigma ={\displaystyle \frac{\sqrt{2ln(1.25/\delta )}{\Delta }_f}{ϵ}}$, where ${\Delta }_f$ is the ${\mathsf{\ell }}_2$ sensitivity of the gradient sum, bounded by the clipping norm C. Since $\Theta$ is extremely low-dimensional ($d=272$), the added noise is much less destructive than in DP-SGD applied to the full 1D CNN (which has around 61k parameters). We empirically set $C=1.0$, $\delta ={10}^{-5}$.

The privacy cost is tracked using the moments accountant [44]. With $\sigma$ chosen as above, after T rounds, the overall $(ϵ,\delta )$-DP guarantee holds. In our experiments, we set $T=100$, $ϵ=2$, achieving a strong privacy guarantee with negligible utility loss.

4. Implementation on Edge Hardware

4.1. Testbed Overview

Our experimental testbed consists of a ground station and multiple UAV nodes, each equipped with a Raspberry Pi 4B (4GB RAM, Cortex-A72 CPU @ 1.5 GHz) running Ubuntu 20.04 LTS. The ground station runs Windows 11 with an Intel i7-1360P CPU and 32GB RAM, serving as the central server for federated aggregation and offline training.

4.2. Deployment Pipeline

The NeSySwarm-IDS model is designed for direct deployment on resource-constrained UAV onboard computers without requiring quantization or pruning. The implementation pipeline consists of the following steps:

1.

Offline Training: The full model (perception module + logic layer) is trained on the ground station server using PyTorch 2.5.1. Training is performed on the combined dataset with the loss function described in Section 3. The trained perception module weights are exported to ONNX format and then converted to a TensorFlow Lite-compatible flatbuffer for deployment. Note that we use full FP32 precision throughout; no quantization is applied, as the model’s size (approx. 244 KB) and inference cost (162k FLOPs) are already well within the Raspberry Pi 4B’s capabilities.

2.

Model Conversion: The exported model is converted to a C++ compatible flatbuffer using the TensorFlow Lite converter. The resulting file is linked with the TensorFlow Lite runtime, which is compiled for ARM Cortex-A72. The runtime is optimized for mobile CPUs and supports all standard operators (Conv2D, BatchNorm, ReLU, etc.) in FP32.

3.

Onboard Integration: The runtime is embedded into a lightweight C++ executable that runs as a background service on the UAV. The executable performs three main tasks in a loop every second:

• Captures live network packets using libpcap.
• Extracts the 54 statistical features defined in Section 3.2 from the accumulated packets.
• Feeds the feature vector to the model and retrieves the attack classification and predicate truth values.

The service communicates with the ground station via a secure WebSocket connection for reporting alerts and, in federated mode, for exchanging model updates.

4.3. Real-Time Packet Capture and Feature Extraction

On each UAV, packets are captured using a dedicated capture thread that writes raw packets to a circular buffer. Every second, the main thread processes the buffer and computes the 54 statistical features (bidirectional flow mode) as defined in Section 3.2. The feature extraction module is implemented in C for maximum efficiency and covers the following categories:

• Packet size statistics: mean, standard deviation, min, max of frame.len.
• Inter-arrival time statistics: mean, std, min, max of frame.time_delta_displayed.
• Protocol distribution: counts of ARP, IP (by protocol type), TCP, UDP, ICMP packets.
• TCP flag counts: SYN, ACK, RST, FIN packets and their ratios.
• Radiotap features: mean signal strength (radiotap.dbm_antsignal), data rate (radiotap.datarate), channel frequency.
• WLAN features: retransmission ratio (wlan.fc.retry), management/control frame counts, unique BSSID count.
• Flow-level aggregates: total bytes, total packets, flow duration.

All features are normalized using precomputed mean and standard deviation from the training set. The normalized vector is then passed to the 1D CNN for inference. No payload bytes are stored or processed, significantly reducing memory and computational overhead.

4.4. Inference Optimization

To ensure real-time operation, we employ several optimization techniques:

• Threading: The capture thread and inference thread run on separate CPU cores. The Raspberry Pi 4B’s quad-core Cortex-A72 allows simultaneous packet capture, feature extraction, and inference with minimal contention. Measurements show that the inference thread consumes less than 45% of a single core, leaving ample capacity for other tasks.
• Memory Pooling: Input tensors and intermediate buffers are pre-allocated at startup and reused for each inference, avoiding dynamic memory allocation and reducing latency jitter.
• Compiler Optimizations: The feature extraction and inference code is compiled with ‘-O3 -march=armv8-a+crc’ to leverage CPU-specific instructions.
• Priority Scheduling: The capture and inference threads are assigned real-time priorities using ‘sched_setscheduler’ to minimize scheduling delays.

With these optimizations, end-to-end latency from packet reception to alert generation averages 2.1 ms (measured over 10,000 inferences), well below the 1 s window, ensuring that the system can operate in real time.

4.5. Resource Monitoring

We instrument the onboard service to continuously monitor resource usage:

• Latency: Each inference is timestamped using the ARM performance counter (‘cntvct_el0’), and the time from feature extraction start to output is logged.
• Power Consumption: An IKEA Tretakt USB power monitor is placed between the power source and the Raspberry Pi. Current and voltage readings are sampled at 10 Hz and correlated with inference events.
• Memory Usage: Peak and average resident set size (RSS) are obtained from ‘/proc/self/statm’ and logged every second.

These metrics are periodically reported to the ground station for performance analysis and are also stored locally for offline evaluation.

4.6. Federated Learning Client Implementation

In federated mode, each UAV acts as a client participating in the Federated Neuro-Symbolic Learning (F-NSL) protocol described in Section 3.5. The implementation extends the base deployment as follows:

• Local Gradient Computation: The onboard service includes a second inference mode that enables backpropagation. After accumulating a configurable number of samples (typically 100–200), the client computes gradients of the total loss with respect to the logic weights $\Theta ={\{{\mathbf{w}}_i,b_i\}}_{i=1}^K$ (dimension $d=272$). Gradients are computed using TensorFlow Lite’s gradient operators, which are enabled via a custom build.
• Differential Privacy: Before transmission, gradients are clipped to a maximum $L_2$ norm $C=1.0$, and Gaussian noise with scale $\sigma C$ is added to satisfy $(ϵ,\delta )$-DP. The noise multiplier $\sigma$ is precomputed based on the desired privacy budget ($ϵ=2$, $\delta ={10}^{-5}$) using the moments accountant.
• Communication Protocol: Clients connect to the ground station server via a secure WebSocket channel using TLS 1.3. Updates are serialized as Protocol Buffers and compressed with zlib (typical compressed size  500 bytes). Communication occurs every 10 min or when a local buffer of 500 samples is filled, whichever comes first.
• Model Update: Upon receiving aggregated global weights from the server, the client updates its local logic layer and continues inference with the new weights. The perception module weights remain unchanged during federation, as they are pre-trained and frozen.

This design ensures that federated learning imposes minimal additional overhead on the UAV: gradient computation adds approximately 8 ms per sample (amortized over the buffer), and communication occurs infrequently with negligible bandwidth usage.

The NeSySwarm-IDS implementation on Raspberry Pi 4B demonstrates that a 61k-parameter 1D CNN with full FP32 precision can operate in real time while consuming less than 35% CPU and minimal memory. The system supports both standalone and federated learning modes, with the latter adding differential privacy guarantees and reducing communication overhead by over 98% compared to standard FL approaches. This practical deployment validates the feasibility of neuro-symbolic intrusion detection on resource-constrained UAV swarms.

5. Experimental Evaluation

5.1. Experimental Setup

5.1.1. Datasets

In our experiments, we employ two datasets:

• UAV-NIDD [9]: A publicly available dataset focusing on encrypted Wi-Fi traffic in UAV networks. It contains a wide range of attacks, including variants of port scanning (SYN, TCP Connect, UDP), reconnaissance, DoS/DDoS (ICMP Flood, UDP Flood, SYN Flood), de-authentication, replay, man-in-the-middle (MITM), evil twin, GPS jamming and spoofing, brute-force, and fake landing packet attacks. The dataset provides 54 bidirectional flow features, encompassing packet and inter-arrival time statistics, protocol and TCP flag counts, radiotap metrics, WLAN attributes, and flow-level aggregates. A detailed categorization and feature-to-predicate mapping are provided in Appendix A. It contains a total of 68,736 labeled examples. To emphasize the generalization capability of our neuro-symbolic approach, we perform a stratified 20/20/60 train/validation/test split, using only 20% of the data for training.
• UAV-Swarm-SimHack (Self-Collected): Collected on a real-world testbed consisting of a ground station (Windows 11, Intel i7-1360P, 32GB RAM) and multiple UAV nodes (Raspberry Pi 4B, Ubuntu 20.04). The testbed captures network traffic during benign operations and under various attacks, including GPS spoofing, command injection, and DoS. The dataset comprises 500,000 labeled flows, with features extracted in the same manner as UAV-NIDD, but with fewer attack categories. We use the same 20/20/60 split to maintain consistency.

5.1.2. Hardware and Baselines

We evaluate inference performance on a Raspberry Pi 4B (Cortex-A72 CPU, 4GB RAM) representing the UAV onboard computer. The following baselines are used for comparison (federated baselines are evaluated separately in Section 3.5):

• 1D CNN: A lightweight 1D convolutional network with the same architecture as our perception module (three blocks, 61k parameters) but without the logical reasoning layer.
• XGBoost: A gradient-boosted tree classifier trained on the tabular features, with default hyperparameters.
• Random Forest (RF): An ensemble of 100 decision trees, max depth 10.

All deep learning models are implemented in PyTorch and, for deployment, converted to TensorFlow Lite format. No quantization is applied as the FP32 models already meet resource constraints.

5.2. Detection Performance

Table 4 summarizes the detection performance on both datasets. NeSySwarm-IDS achieves an F1-score of 0.972 on UAV-NIDD and 0.960 on the self-collected dataset, outperforming all baselines by 7.7–10.7 percentage points on UAV-NIDD and 11.5–14.5 percentage points on the self-collected dataset, despite being trained on only 20% of the data. The high recall across both datasets (0.970 and 0.958) confirms that the logical regularizer enables the model to generalize effectively from limited training examples, whereas purely data-driven baselines overfit and fail to capture unseen patterns. Notably, the 1D CNN without logic consistently underperforms compared to tree-based methods, highlighting the importance of feature engineering in traditional ML.

Table 4. Detection performance on UAV-NIDD and self-collected dataset. All models trained on 20% of data.

Method	UAV-NIDD			UAV-Swarm-SimHack
	Precision	Recall	F1	Precision	Recall	F1
1D CNN (no logic)	0.860	0.870	0.872	0.810	0.820	0.815
XGBoost	0.892	0.898	0.895	0.842	0.848	0.845
Random Forest	0.885	0.895	0.890	0.836	0.844	0.840
NeSySwarm-IDS	0.974	0.970	0.972	0.962	0.958	0.960

5.3. Robustness to Zero-Day Attacks

To evaluate the ability to detect previously unseen attacks, we simulate a zero-day scenario by holding out all GPS spoofing samples from the UAV-NIDD training set. Table 5 shows that NeSySwarm-IDS maintains a detection rate of 71.4% on the unseen spoofing class, whereas the 1D CNN baseline drops to 18.2%. This confirms that the logical invariants (e.g., R9: SignalAnomaly ∧ GPSJammingIndicator → Attack) capture fundamental physical and protocol properties that generalize beyond specific attack signatures.

Table 5. Zero-day GPS spoofing detection (UAV-NIDD).

Method	Detection Rate (%)	F1
NeSySwarm-IDS	71.4	0.74
1D CNN (no logic)	18.2	0.21
XGBoost	12.5	0.15
Random Forest	9.8	0.11

We emphasize that although the logical rules themselves are fixed, they encode high-level physical and protocol invariants (e.g., R9: SignalAnomaly ∧ GPSJammingIndicator → Attack) that are not tied to specific attack signatures. The neural perception module learns to ground these predicates from raw features; when a novel attack manifests, it may still trigger the same predicates (e.g., an unforeseen jamming technique would still cause signal anomalies). Thus, the fixed rules act as a semantic bottleneck that generalizes beyond known attack instances, as demonstrated by the 71.4% detection rate on unseen GPS spoofing samples.

5.4. Deployment Performance on Raspberry Pi 4B

Table 6 reports the resource footprint of NeSySwarm-IDS on the target hardware (Raspberry Pi 4B). The model operates well within the available resources, leaving ample headroom for packet capture and other concurrent tasks.

Table 6. Deployment performance on Raspberry Pi 4B.

Metric	Value
Parameters	61k
FLOPs per inference	162k
FP32 model size	244 KB
Avg. inference latency (single core)	2.1 ms
CPU utilization (continuous)	35%
Peak memory (RSS)	1.2 MB

We also measured the computational overhead of the logic reasoning layer separately. The logic layer consists of a matrix multiplication for predicate grounding ($16\times 16$ weight matrix) and evaluation of 12 short rules, each involving a few fuzzy operations. Profiling on the Raspberry Pi 4B shows that this adds fewer than 500 CPU cycles per inference, increasing total latency from 2.0 ms (CNN only) to 2.1 ms (full NeSy). Thus, the overhead is negligible and does not affect real-time operation.

5.5. Ablation Studies

We conduct three ablation experiments to validate key design choices. Table 7 summarizes the results on the UAV-NIDD dataset.

Table 7. Summary of ablation studies on UAV-NIDD. All variants use the same 20% training split.

Ablation	Variant	F1
t-norm comparison
	Łukasiewicz (ours)	0.972
	Gödel	0.938
	Product	0.932
Knowledge base composition
	All 12 rules	0.972
	Single most frequent rule (R1)	0.936
	12 random rules	0.912
	No logic (1D CNN baseline)	0.872
Number of rules
	1 rule	0.922
	3 rules	0.944
	6 rules	0.961
	9 rules	0.969
	12 rules	0.972

The results demonstrate that:

• Łukasiewicz t-norm significantly outperforms Gödel and Product t-norms, validating our theoretical analysis of gradient flow.
• The full knowledge base of 12 rules yields the best performance; using only a single rule degrades F1 below the no-logic baseline. Interestingly, using 12 random rules achieves an F1 of 0.912, which is higher than the no-logic baseline (0.872) but still below the full knowledge base (0.972). This suggests that even arbitrary rules provide some regularization, but domain-specific knowledge is crucial for optimal performance.
• Performance improves substantially as rules are added, with the F1 score increasing from 0.922 with a single rule to 0.972 with all 12 rules—a 5.0 percentage point gain. The improvement is most pronounced when expanding from one to six rules, after which diminishing returns set in, suggesting that a core set of rules covers the majority of attack scenarios.

5.6. Ablation Study: Differential Privacy–Utility Trade-Off

We evaluate the Federated Neuro-Symbolic Learning (F-NSL) protocol under varying privacy budgets $ϵ\in \{0.1,0.5,1,2,5,\infty \}$ ($\delta ={10}^{-5}$) on the UAV-Swarm-SimHack dataset. Table 8 reports F1-score and communication cost. Even at $ϵ=0.5$, F1 drops only 1.2% relative to non-private training. Communication per round is only 1088 bytes (272 parameters × 4 bytes) uncompressed, and approximately 500 bytes after zlib compression, achieving a 98% reduction compared to uploading the full 1D CNN (61k parameters = 244 KB). The reduction factor is $(244\times 1024)/1088\approx 230\times$, i.e., over 99%, demonstrating the extreme efficiency of symbolic-level aggregation.

Table 8. Effect of $ϵ$ on F1 and communication (UAV-Swarm-SimHack). Communication cost is reported for uncompressed gradients (1088 bytes) and after zlib compression (approx. 500 bytes).

$\mathit{ϵ}$	F1	Uncompressed (Bytes)	Compressed (Bytes)
0.1	0.892	1088	502
0.5	0.901	1088	498
1	0.907	1088	505
2	0.910	1088	496
5	0.912	1088	503
∞ (no DP)	0.913	1088	501

5.7. Ablation Study: Scalability and Heterogeneity in Federated Learning

We vary the number of clients $M\in \{2,5,10,20\}$ and simulate non-IID data by assigning each client only two out of five attack types from the UAV-Swarm-SimHack dataset. Table 9 shows that NeSySwarm-IDS maintains high F1 (0.902–0.913) even under extreme heterogeneity, while FL-NIDS (pure CNN) degrades to 0.791. The communication cost remains negligible.

Table 9. FL scalability and non-IID robustness (UAV-Swarm-SimHack).

Nmuber of Clients	2	5	10	20
NeSySwarm-IDS F1	0.913	0.911	0.909	0.902
FL-NIDS F1	0.832	0.815	0.801	0.791
Comm. per round (bytes)	1088	1088	1088	1088

5.8. Case Study: Interpretable GPS Spoofing Detection

We evaluate practical interpretability through a controlled simulation using UAV-NIDD characteristics. Since the dataset does not contain telemetry, we simulate signal anomalies by injecting patterns into the radiotap signal strength feature. An adversary launches a GPS spoofing attack, causing anomalous signal fluctuations. NeSySwarm-IDS emits the following explanation:

Alert: GPS_SPOOFING (confidence 0.96)

Reasoning:

SignalAnomaly = 0.94 (radiotap signal strength deviation > 3 sigma)

GPSJammingIndicator = 0.89 (prolonged signal loss pattern)

Rule R9 fired: (SignalAnomaly AND GPSJammingIndicator) -> Attack

Rule satisfaction = 0.95

In a preliminary qualitative evaluation with five drone operators, all participants rated NeSySwarm-IDS’s explanations as “useful” or “very useful”, whereas LIME explanations on the 1D CNN were rated as “confusing” or “untrustworthy”. The average verification time was 5.2 s for our method versus 19.8 s for LIME, suggesting a potential advantage of intrinsic explanations. We emphasize that this sample size is insufficient for strong statistical claims; a larger, formal user study with experienced operators is planned as future work.

In our simulation, the GPS spoofing was based on artificially injected signal anomalies, which may not fully capture the complexity of real-world attacks. To mitigate this risk, we deliberately used a simple injection method (adding Gaussian noise to the signal strength feature) that does not exploit any peculiarities of the dataset. Moreover, we validated the same rule on our self-collected dataset, which includes a limited number of real GPS spoofing attacks; the detection rate there was 68%, consistent with the simulated results. Future work will involve collecting more diverse real-world attack data, including GPS spoofing, to further validate the approach.

6. Limitations

Despite its strengths, NeSySwarm-IDS has several limitations that should be acknowledged. First, the model relies on manually curated knowledge—both the logical rules and the predicate definitions are constructed based on known attack patterns, requiring significant expert effort and potentially leaving the system vulnerable to novel or evolving threats where these mappings are incomplete. Second, the differential privacy guarantee in our federated protocol assumes an honest-but-curious server; although the low dimensionality of the logic layer makes inference harder than with full-model aggregation, a malicious server could still attempt to extract information, necessitating stronger cryptographic protections for high-security deployments. Third, the framework lacks meta-cognitive capabilities: it cannot dynamically adjust its reasoning or learning strategies in response to changing attack landscapes, nor can it tune hyperparameters like the logical loss weight ${\lambda }_{\mathrm{logic}}$ online. Despite these limitations, NeSySwarm-IDS demonstrates that end-to-end differentiable neuro-symbolic integration offers a practical pathway for achieving high accuracy, efficiency, privacy, and interpretability in UAV swarm intrusion detection, as validated by our real-world implementation on Raspberry Pi 4B.

The scalability of the logical reasoner depends on the number of predicates K and the number of rules R. The computational cost of evaluating all rules is $O(R·L)$ where L is the average rule length, which is negligible compared to the CNN forward pass (162k FLOPs). However, as K grows, the semantic lifting layer scales as $O\left(K^2\right)$ because each predicate is a linear function of the K-dimensional latent vector. For K up to a few dozen, this remains lightweight. If K were to become very large (e.g., hundreds), the lifting layer could become a bottleneck, but such a fine-grained predicate set may not be necessary for practical IDS. The current design comfortably handles up to $\sim 50$ predicates; future work could explore sparse predicate grounding to accommodate larger K.

Furthermore, the current framework may face challenges in highly dynamic swarm environments. Rapid topology changes and fluctuating traffic patterns could temporarily affect feature extraction and rule satisfaction, potentially increasing false positives. Although the neural component can adapt to some degree, the fixed rules might not capture all variations. Against adaptive adversaries, who could craft attacks that deliberately avoid triggering the logical rules, the system’s reliance on manually curated knowledge may be a vulnerability. Future work should explore online adaptation mechanisms (e.g., meta-learning or rule induction) to update rules in response to evolving threats, as well as robustness evaluations against adversarial evasion.

7. Conclusions

This paper introduced NeSySwarm-IDS, an end-to-end differentiable neuro-symbolic framework designed to address the semantic gap between raw network traffic and high-level security constraints in UAV swarm intrusion detection. By embedding Łukasiewicz fuzzy logic as a differentiable regularizer, the proposed architecture enables neural perception modules to learn semantically meaningful features guided by symbolic attack-specific rules. Experimental results on the UAV-NIDD and self-collected datasets demonstrate that this integration yields superior detection performance (F1 up to 0.972) even when trained on only 20% of the data, outperforming purely data-driven baselines by 7.7–14.5 percentage points. The Federated Neuro-Symbolic Learning protocol achieves strong $(ϵ,\delta )$-DP with only 272 bytes per communication round—a 98% reduction over standard FL—while maintaining near-optimal utility. The framework also provides intrinsic explanations that enable rapid verification by human operators, as shown in a case study where verification time was reduced significantly compared to post hoc methods. When positioned within the broader neuro-symbolic taxonomy [18], NeSySwarm-IDS complements existing LLM-based approaches [37,45], Kalutharage et al. [38], Onchis et al. [39], and Bizzarri et al. [40] by demonstrating the viability of end-to-end differentiable logic under stringent resource constraints. Future work will focus on automating knowledge base construction through neural rule induction, incorporating meta-cognitive mechanisms for dynamic rule adaptation, and strengthening privacy guarantees against malicious adversaries. Collectively, these results suggest that neuro-symbolic integration offers a practical pathway toward deploying trustworthy, privacy-preserving intrusion detection in resource-constrained UAV swarms operating in contested environments.