To address the problems of complex multi-node relationships， weak early abnormal signals， and difficulty in timely attack warning in low-altitude collaborative tasks， this paper proposes a security evolution prediction method based on execution-communication composite behavior modeling. The method constructs an execution-communication composite task behavior graph from normal task operation data， provides a unified representation of multi-source behaviors such as control execution， task resource access， link interaction， status feedback， and task results， and learns a task propagation baseline. In the online stage， the current suspicious behavior is taken as input to construct an abnormal propagation context， screen candidate affected nodes， and score and rank candidate propagation paths， thereby predicting task objects and propagation paths that may be affected subsequently. Substitute validation based on the CICAPT-IIoT 2024 dataset shows that the proposed method achieves a warning precision of 78.35%， an attack episode coverage of 66.67%， an average of 1.40 false alarms per episode， and an average lead-step ratio of 96.7% for the first valid warning relative to the attack objective completion point. The results indicate that the method can provide early warnings for most attack processes without using future attack information， and can provide support for anomaly isolation， link adjustment， and task replanning in low-altitude collaborative tasks.