This paper studies the countermeasure design problems of distributed resilient time-varying formation-tracking control for multi-UAV systems with single-way communications against composite attacks, including denial-of-services (DoS) attacks, false-data injection attacks, camouflage attacks, and actuation attacks (AAs). Inspired by the concept of digital twin, a new two-layered protocol equipped with a safe and private twin layer (TL) is proposed, which decouples the above problems into the defense scheme against DoS attacks on the TL and the defense scheme against AAs on the cyber-physical layer. First, a topology-repairing strategy against frequency-constrained DoS attacks is implemented via a Zeno-free event-triggered estimation scheme, which saves communication resources considerably. The upper bound of the reaction time needed to launch the repaired topology after the occurrence of DoS attacks is calculated. Second, a decentralized adaptive and chattering-relief controller against potentially unbounded AAs is designed. Moreover, this novel adaptive controller can achieve uniformly ultimately bounded convergence, whose error bound can be given explicitly. The practicability and validity of this new two-layered protocol are shown via a simulation example and a UAV swarm experiment equipped with both Ultra-WideBand and WiFi communication channels.