针对低空协同任务中多节点关系复杂、早期异常信号较弱、攻击难以及时预警等问题，提出一种基于执行-通信复合行为建模的低空协同任务安全演化预测方法。该方法利用正常任务运行数据构建执行-通信复合任务行为图，统一表示控制执行、任务资源访问、链路交互、状态反馈和任务结果等多源行为，并学习任务传播基线。在线阶段，以当前可疑行为为输入，构造异常传播上下文，筛选候选受影响节点，对候选传播路径进行评分和排序，从而预测后续可能受影响的任务对象和传播路径。基于CICAPT-IIoT 2024数据集的替代验证结果表明，该方法在在线预警任务中的预警准确率为78.35%，攻击片段覆盖率为66.67%，平均每个攻击片段产生1.40条误报，首次有效预警相对于攻击目标达成点的平均提前步率为96.7%。结果说明，该方法能够在不使用未来攻击信息的条件下对多数攻击过程形成提前预警，可为低空协同任务中的异常隔离、链路调整和任务重规划提供参考。

To address the problems of complex multi-node relationships， weak early abnormal signals， and difficulty in timely attack warning in low-altitude collaborative tasks， this paper proposes a security evolution prediction method based on execution-communication composite behavior modeling. The method constructs an execution-communication composite task behavior graph from normal task operation data， provides a unified representation of multi-source behaviors such as control execution， task resource access， link interaction， status feedback， and task results， and learns a task propagation baseline. In the online stage， the current suspicious behavior is taken as input to construct an abnormal propagation context， screen candidate affected nodes， and score and rank candidate propagation paths， thereby predicting task objects and propagation paths that may be affected subsequently. Substitute validation based on the CICAPT-IIoT 2024 dataset shows that the proposed method achieves a warning precision of 78.35%， an attack episode coverage of 66.67%， an average of 1.40 false alarms per episode， and an average lead-step ratio of 96.7% for the first valid warning relative to the attack objective completion point. The results indicate that the method can provide early warnings for most attack processes without using future attack information， and can provide support for anomaly isolation， link adjustment， and task replanning in low-altitude collaborative tasks.