Diff-DDoS: Realistic Cyber-Physical Attack Synthesis and Robust Detection for 5G-Enabled CPS Using Tabular Diffusion Models

IEEE TRANSACTIONS ON INDUSTRIAL INFORMATICS, VOL. XX, NO. XX, XXXX

1

Diff-DDoS: Realistic Cyber-Physical Attack Synthesis and Robust Detection for 5G-Enabled CPS Using Tabular Diffusion Models

arXiv:2608.17796v1 [cs.CR] 18 Aug 2026

Bilal Hussain , Senior Member, IEEE, Xiao Tang , Member, IEEE, Qinghe Du , Member, IEEE, Tan Li , Member, IEEE, Muhammad Azhar , Member, IEEE, and Danista Khan , Member, IEEE

Abstract— Deep learning-based DDoS detectors for 5Genabled cyber-physical systems face two challenges: scarce real-world labeled attack data and the unrealism of naive synthetic substitutes, which limit robustness against adaptive adversaries. Detectors trained on hand-crafted attacks with fixed scaling multipliers degrade catastrophically—F1-score drops of ∼47% to 100% depending on scenario—when confronted with realistic, distribution-preserving samples. We propose Diff-DDoS, a three-phase framework for realistic attack synthesis and robust detection using tabular diffusion models. Phase 1 establishes a baseline CNN cell-level detector on spatiotemporal grids derived from call detail records (CDRs). Phase 2 trains a tabular denoising diffusion probabilistic model (TabDDPM) on normal CDR aggregates to generate realistic attacks, exposing detector vulnerabilities. Phase 3 introduces adversarial diffusion training (ADT), which applies inverse classifier guidance to iteratively generate hard yet distribution-preserving adversarial samples until the detector converges. On a real-world Milano CDR dataset across SMS-flooding, silent-call, Internet-signaling, and blended scenarios, ResNet50 with ADT recovers F1-scores Received March 18, 2026; revised July 6, 2026; accepted August 11, 2026. This work was fully supported by a grant from the College of Professional and Continuing Education, an affiliate of The Hong Kong Polytechnic University. Paper no. TII-26-6533. (Corresponding author: Bilal Hussain.) Bilal Hussain is with the Division of Science, Engineering, and Health Studies, School of Professional Education and Executive Development, The Hong Kong Polytechnic University, Hong Kong SAR, China (e-mail: bilal.hussain@cpce-polyu.edu.hk). Xiao Tang and Qinghe Du are with the School of Information and Communications Engineering, Xi’an Jiaotong University, Xi’an, China (emails: tangxiao@xjtu.edu.cn; duqinghe@mail.xjtu.edu.cn). Tan Li is with the Department of Computer Science, The Hang Seng University of Hong Kong, Hong Kong SAR, China (e-mail: tanli@hsu.edu.hk). Muhammad Azhar is with the Department of Applied Data Science, Hong Kong Shue Yan University, Hong Kong SAR, China (e-mail: azhar@hksyu.edu). Danista Khan is with the Division of Business and Hospitality Management, School of Professional Education and Executive Development, The Hong Kong Polytechnic University, Hong Kong SAR, China (e-mail: danista.khan@cpce-polyu.edu.hk). Digital Object Identifier XX.XXXX/TII.2026.XXXXXXX This is the authors’ accepted manuscript. Accepted for publication in IEEE T RANSACTIONS ON I NDUSTRIAL I NFORMATICS, paper no. TII26-6533. © 2026 IEEE. Personal use of this material is permitted. Permission from IEEE must be obtained for all other uses, in any current or future media, including reprinting/republishing this material for advertising or promotional purposes, creating new collective works, for resale or redistribution to servers or lists, or reuse of any copyrighted component of this work in other works.

of 79.62% (silent-call), 100% (Internet), and 92.79% (blended) while retaining near-perfect multiplier-test F1 on most scenarios. We further benchmark ADT against gradient-based adversarial training, conditional tabular GAN (CTGAN), and fixed-multiplier baselines under identical iterative training and validation-based threshold calibration; after calibration, ADT reaches 100% SMS F1 versus 47.3% for CTGAN and attains silent-call F1 on par with the strongest gradientbased adversarial-training baseline. SMS flooding remains challenging for lightweight architectures, though calibration enables near-perfect ResNet50 detection. These results establish tabular diffusion models as a practical tool for stress-testing and hardening intrusion detectors in datascarce 5G cyber-physical deployments. Index Terms— 5G networks, adversarial training, cyberphysical systems, DDoS attacks, diffusion models.

I. I NTRODUCTION IFTH-generation (5G) mobile networks are becoming a core communication substrate for cyber-physical systems (CPSs), including industrial monitoring, transportation, and energy services. This convergence enlarges the attack surface and creates new pathways for distributed denial-of-service (DDoS) attacks that threaten both network availability and physical processes [1]–[4], requiring multi-layer AI-enabled protection [5], [6]. Recent threat-landscape reports rank DDoS attacks among the most prominent cybersecurity threats in mobile and Internet of Things (IoT)-connected environments [7]. Detecting stealthy cellular attacks is particularly difficult. Silent-call abuse, SMS flooding, and Internet-signaling (signaling storm) attacks stress control-plane procedures rather than only consuming user-plane bandwidth [8]–[11], and signaling overload and layer-3 abuse remain credible threats in modern cellular architectures [10], [11]. At the monitoring layer, call detail record (CDR) aggregates capture cell-level temporal deviations in SMS, call, and Internet activity. Hussain et al. [4] showed they can be organized as 9 × 9 × 3 spatiotemporal grids and classified by convolutional neural networks (CNNs) with strong performance on multiplier-based synthetic attacks. However, those multiplier attacks use fixed, large feature multipliers and are therefore easier to separate from normal traffic than realistic adversarial behavior. This mismatch exposes a broader weakness: models trained on stylized attacks degrade sharply under distribution

F

2

IEEE TRANSACTIONS ON INDUSTRIAL INFORMATICS, VOL. XX, NO. XX, XXXX

shift [12], [13]. In cellular settings the problem is amplified by scarce, privacy-sensitive attack labels; naive perturbations can break traffic semantics [2], [4], [12], [13], leaving detectors brittle against attacks that stay near the normal traffic manifold. To address this gap, we propose Diff-DDoS, a three-phase framework using tabular diffusion models to synthesize realistic attack samples and harden detectors against adaptive evasion. In Phase 1, we re-implement the CNN-based detector of [4] as a multiplier-based baseline (full pseudo-code in Supplementary Sec. S-A). In Phase 2, we train TabDDPM only on normal CDR aggregates to generate manifold-preserving attack samples, revealing the baseline detector’s poor generalization. In Phase 3, we introduce adversarial diffusion training (ADT), which uses guided diffusion sampling to generate hard on-manifold attacks and iteratively retrains the detector. The main contributions of this work are as follows: 1) We re-implement the cell-level CNN baseline of [4] and establish reference performance on multiplier-based attacks. 2) We demonstrate that detectors trained only on multiplierbased attacks can fail severely when evaluated on diffusion-generated attacks drawn from the normal CDR manifold. 3) We introduce ADT, which combines TabDDPM-based generation with inverse classifier guidance to create hard, realistic attack samples for iterative robust training. 4) We evaluate Diff-DDoS across SMS, silent-call, Internet, and blended scenarios using SimpleCNN and 50layer residual network (ResNet50), highlighting ADT robustness gains, validation-based threshold calibration, and a per-scenario learnability analysis showing that SMS flooding is capacity-limited on SimpleCNN but recoverable on ResNet50. Sec. II covers related work; Sec. III background and problem setup; Sec. IV methodology; Sec. V experimental setup and evaluation protocols; Sec. VI results; Sec. VII limitations and conclusion. Extended derivations and full result grids are in the Supplementary Material. II. R ELATED W ORK DDoS detection in 5G-enabled CPSs has advanced from rule-based to machine learning/deep learning (ML/DL) methods because signaling abuse, SMS flooding, and silent-call attacks can evade threshold defenses [2], [14]. Hussain et al. [4] showed CDR grids enable strong CNN performance on multiplier-based attacks; later work explored recurrent, federated, and quantum-inspired models [15]–[17]. CDR analytics also demonstrate useful spatiotemporal structure for traffic prediction and network monitoring [18]–[21]. Yet both DDoS detection and CDR analytics literatures rarely evaluate robustness to adaptive evasion close to normal traffic statistics [4], [15], [22], [23]. Deep intrusion detection systems (IDSs) degrade under distribution shift and adversarial manipulation [24]–[26]. Conditional tabular generative adversarial network (CTGAN) improves data augmentation but suffers from instability [27];

TabDDPM offers richer tabular distributions and higherfidelity synthesis [28], [29]. Gradient-based adversarial perturbations generate off-manifold samples [12], [13], [30], [31], while diffusion-based approaches show growing promise [32]– [34].

III. B ACKGROUND AND P ROBLEM S ETUP A. CDR Grid Representation and Detection Task Each CDR snapshot is represented as a grid image x ∈ R9×9×3 , where the three channels correspond to aggregated SMS-out, Call-out, and Internet traffic for each of the 9 × 9 = 81 cells in a selected Milano [35] subgrid over one 10-minute interval within the 11:00–14:00 window. The detection task is formulated as a multilabel cell-level classification problem: for each grid image x, a CNN-based detector M with learnable weights θ outputs a vector M(x; θ) = Ŷ ∈ (0, 1)81 , where each component ŷk ∈ (0, 1) is the sigmoid-activated predicted attack probability for cell k ∈ {1, . . . , 81}. The ground-truth label Y ∈ {0, 1}81 assigns Yk = 1 if cell k is under attack and Yk = 0 otherwise. During adversarial diffusion training (Phase 3), θ is updated iteratively across rounds, so the detector after ADT round r for attack scenario s is denoted M(· ; θsr ) (during round-r sampling, guidance uses θsr−1 ; Sec. IV-D). We write fθ ≡ M(·; θ) in algorithms when shorthand is needed. The CDR-based attack synthesis of [4] applies scenariospecific multipliers to |C| = 40 randomly selected cells, labeling them Yk = 1 (see Supplementary Algorithm S2). Four scenarios are evaluated throughout: SMS flooding (elevated SMSout), silent-call (suppressed outgoing calls), Internet-signaling (elevated Internet, approximating a signaling storm [4]), and blended (simultaneous SMS/Internet elevation and call suppression). Phase 1 uses fixed multipliers (169.5× SMS, −33.1× call clipped at zero, 43.3× Internet); these stylized attacks motivate the diffusion-based robustness evaluation and are not used to generate attacks in Phases 2–3 (Phase 2 test attacks are TabDDPM-generated; see Sec. IV-C). The preprocessing pipeline (62 CDR files, 11:00–14:00 aggregation, Num2Dims(·) row-major cell indexing) is given in Supplementary Algorithms S1–S2.

B. Denoising Diffusion and Classifier Guidance We use standard denoising diffusion probabilistic model (DDPM) notation [28], [36]: a fixed forward schedule corrupts clean data x0 into noisy samples xt over T steps; a learned reverse denoiser ϵψ (weights ψ, distinct from detector θ) predicts the injected noise. Our TabDDPM instantiation on 3D CDR aggregates is summarized in Sec. IV-C.1; full equations are in Supplementary Sec. S-B. DDPMs have been extended from images [37] to tabular data [28]; Diff-DDoS builds on the latter.

AUTHOR et al.: TITLE

3

TABLE I: Main-text notation summary. Symbol

Meaning

M(·; θ), fθ

Multilabel CNN detector (81 sigmoid outputs per grid)

Metric bundles (Acc, Prec, Rec, F1, FPR) for attack , Ξr,Tab Ξrs , Ξr,orig s s scenario s at ADT round r; not the detector θ, θs∗ , θsr

Detector learnable weights

ϵψ , ϕTabDDPM

TabDDPM denoiser network (weights ψ; distinct from θ)

ϕs : R 3 → R 3

Mild post-sample scenario scaling on 3D CDR aggregates (Phase 2)

MapToGrid(x̃, B) Copy background B, write aggregate x̃ into attacked cells C, set Yk = 1 on C pattack

Mean detector score over attacked cells C during inverse guidance

Classifier guidance [37] steers the reverse process via classifier gradients: ∇xt log p(xt | y) = ∇xt log p(xt ) +scg · ∇xt log p(y | xt ), {z } {z } | | unconditional score

classifier gradient

(1) where ∇xt is the gradient with respect to the noisy sample xt , scg controls conditioning strength, and the classifier gradient biases samples toward target class y. Diff-DDoS extends this idea via inverse guidance in Phase 3 (Sec. IV-D), steering samples away from attack-like detector scores while preserving the normal CDR manifold [33], [34]. C. Notation Summary Table I lists overloaded symbols used in the main text; the supplement provides an extended disambiguation table.

TABLE II: Attack-steering mechanisms across Diff-DDoS phases. Mechanism

Phase

Action

Heuristic 2 steering + ϕs Inverse classifier 3 guidance

Minimize pattack to- Hard robust-training ward ptarget samples

B. Phase 1: Baseline Detector Training The detector is a multilabel model with 81 sigmoid outputs per grid (Sec. III-A); Phase 1 trains on the union of normal grids (all-negative labels) and multiplier-attack grids (40 perturbed cells positive), without any TabDDPM-generated attacks. Phase 1 follows [4]; the full training procedure is in Supplementary Algorithm S3. Data Preprocessing: Phase 1 uses the two-stage pipeline of Supplementary Algorithms S1–S2 (grid extraction and fixedmultiplier attack injection on |C| = 40 cells; Table II). Attack labels are defined solely by synthesis; no statistical thresholding is applied. Model Training: Two detector architectures are employed: • SimpleCNN: A lightweight CNN with three convolution–pooling blocks followed by fully-connected layers. • ResNet50: A deeper (50-layer) residual network adapted to 9 × 9 × 3 inputs with an 81-way sigmoid output layer. Both models are trained with a multilabel binary crossentropy (BCE) loss averaged over N training images and all 81 cells: N

IV. M ETHODOLOGY

Purpose

169.5× SMS, Stylized baseline −33.1× Call, 43.3× Internet Mild γ ranges on tar- On-manifold get channel(s) vulnerability test

Fixed multipliers 1

LBCE (θ) = −

81

1 X 1 Xh yi,k log ŷi,k N i=1 81 k=1

Fig. 1 summarizes the Diff-DDoS pipeline: Phase 1 establishes a multiplier-trained CNN baseline; Phase 2 trains TabDDPM on normal 3D CDR aggregates and exposes baseline vulnerability to manifold-preserving attacks; Phase 3 applies adversarial diffusion training (ADT) with inverse classifier guidance to iteratively harden the detector. Offline attack synthesis is separated from online grid-level inference (Sec. VI-F). A. Data Representations and Attack-Steering Mechanisms Normal tabular training rows are Rnorm = {(SMS sum, CALL sum, INTERNET sum)} extracted from raw CDR aggregates over the 9 × 9 subgrid; they are standardized with StandardScaler fit on Rnorm only. Num2Dims(k) maps cell index k to grid coordinates (h, w) in row-major order. MapToGrid(x̃, B) copies background grid B, writes aggregate x̃ into attacked cells C via Num2Dims(·), and sets Yk = 1 on C. Phase 2 test grids use B ∈ A (abnormal-template pool); Phase 3 ADT training grids use a zero background (B = 0): only cells in C receive x̃; all others remain zero (Algorithm 2). Table II contrasts the three attack-steering mechanisms used across phases.

(2)

i + (1 − yi,k ) log(1 − ŷi,k ) , where yi,k ∈ {0, 1} is the ground-truth label and ŷi,k = M(xi ; θ)k ∈ (0, 1) is the sigmoid-activated predicted attack probability for cell k in image i, produced by detector M with learnable weights θ. Predictions are binarized at τ = 0.5; true positives, false positives, and false negatives (TP/FP/FN) are micro-averaged over Ntest ×81 cell decisions to compute Accuracy, Precision, Recall, F1 score, False Positive Rate (FPR), and receiver operating characteristic area under the curve (ROC–AUC) (Sec. VI-G; dataset splits in Sec. V). C. Phase 2: TabDDPM-Based Vulnerability Demonstration Phase 2 demonstrates that multiplier-trained detectors are vulnerable to realistic diffusion-based attacks. Let Xn denote the 781 normal-only grid images (614 train + 167 test) and A the 335 unperturbed abnormal-template grids produced by Supplementary Algorithms S1–S2 (fixed random seed 1; Sec. V). Let Xas denote the scenario-specific abnormal grid working pool (Nabn = 335) used in Phase 2 indexing.

4

IEEE TRANSACTIONS ON INDUSTRIAL INFORMATICS, VOL. XX, NO. XX, XXXX

Phase 1: Baseline Detector Training Database with Training (Normal + Multiplier-based Attack) Examples

raw CDRs Cell ID

....

Internet

Value 2 Value 3 Cell1 IDValue.... Internet Assets .... .... .... Value 1 Value 2 Value 3 Cell ID .... Internet .... .... .... .... .... .... Value 1Assets ... Value 3 Value.... 10 Value.... 11 Value.... 12 .... .... .... Assets Value .... 10 Value .... 11 Value .... 12 Value 10 Value 11 Value 12 [Cell ID, timestamp, SMS, Call, Internet]

Spatiotemporal traffic tensors (9 × 9 × 3)

Phase 3: Adversarial Diffusion Training (ADT)

0 0 1 0 0

ADT Robust Training Loop

0 0 1 CNN-based Baseline Detector

Robust detector

Per-cell attack probability vector Ŷ ∈ (0,1)⁸¹

Phase 2: TabDDPM Generative Diffusion Model Forward Process (Noising) x0 Normal CDR Samples

SMS_sum CALL_sum INTERNET_sum

x1

xT ∼ N (0, I) (pure noise)

x2

Generate adversarial samples MLP-based Neural Network

Inverse Classifier Guidance

Guided adversarial CDR samples (on-manifold attacks)

Repeat until convergence

Reverse Process (Denoising)

Fig. 1: Overview of the proposed Diff-DDoS framework. Phase 1 trains baseline detectors on multiplier-based attacks, Phase 2 uses TabDDPM to generate realistic attacks from normal CDR aggregates, and Phase 3 applies ADT to generate hard onmanifold samples for iterative retraining. Training attacks in Xas (indices 0–166) remain multipliertest based, while test attacks (indices 167–334, Nattack = 168) are replaced with TabDDPM-generated grids. Let Xas,Tab denote the TabDDPM-based test set: the 335-image split combining 167 held-out normal test grids with 168 TabDDPM test-attack (s) grids Xas [167:335] (i.e., Dtest in Algorithm 1). Phase-2 F1 is (s) F1Ph.2 on this split with τ = 0.5 (protocol P1; Table III); (s) (s) (s) (s) degradation is ∆F1 = (F1Ph.1 − F1Ph.2 )/F1Ph.1 × 100%. 1) Tabular Diffusion Model for Aggregated CDRs: Attack synthesis operates on 3D CDR aggregates (SMS, CALL, INTERNET) per attacked-cell group, where scenario constraints are naturally expressed and realism is quantified (Sec. VI-C). A grid-image DDPM would couple unrelated cells and complicate per-channel control; we therefore model the low-dimensional aggregate manifold with TabDDPM [28] and map sampled aggregates back to 9 × 9 × 3 grids via MapToGrid(·, B) (Sec. IV-A).

We adapt the DDPM framework [36] to tabular CDR features. Raw CDR rows are aggregated into a 3D feature vector x0 = (SMS sum, CALL sum, INTERNET sum) ∈ R3 per (cell, timeslot, day), which defines the normal CDR manifold. A fixed linear noise schedule (T = 1000, βmin = 10−4 , βmax = 0.02) governs the forward diffusion, and the denoiser ϵψ —a multilayer perceptron (MLP) with hidden dimensions [256, 512, 256] that takes the concatenation of xt and the scalar diffusion step t (broadcast to the feature dimension)— is trained with the standard ℓ2 noise-prediction objective LDDPM (ψ). The full forward/reverse equations, denoiser architecture, training objective, and posterior sampling are given in Supplementary Sec. S-B.

2) Realistic Attack Scenario Generation: TabDDPM is trained exclusively on normal aggregate CDR rows. Here U(a, b) denotes the continuous uniform distribution on [a, b], and γ1 , γ2 , γ3 are independent per-sample scaling factors. To generate realistic attacks for a given scenario s, we: 1) Run reverse diffusion (Supplementary Sec. S-B) to obtain an aggregate x(i) = (SMS, CALL, INTERNET) ∈ R3 , applying lightweight heuristic steering on the target channel(s) every max(1, ⌊T /10⌋) timesteps (Table II; distinct from Phase 3 inverse classifier guidance and from post-sample ϕs in item 2). 2) Apply mild scenario-specific constraints x̃(i) ← ϕs (x(i) ) on the target channel only: SMS, γ1 ∼ U(2, 5); silent-call, γ2 ∼ U (0.3, 0.7) with CALL ← max(0, γ2 · CALL); Internet, γ3 ∼ U(2, 5); Blended, all three applied jointly. Non-target channels are left unchanged (silent-call models resource-exhaustion via call suppression [8], [38]). 3) Map each constrained triple to a 9 × 9 × 3 grid via MapToGrid(x̃(i) , B (i) ) with B (i) ∈ A. The Phase 1 detectors are then evaluated on the full test split without retraining (results in Sec. VI-B).

D. Phase 3: Adversarial Diffusion Training (ADT) Phase 3 applies ADT: for each s ∈ S = {SMS, Call, Internet, Blended} and round r = 1, . . . , R, inverse-guided TabDDPM samples are appended to the training set and the detector is fine-tuned (Algorithm 2). Let r Xadv denote the adversarial grids generated in round r and ϕTabDDPM the Phase 2 TabDDPM denoiser (Supplementary Sec. S-B).

AUTHOR et al.: TITLE

5

Algorithm 1 Phase 2: TabDDPM Vulnerability Demonstration

Algorithm 2 Phase 3: adversarial diffusion training (ADT)

Require: Supplementary Algorithms S1–S2 outputs (Dnorm , A, attacked-cell set C); detector M(·; θ) (written fθ ) (s) (s) Ensure: Baseline {fθs∗ }s ; {F1Ph.2 , ∆F1 }s 1: Build Rnorm from normal CDR aggregates; fit StandardScaler on Rnorm 2: Train TabDDPM pψ on scaled Rnorm (Supplementary Sec. S-B); save model and scaler 3: for each s ∈ {SMS, Call, Internet, Blended} do 4: Train fθ on scenario-specific Dstrain (Algorithm S2; no TabDDPM in training) ⇒ fθs∗ 5: Initialize Xas with multiplier attacks on all Nabn = 335 slots (indices 0–166 retained for training) test 6: for i = 167 to 334 {Nattack = 168 test-attack indices} do 7: x(i) ← TabDDPM-Sample(pψ ) with heuristic scenario steering on target channel(s) during reverse diffusion every max(1, ⌊T /10⌋) steps (enumerate item 1; not Phase 3 inverse classifier guidance) 8: x̃(i) ← ϕs (x(i) ) {post-sample mild γ ranges in enumerate item 2} 9: B (i) ← A[i]; Xas [i] ← MapToGrid(x̃(i) , B (i) ) 10: end for (s) 11: Assemble Dtest from 167 held-out normal grids and 168 TabDDPM attack grids Xas [167:335] (335 test images total) (s) (s) 12: Evaluate fθs∗ on Dtest without retraining; record F1Ph.2 , (s) ∆F1 13: end for (s) (s) 14: return {fθs∗ }s , {F1Ph.2 , ∆F1 }s

Require: Phase 1 weights {θs∗ }s∈S ; TabDDPM ϕTabDDPM (Supplementary Sec. S-B); (Xstrain , Ystrain ), Xstest , Xas,Tab (Phases 1–2); rounds R, guidance λ, samples/round NADT , fine-tune epochs EADT , cell set C Ensure: {θsR,∗ }s ; {Ξrs }R r=0 1: for each s ∈ S = {SMS, Call, Internet, Blended} do 2: θs0 ← θs∗ ; Ξ0s ← Evaluate(θs0 , Xas,Tab ) 3: for r = 1 to R do r 4: Xadv ← ∅; fguid ← max(1, ⌊T /10⌋) 5: for i = 1 to NADT do 6: TabDDPM reverse diffusion from xT ∼ N (0, I); at steps t mod fguid = 0, t > 0, apply inverse guidance (Eqs. (3)–(5)) using M(·; θsr−1 ) 7: xadv ← MapToGrid(x̂0 , B=0) {zero background; aggregate in C only} r r 8: Xadv ← Xadv ∪ {xadv } 9: end for r 10: Append Xadv to Xstrain (attack labels) train,r train,r ) , Ys ⇒ (Xs 11: Fine-tune θsr−1 for EADT epochs ⇒ θsr } on Xstest , Xas,Tab , Ξr,Tab 12: Ξrs ← {Ξr,orig s s 13: end for 14: θsR,∗ ← θsR 15: end for 16: return {θsR,∗ }s , {Ξrs }R r=0

1) Inverse Classifier Guidance: During each ADT round, inverse classifier guidance steers TabDDPM sampling away from attack-like detector scores. Let M(·; θsr ) denote the detector after ADT round r (θs0 = θs∗ from Phase 1). During generation at round r, inverse guidance uses M(·; θsr−1 ) (Algorithm 2); we omit subscript s in Eqs. (3)–(5) when s is fixed. For a CDR aggregate x (or its clean estimate x̂0 during reverse diffusion), we form the grid Igrid (x) = MapToGrid(x, B) by replicating x into all cells of C = {c1 , . . . , c40 } on a background grid B (for inverse guidance during ADT sampling, B is drawn from normal training grids; see ADT iterative training below). The scalar attack probability is the mean predicted score over C: 1 X pattack = M(Igrid (x); θsr−1 )k . (3) |C| k∈C

Given target probability ptarget = 0.3 and guidance scale λ, the guidance term is ∇guidance := λ · (pattack − ptarget ) · ∇x pattack ,

(4)

where ∇x pattack is the gradient of pattack with respect to x; the guided update is x̂0 ← x̂0 − ∇guidance .

(5)

For non-blended scenarios, gradient components in non-target CDR channels are scaled by 0.7 before applying the update,

preventing guidance from distorting unrelated traffic dimensions. 2) ADT Iterative Training Procedure: Round-wise metrics are Ξrs = {Ξr,orig , Ξr,Tab } on the multiplier test split Xstest and s s TabDDPM test set Xas,Tab , respectively; the final weights are θsR,∗ . During inverse guidance, Igrid (x) is formed with a randomly drawn normal training background. ADT-appended training grids use a zero background with the aggregate written only into C (Sec. IV-A). Hyperparameters (R, NADT , EADT , λ, ptarget ) are given in Sec. V. V. E XPERIMENTAL S ETUP Following [4], we use the Telecom Italia Milano CDR collection [35]: a 9 × 9 subgrid (81 cells), 18 time slots per day (11:00–14:00, 10-minute intervals), yielding 1,116 grid images per scenario split into 781 training (614 normal + 167 attack) and 335 test (167 normal + 168 attack) images. We fix random seed 1 for data shuffling and attack-cell selection (|C| = 40). TabDDPM is trained on normal aggregate CDR rows (3D features) for 100 epochs (learning rate 10−4 , batch size 32). SimpleCNN and ResNet50 are trained for up to 100 epochs in Phases 1–2 (ResNet50: 10% validation split with early stopping to limit overfitting; SimpleCNN: full 100-epoch budget). Phase 3 ADT uses R = 3 rounds, λ = 1.0, NADT = 100 samples per round and scenario, EADT = 20 fine-tuning epochs per round, and ptarget = 0.3. We evaluate Accuracy, Precision, Recall, F1, FPR, and ROC AUC via micro-averaging over Ntest × 81 cell decisions (Ntest = 335). No normalization is applied to CNN inputs (consistent with [4]); TabDDPM

6

IEEE TRANSACTIONS ON INDUSTRIAL INFORMATICS, VOL. XX, NO. XX, XXXX

TABLE III: Reader’s guide to F1 evaluation protocols. ID

Protocol

Main location

P1

335-grid TabDDPM test; τ = 0.5; cumulative Phase-3 ADT Same test as P1; fresh 3round schedule per method; τ = 0.5 Locked attack test; τF1max or τY from validation Fresh-retrain λ/ptarget sweep; locked test Multiplier test split; τ = 0.5

Table IV

P2 P3 P4 P5

Fig. 4 (left) Fig. 4 (right); Sec. VI-G Table VII Table V

aggregates are standardized with StandardScaler fit on normal data only. Implementation details follow Supplementary Algorithms S1–S3 and main-text Algorithms 1–2.

TABLE IV: Detector performance across phases (protocol P1; all values in %; deployment-default τ = 0.5). Ph. 1: multiplier-based test attacks (Acc, Rec, F1); precision is 100% for all rows (omitted). Ph. 2: TabDDPM-generated attacks without retraining. Ph. 3: ADT rounds R1–R3. SC: SimpleCNN; R50: ResNet50. Scenario

Acc SMS (SC) 99.96 SMS (R50)a 100 Call (SC)b 99.85 Call (R50) 99.83 Internet (SC) 100 Internet (R50) 99.80 Blended (SC) 100 Blended (R50) 100

Ph. 1 Rec 99.85 100 99.40 99.32 100 99.21 100 100

Ph. 2 Ph. 3 F1 F1 F1 R1 R2 R3 99.93 0 9.09 9.09 9.09 100 0 6.98 9.74 9.58 99.70 52.63 38.44 12.87 9.71 99.66 7.56 77.22 81.52 79.62 100 0 89.14 96.78 96.62 99.60 0 100 100 100 100 0 86.55 81.13 79.57 100 0 99.35 97.22 92.79

a ResNet50 SMS values below 10% reflect a fixed-τ artifact (Sec. VI-G).

A. Evaluation Protocols for Reported F1 F1 is reported under protocols P1–P5; Table III maps each label to its evaluation setting. VI. E XPERIMENTAL R ESULTS AND D ISCUSSION Extended derivations, sensitivity sweeps, and full result grids are in the Supplementary Material. A. Evaluation Scope Our use of “5G” refers to the deployment context—CPS services depending on cellular connectivity—rather than a claim the benchmark traces were collected from a 5G standalone (SA) core. We evaluate on the public Milano CDR corpus [35] for reproducible comparison with Hussain et al. [4]; coarse CDR aggregates remain generation-agnostic monitoring records used in contemporary 5G anomaly detection [23], [39]. No public labeled per-cell cellular DDoS CDR dataset exists; packet-/flow-level 5G corpora (5G-NIDD [40], NCSRD-DS5GDDoS [41]) are not directly mappable to our 9 × 9 × 3 grid representation. Empirical claims are scoped to robust CDRgrid detection under realistic synthetic stress tests in a 5Gmotivated CPS monitoring setting. B. Phase Progression Across Diff-DDoS Table IV summarizes detector performance across phases (all values at τ = 0.5; Ph. 2–3 follow protocol P1 on the TabDDPM test split). Both architectures achieve near-perfect Phase 1 F1 (99.6%–100%) on multiplier-based test attacks— expected because Phase 1 multipliers (Table II) deviate tens to hundreds of σ from normal (Fig. 2). Without retraining, Phase 2 F1 collapses to near zero for SMS, Internet, and Blended on TabDDPM attacks; ResNet50 silent-call F1 falls to 7.6% despite greater model capacity (a comparatively deeper backbone). ADT (Phase 3) recovers ResNet50 F1 to 79.6% (silent-call), 100% (Internet), and 92.8% (Blended) at round 3; SMS F1 stays below 10% at τ = 0.5 (a decision-rule artifact resolved in Sec. VI-G). SimpleCNN silent-call F1 declines under ADT (Sec. VI-H); for these sparse stealth scenarios (SMS flooding and silent-call), ResNet50 is the deployable backbone (Secs. VI-G–VI-H).

b SimpleCNN silent-call Phase 3 decline is interpreted in Sec. VI-H.

C. Attack Realism of TabDDPM-Generated Attacks We operationalize realistic as manifold-preserving: synthesized attacks remain within the statistical envelope of normal CDR traffic, modeling stealthy control-plane abuse rather than high-volume volumetric DDoS. We quantify distributional fidelity against the normal CDR aggregate manifold and benchmark against Phase 1 multiplier baselines [4]. For each test attack grid we extract the mean 3D aggregate over the 40 attacked cells (168 grids per scenario) and compare it to a normal reference pool of 5,000 cell-level 3D features from normal-only training grids, using target-channel mean absolute z-score as the primary realism metric and squared maximum mean discrepancy (MMD2 ) with a radial basis function (RBF) kernel as a distributional check (full definitions in Supplementary Sec. S-C). Separately, 5,000 unconstrained TabDDPM draws yield joint MMD2 = 0.50 to that normal pool, confirming generative fidelity before scenario constraints. After mild scenario constraints, TabDDPM attacks deviate by only ≈ 0.6–3.5σ on the target channel, whereas multiplier attacks deviate by ≈ 1–172σ (Fig. 2; Supplementary Table SI). For silent-call, TabDDPM attacks deviate by only 0.59σ on CALL (target-channel MMD2 = 0.19), so Phase 2 traffic is statistically near-normal; this stealth regime helps explain why multiplier-trained ResNet50 F1 collapses to 7.6% on TabDDPM Call grids despite near-perfect Phase 1 multiplier scores. These results confirm TabDDPM as a manifoldpreserving stealth-attack synthesizer; limitations are discussed in Sec. VII. D. ADT Recovery and Multiplier Retention Beyond Table IV (TabDDPM test, protocol P1), we assess architecture-specific recovery and multiplier-test retention (protocol P5). SimpleCNN. On the same 335-grid TabDDPM protocol (Table IV, τ = 0.5), Internet (0% → 96.6% at R3) and Blended (0% → 79.6%) improve markedly. Silent-call F1 drops from 52.6% (Phase 2) to 9.7% at R3—Grad-CAM analysis (Sec. VI-H) shows ADT suppresses attack scores on TabDDPM silent-call samples (mean attack score on attacked cells 0.35 → 0.01) while preserving localization; ResNet50

AUTHOR et al.: TITLE

7

171.77 0.738

0.886

0.860

0.611

0.593

100

0

0.269 2.64

SMS

0.237 0.06 0.59 1.19

TabDDPM Multiplier

Call

56.28 3.52

Internet

0.8 0.6 0.4 0.2

2.20

Blended

0.0

Bars: Mean |z| (left axis) Lines: Joint MMD 2 (right axis)

Fig. 2: Dual-axis realism summary on test attack grids (168 per scenario). Bars (left axis) show target-channel mean absolute z-score, and lines (right axis) show joint (3D) MMD2 to normal, for TabDDPM and multiplier attacks across scenarios. Lower values indicate closer alignment with normal CDR aggregates (higher realism/stealth). TABLE V: Retention on fixed-multiplier attacks (protocol P5; ResNet50): F1 (%) on the locked multiplier test split at τ = 0.5, before ADT (Phase 1) and after ADT round 3. Scenario SMS Call Internet Blended

Phase 1 (pre-ADT) 100.00 99.66 99.60 100.00

ADT round 3 100.00 100.00 66.80 100.00

Call F1 still rises to 79.6%. SMS F1 remains near 9% throughout. Cell-level localization. Per-cell accuracy heatmaps for the Blended scenario before and after ADT (Fig. 3) show that ADT converts a patchwork of inconsistent per-cell accuracies into a near-uniform 9 × 9 accuracy grid (≈ 100% per cell), resolving spatial inconsistencies across attacked locations. Retention on multiplier-based tests. Table V shows that ResNet50 retains 100% F1 on SMS, silent-call, and Blended on the multiplier test split at τ = 0.5 after ADT. For Internet, F1 decreases from 99.6% to 66.8%, while attack-cell recall remains 100% (TP= 6720, FN= 0), indicating a calibration shift driven by false positives on normal cells rather than loss of multiplier-attack recognition; increasing τ to 0.99 raises Internet F1 to 86.3%. SimpleCNN retains 100% F1 on all four scenarios after ADT round 3. E. Comparison with Generative and Adversarial-Training Baselines We compare ADT against a fixed-multiplier-trained detector without iterative retraining [4], fast gradient sign method (FGSM) adversarial training, projected gradient descent (PGD) adversarial training (ℓ∞ , ε = 0.1×, 10 steps), and conditional tabular GAN (CTGAN) [27] (150 epochs on up to 20,000 normal cell-level CDR features, same mild scenario scaling as Phase 2). All iterative methods follow the Phase 3 schedule (3 rounds, 100 augmented grids/round, 20 finetuning epochs/round) on ResNet50, evaluated on the locked TabDDPM test set (the same 335-image split as protocol P1: 167 normal + 168 TabDDPM attack grids; indices fixed after Phase 2 generation). We report τ = 0.5 as the deploymentdefault (attack-type labels are unavailable at deployment time) before presenting validation-calibrated results with per-method

Fig. 3: Cell-level accuracy heatmaps for the Blended scenario before and after ADT. 100

F1 @ = 0.5 (full test)

100

80

80

60

60

F1 (%)

50

76.41

1.0

F1 (%)

150

Joint MMD 2 to normal

Mean |z| on target channel

Realism metrics by scenario (bars: |z|, markers: joint MMD 2)

40 20 0

F1 @ F1max (locked test) ADT FGSM PGD CTGAN

40 20

SMS

Call Internet Blended

0

SMS

Call Internet Blended

Fig. 4: Baseline comparison on the locked TabDDPM test set (ResNet50, round 3). Left (P2): F1 at deployment-default τ = 0.5 (FGSM, PGD, and CTGAN each follow the identical 3-round schedule used for ADT). Right (P3): F1 at τF1max (validation-selected; Sec. VI-G). Compare methods within each panel; each panel applies a single threshold rule. Numeric values appear in Supplementary Table SIII. τF1max (Sec. VI-G). Fig. 4 summarizes round-3 F1 under protocols P2 (left) and P3 (right); compare methods within each panel, as the two panels apply distinct threshold rules (common τ = 0.5 versus per-method τF1max ). Results at τ = 0.5 (iterative protocol). Fig. 4 (left panel) and Supplementary Table SIII report round-3 F1 under protocol P2 (iterative baseline-comparison: FGSM, PGD, and CTGAN each follow the same 3-round retraining schedule as ADT). Under this protocol (τ = 0.5, locked TabDDPM test), ADT is the only method reaching operational F1 on Blended without per-method tuning (95.1% vs. ≤ 77.2% for FGSM/PGD/CTGAN). On Call, ADT leads (80.4%; nextbest PGD 77.0%). On Internet, ADT ties PGD/CTGAN (66.8%). On SMS, PGD reports higher round-3 F1 at τ = 0.5 (P2: 66.8% vs. ADT 7.2%); on the locked attack test split both achieve AUC= 1.0—a decision-rule artifact resolved in Sec. VI-G (Fig. 4, right panel). Validation-calibrated comparison. Fig. 4 (right panel) reports τF1max selected on the held-out attack validation split and applied once to the locked attack test (P3; distinct from the 335-grid τ = 0.5 scores in Table IV). ADT and PGD are essentially tied on Call (90.5% vs. 89.5%; bootstrap 95% CIs [85.6, 94.7] and [83.3, 94.3], overlapping). The clearest gap is SMS: ADT/FGSM/PGD reach 100% while CTGAN remains at 47.3%. Internet and Blended approach 100% for all methods after calibration. Is diffusion strictly necessary? FGSM and PGD are training-time perturbation methods that distort existing grids but cannot synthesize standalone manifold-consistent attack samples for independent stress-testing; PGD is competitive on

IEEE TRANSACTIONS ON INDUSTRIAL INFORMATICS, VOL. XX, NO. XX, XXXX

Method

Train (s) Aug. 100

FGSM / PGD — ≲0.01 CTGAN 62.5 0.007 TabDDPM 1296.0 — ADT round — 21.7 Note: FGSM/PGD: no generative model; augmentation is on-the-fly grid perturbation. CTGAN and TabDDPM: one-time offline training. ADT round: inverse-guided TabDDPM generation plus 20-epoch detector fine-tuning per round.

TABLE VII: Inverse-guidance sensitivity summary (ResNet50, round-3 F1 %). The operational default row reports P1 (cumulative Phase-3 ADT on the full 335-grid TabDDPM test, Table IV); sweep rows report a fresh-retrain, locked-test oneat-a-time sweep. The full grid is in Supplementary Table SII. λ 1.0 1.0 Fresh-retrain sweep 2.0 1.0 Protocol Operational default

pt Blended SMS Internet 0.3 92.8 9.6 100.0 0.3 66.8 100.0 66.8 0.3 66.8 100.0 100.0 0.1 100.0 100.0 65.9

Call but lacks CDR aggregate realism (Sec. VI-C). FGSM and PGD require no generative pre-training, whereas CTGAN trains ≈ 21× faster than TabDDPM (62.5 s vs. 1296.0 s; Table VI), but showed a large Blended round-wise regression (99.7% → 66.8% at τ = 0.5) and calibrated SMS F1 of only 47.3% (P3; Supplementary Table SIII bottom block). ADT combines manifold-preserving synthesis with deployable Blended robustness at the default threshold—properties not jointly matched by the alternatives. F. Inverse-Guidance Sensitivity and Online Latency ADT depends on guidance scale λ (steering strength) and ptarget (adversarial difficulty). We perform a one-at-a-time sweep on ResNet50: λ ∈ {0.25, 0.5, 1.0, 2.0} at ptarget =0.3, and ptarget ∈ {0.1, 0.3, 0.5, 0.7} at λ=1.0. Target-channel MMD2 stays flat (≈ 0.51–0.57), so neither hyperparameter materially affects on-manifold realism. On the fresh-retrain one-at-a-time sweep (P4; locked TabDDPM attack test, round3 F1 at τ = 0.5) in Table VII, robustness is sensitive and nonmonotonic: Internet F1 rises from 66.8% at λ=1.0 to 100% at λ=2.0; Blended F1 rises from 66.8% at ptarget =0.3 to 100% at ptarget =0.1. The table also reports the operational Phase-3 default; the full sweep is in Supplementary Sec. S-D. (1.0, 0.3) is the fixed deployment compromise, not a global optimum. Runtime CPS monitoring requires only the online forwardpass latencies in Table VIII. Diff-DDoS targets periodic CDR grid analytics, not per-packet or Ultra-Reliable and LowLatency Communications (uRLLC)-level (∼1 ms) inference: each 9 × 9 × 3 grid aggregates a 10-minute window (Sec. V), so the operative CPS latency budget is the inter-grid interval (600 s). SimpleCNN attains 35.7 ms mean (49.5 ms p95) and ResNet50 42.7 ms mean (60.4 ms p95) on an RTX 4090 reference GPU; worst batch-1 p95 is ≈ 104 × below the aggregation window (Supplementary Table SVIII). Offline pipeline cost is in Supplementary Sec. S-H (Table SVI).

TABLE VIII: Online single-grid inference latency for Phase 3 (ADT) detectors (batch = 1, scenario-averaged; RTX 4090, 500 iterations after 50 warmup). The per-scenario and batch= 32 breakdown is in Supplementary Table SVIII. Arch.

Mean (ms)

p95 (ms)

Grids/s

35.7 42.7

49.5 60.4

28.1 23.4

SimpleCNN ResNet50

ROC Curves (Micro-averaged, Blended scenario)

1.0

Phase 2: Baseline on TabDDPM attacks (Blended)

0.8 0.6 0.4 0.2 0.0 0.0

1.0

True Positive Rate

TABLE VI: Offline generative and augmentation cost (RTX 4090).

True Positive Rate

8

0.2

SimpleCNN (AUC=0.750) ResNet50 (AUC=0.997) Random (AUC=0.5) 0.4 0.6 0.8 1.0

False Positive Rate

Phase 3: ResNet50 on TabDDPM attacks (Blended)

0.8 0.6 0.4 0.2 0.0 0.0

0.2

Before ADT (AUC=0.997) After ADT (AUC=1.000) Random (AUC=0.5) 0.4 0.6 0.8 1.0

False Positive Rate

Fig. 5: ROC curves for the Blended scenario on TabDDPMgenerated attacks. Left: Phase 2 comparison of SimpleCNN and ResNet50. Right: ResNet50 before and after ADT in Phase 3. G. Operating Points: ROC-AUC and Threshold Calibration Micro-averaged ROC AUC (full table in Supplementary Table SVII; representative Blended ROC curves in Fig. 5, with additional ROC/PR curves in the Supplement) confirms Phase 1 perfect separability (AUC= 1.0). Phase 2 reveals vulnerability: SimpleCNN drops to AUC= 0.43 (SMS) and 0.75 (Blended), while ResNet50 holds 0.90–0.99. After ADT, SimpleCNN recovers to 0.85 (SMS) and 0.96 (Blended); ResNet50 reaches 0.95–1.0. The AUC/F1 gap is a decisionrule artifact: for SMS the detector correctly ranks attacks (ResNet50 AUC up to 1.0 after ADT) yet τ = 0.5 yields near-zero SMS F1 (Table IV; locked attack split in Fig. 6) because attack scores concentrate below 0.5; validation-based threshold calibration (below) resolves this. We implement validation-based threshold calibration and cost-sensitive retraining for the two threshold-sensitive sparseattack scenarios (SMS flooding and silent-call). For each, τF1max (validation F1-maximizing) and τY (Youden’s J = TPR−FPR) [42] are selected on a held-out validation split of the TabDDPM attack-only test grids (84 of 168 attack images, 50% split, seed 1) and applied once to the remaining 84 locked attack test grids (separate from the primary 335-image microaveraged evaluation in Table IV), so no test-set tuning occurs. Fig. 6 compares locked-test F1 at τ = 0.5, τF1max , and τY for Phase 2 (TabDDPM, no ADT) versus Phase 3 (ADT) on SMS flooding and silent-call. For ResNet50 on SMS flooding, calibration alone resolves the apparent ADT failure: on the locked attack split (Fig. 6), F1 rises from 4.82% at τ = 0.5 to 99.55% at τF1max = 0.05 (AUC= 1.0, FPR= 0%; Table SIV), confirming that ADT learned the attack and that the sub-10% SMS F1 at τ = 0.5 in Table IV was a fixed-threshold artifact rather than a learning failure. We also evaluate class-weighted BCE with positive-class

AUTHOR et al.: TITLE

9

SMS flooding SimpleCNN F1 on locked test (%)

100 80

F1@ = 0.5 F1@ F1max F1@ Y

85.1

SMS flooding ResNet50 93.8

Silent-call SimpleCNN

Silent-call ResNet50

99.6 99.9

60

75.8 48.6 52.6

58.8

53.0

9.1

91.6

43.4

40 20

75.5

85.3

6.9

5.6 4.8 4.7 2.4 0.0 0.0 0.0 0.0 0 0.0Phase 2 Phase 3 Phase 2 Phase 3 Phase 2 Phase 3 Phase 2 Phase 3 Fig. 6: Locked-test F1 at the default threshold versus validation-calibrated thresholds (τF1max , τY ) for the SMS and silent-call scenarios.

Call channel

H. Grad-CAM Interpretability of the SimpleCNN Silent-Call Anomaly

attn=51%, p=0.29

attn=54%, p=0.00

attn=52%, p=0.27

attn=55%, p=0.00

Fig. 7: Grad-CAM overlays for TabDDPM silent-call attacks (SimpleCNN): Call-channel input (left) and saliency maps for Phase 2 (trained on multiplier attacks, tested on TabDDPM silent-call grids) vs. Phase 3 ADT (same backbone after retraining). Boxed cells mark ground-truth attacked locations (green on the input panel, white on the overlays). Subplot titles report the mean predicted attack score on attacked cells (p̂) and the fraction of Grad-CAM saliency mass on those cells (attn).

Mean predicted attack score (attacked cells)

SimpleCNN silent-call F1 falls from 52.6% (Phase 2) to 9.7% (Phase 3, Table IV), which appears to contradict the ADT robustness claim. We apply Gradient-weighted Class Activation Mapping (Grad-CAM) [44] to SimpleCNN’s last convolutional layer on three grid types—normal (real) CDR snapshots, TabDDPM silent-call attacks, and fixed-multiplier baseline attacks—comparing the Phase 2 detector with the Phase 3 ADT model over N =40 test grids per condition. Warmer overlay colors in Fig. 7 indicate stronger Grad-CAM activation (where the model was most sensitive on that grid image); p̂ is the mean predicted attack score on attacked cells, analogous to pattack in Sec. IV-D. The figure shows three illustrative TabDDPM silent-call grids in which Phase 2 assigns moderate p̂ on attacked cells while Phase 3 drives p̂ near zero, even though the fraction of Grad-CAM mass on attacked cells (attn) stays ≈ 50% in both phases. Fig. 8 summarizes the score–saliency asymmetry quantitatively: across N =40 TabDDPM silent-call test grids, mean attacked-cell scores drop from 0.35 ± 0.47 (Phase 2) to 0.01±0.07 (Phase 3), matching the F1 collapse, while saliency mass on attacked cells stays comparable (0.51±0.01 vs. 0.51± 0.02). On multiplier-based attacks, mean scores remain near 1.0 in both phases, while Phase 3 saliency becomes diffuse (0.18 ± 0.24 vs. 0.51 ± 0.01; Supplementary Table SV). ADT on SimpleCNN therefore overfits to stealth guidance samples and suppresses detection on manifold-preserving TabDDPM traffic rather than losing localization; ResNet50 still reaches 79.6% F1 under the same protocol. Full numerical Grad-CAM results are in Supplementary Sec. S-G (Table SV).

Phase 2 (TabDDPM test) Phase 3 (ADT) attn=51%, p=0.50 attn=50%, p=0.00

1.0

1.0

0.8

0.8

0.6 0.4 0.2

Saliency mass on attacked cells

weight (w+ ≈ 8.5) and focal loss (γ = 2, α = 0.75) [43] over five seeds. For SMS flooding, neither calibration nor cost-sensitive retraining raises SimpleCNN F1 above 12.3 ± 8.6% (large seed variance), indicating a capacity limit on the lightweight backbone; we therefore adopt ResNet50 as the deployable detector for sparse attacks. For silent-call, weighted BCE raises mean locked-test AUC from 0.65 to 0.85 ± 0.09, but F1 at τF1max remains only 48.5 ± 25.3% with large seed variance. The full per-architecture grid, Youden thresholds with FPR, and cost-sensitive comparisons appear in Supplementary Sec. S-F (Table SIV); see also Fig. 6.

0.6

Phase 2, TabDDPM Phase 2, Multiplier Phase 3 ADT, TabDDPM Phase 3 ADT, Multiplier

0.4 0.2

0.0 TabDDPM 0.0 TabDDPM Multiplier Multiplier Fig. 8: Quantitative Grad-CAM summary for SimpleCNN before vs. after ADT on attacked cells. Left: mean predicted attack score on attacked cells for TabDDPM and multiplier attack sets. Right: Grad-CAM saliency mass on attacked cells for the same sets. Bars compare Phase 2 and Phase 3 (ADT); error bars denote ±1 sample standard deviation over N = 40 test grids per condition.

10

IEEE TRANSACTIONS ON INDUSTRIAL INFORMATICS, VOL. XX, NO. XX, XXXX

VII. L IMITATIONS AND C ONCLUSION We found that multiplier-trained CDR detectors fail on manifold-preserving attacks: Phase 2 F1 collapsed to near zero in three of four scenarios (Table IV), while ADT with ResNet50 recovered deployable F1 for silent-call (79.6%), Internet (100%), and Blended (92.8%), retaining near-perfect multiplier-test performance except an Internet calibration shift (Table V). This extends Hussain et al. [4] from multiplier baselines to manifold-preserving stress tests and applies inverseguided TabDDPM for iterative cellular IDS hardening. Calibration resolves the SMS threshold artifact (Sec. VI-G), GradCAM shows SimpleCNN can suppress stealth silent-call scores without losing localization (Sec. VI-H), and ADT matched or exceeded gradient- and GAN-based baselines (Sec. VI-E). Three limitations bound external validity. No labeled percell cellular DDoS CDR ground truth exists (Sec. VI-A), so evaluation uses synthetic rather than operator-confirmed attack traces. Attack realism uses coarse 3D aggregate statistics— mean |z| and MMD2 on SMS/CALL/INTERNET sums (Sec. VI-C)—a proxy that omits full grid spatiotemporal structure and does not establish field adversary fidelity. Finally, the Milano corpus reflects 3G/4G-era metropolitan traffic [35], and ten-minute grid monitoring targets periodic CPS analytics rather than sub-millisecond uRLLC control (Sec. VI-F). Operator CDR validation and packet-level 5G corpora where mapping permits [40], [41] should confirm ADT transfer beyond Milano; future work includes adaptive adversaries and regional scale-up [6]. For 5G-connected CPS and IoT services, stealthy signaling abuse threatens network and physicalprocess availability; pre-deployment stress testing is a practical safeguard. Manifold-preserving TabDDPM attacks expose multiplier-trained brittleness, and ADT recovers robustness with ResNet50 and calibration, offering a workflow to harden cell-level DDoS monitors when labeled attack CDRs remain scarce. R EFERENCES [1] A. Humayed, J. Lin, F. Li, and B. Luo, “Cyber-physical systems security—a survey,” IEEE Internet Things J., vol. 4, no. 6, pp. 1802– 1831, 2017. [2] L. He, Z. Yan, and M. Atiquzzaman, “LTE/LTE-A network security data collection and analysis for security measurement: A survey,” IEEE Access, vol. 6, pp. 4220–4242, 2018. [3] 3GPP, “Study on the security aspects of the next generation system,” 3rd Generation Partnership Project (3GPP), Tech. Rep. TR 33.899, Rel. 14, v1.3.0, 2017. [4] B. Hussain, Q. Du, B. Sun, and Z. Han, “Deep learning-based DDoSattack detection for cyber-physical system over 5G network,” IEEE Trans. Ind. Informat., vol. 17, no. 2, pp. 860–870, 2021. [5] A. Alam, A. Umer, I. Ullah, and A. Alsayat, “AI-enabled cybersecurity framework for future 5G wireless infrastructures,” Sci. Rep., vol. 16, p. 7055, 2026. [6] B. Hussain, M. Bilal, T. Li, H. Pervaiz, X. Tang, Q. Du, F. Ahmad, M. Azhar, and J. Zhang, “AI-native closed-loop security for 6Genabled cyber-physical systems: From edge detection to network-wide mitigation,” arXiv:2606.08173, 2026. [7] ENISA, “ENISA threat landscape 2025,” European Union Agency for Cybersecurity (ENISA), Tech. Rep., Oct. 2025. [8] G.-H. Tu, C.-Y. Li, C. Peng, and S. Lu, “How voice call technology poses security threats in 4G LTE networks,” in Proc. IEEE Conf. Commun. Netw. Secur. (CNS), 2015, pp. 442–450. [9] I. Murynets and R. P. Jover, “Anomaly detection in cellular machineto-machine communications,” in Proc. IEEE Int. Conf. Commun. (ICC), 2013, pp. 2138–2143.

[10] D. K. Nguyen, R. E. Malki, and F. Rebecchi, “RRC signaling storm detection in O-RAN,” in Proc. IEEE Symp. Comput. Commun. (ISCC), 2025, pp. 1–7. [11] H. Wen, P. Porras, V. Yegneswaran, A. Gehani, and Z. Lin, “5G-Spector: An O-RAN compliant layer-3 cellular attack detection service,” in Proc. 31st Annu. Netw. Distrib. Syst. Secur. Symp. (NDSS), 2024. [12] K. He, D. D. Kim, and M. R. Asghar, “Adversarial machine learning for network intrusion detection systems: A comprehensive survey,” IEEE Commun. Surveys Tuts., vol. 25, no. 1, pp. 538–566, 2023. [13] H. A. Alatwi and C. Morisset, “Adversarial machine learning in network intrusion detection domain: A systematic review,” arXiv:2112.03315, 2021. [14] S. Mavoungou, G. Kaddoum, M. Taha, and G. Matar, “Survey on threats and attacks on mobile networks,” IEEE Access, vol. 4, pp. 4543–4572, 2016. [15] D. Dahiya, “DDoS attacks detection in 5G networks: Hybrid model with statistical and higher-order statistical features,” Cybern. Syst., vol. 54, no. 6, pp. 888–913, 2023. [16] P. Munaweera, S. Prasad, T. Hewa, Y. Siriwardhana, and M. Ylianttila, “Federated learning-powered DDoS attack detection for securing cyber physical systems in 5G and beyond networks,” in Proc. 14th Int. Conf. Internet Things (IoT), 2024, pp. 273–278. [17] B. H. Swathi, R. Arvind, S. Benvin, R. Gupta, R. Maranan, and R. Jayanthi, “Securing 5G-enabled cyber-physical systems: An optimized reflection equivariant quantum neural network approach to DDoS attack detection,” in Proc. 3rd Int. Conf. Self Sustain. Artif. Intell. Syst. (ICSSAS), 2025, pp. 606–612. [18] D. Naboulsi, M. Fiore, S. Ribot, and R. Stanica, “Large-scale mobile traffic analysis: A survey,” IEEE Commun. Surveys Tuts., vol. 18, no. 1, pp. 124–161, 2016. [19] F. Xu, Y. Li, H. Wang, P. Zhang, and D. Jin, “Understanding mobile traffic patterns of large scale cellular towers in urban environment,” IEEE/ACM Trans. Netw., vol. 25, no. 2, pp. 1147–1161, 2017. [20] A. Furno, M. Fiore, and R. Stanica, “Joint spatial and temporal classification of mobile traffic demands,” in Proc. IEEE INFOCOM, 2017, pp. 1–9. [21] D. Naboulsi, R. Stanica, and M. Fiore, “Classifying call profiles in largescale mobile traffic datasets,” in Proc. IEEE INFOCOM, 2014, pp. 1806– 1814. [22] K. Sultan, H. Ali, and Z. Zhang, “Call detail records driven anomaly detection and traffic prediction in mobile cellular networks,” IEEE Access, vol. 6, pp. 41 728–41 737, 2018. [23] Z. Aziz and R. Bestak, “Insight into anomaly detection and prediction and mobile network security enhancement leveraging k-means clustering on call detail records,” Sensors, vol. 24, no. 6, p. 1716, 2024. [24] N. Shone, T. N. Ngoc, V. D. Phai, and Q. Shi, “A deep learning approach to network intrusion detection,” IEEE Trans. Emerg. Topics Comput. Intell., vol. 2, no. 1, pp. 41–50, 2018. [25] G. Apruzzese, M. Colajanni, L. Ferretti, A. Guido, and M. Marchetti, “On the effectiveness of machine and deep learning for cyber security,” in Proc. 10th Int. Conf. Cyber Conflict (CyCon), 2018, pp. 371–390. [26] D. Arp, E. Quiring, F. Pendlebury, A. Warnecke, F. Pierazzi, C. Wressnegger, L. Cavallaro, and K. Rieck, “Dos and don’ts of machine learning in computer security,” in Proc. 31st USENIX Security Symp. (USENIX Security), 2022, pp. 3971–3988. [27] L. Xu, M. Skoularidou, A. Cuesta-Infante, and K. Veeramachaneni, “Modeling tabular data using conditional GAN,” in Adv. Neural Inf. Process. Syst. (NeurIPS), 2019, pp. 7335–7345. [28] A. Kotelnikov, D. Baranchuk, I. Rubachev, and A. Babenko, “TabDDPM: Modelling tabular data with diffusion models,” in Proc. 40th Int. Conf. Mach. Learn. (ICML), 2023, pp. 17 564–17 579. [29] M. C. Stoian, E. Giunchiglia, and T. Lukasiewicz, “A survey on deep learning approaches for tabular data generation: Utility, alignment, fidelity, privacy, diversity, and beyond,” Trans. Mach. Learn. Res., 2026. [Online]. Available: https://openreview.net/forum?id=RoShSRQQ67 [30] I. J. Goodfellow, J. Shlens, and C. Szegedy, “Explaining and harnessing adversarial examples,” in Proc. Int. Conf. Learn. Represent. (ICLR), 2015. [31] A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu, “Towards deep learning models resistant to adversarial attacks,” in Proc. Int. Conf. Learn. Represent. (ICLR), 2018. [32] M. Alauthman, N. Aslam, A. Al-Qerem, A. Aldweesh, and P. Sureephong, “Generative adversarial networks for intrusion detection systems: A comprehensive survey of applications, challenges, and research directions,” Arab. J. Sci. Eng., vol. 51, no. 1, pp. 179–203, 2026.

AUTHOR et al.: TITLE

11

[33] W. Nie, B. Guo, Y. Huang, C. Xiao, A. Vahdat, and A. Anandkumar, “Diffusion models for adversarial purification,” in Proc. 39th Int. Conf. Mach. Learn. (ICML), 2022. [34] M. A. Merzouk, E. Beurier, R. Yaich, N. Boulahia-Cuppens, F. Cuppens, and F. Khomh, “Diffusion-based adversarial purification for intrusion detection,” in Data and Applications Security and Privacy XXXIX, ser. Lecture Notes in Computer Science. Springer, 2025, vol. 15722, pp. 351–370. [35] G. Barlacchi, M. De Nadai, R. Larcher, A. Casella, C. Chitic, G. Torrisi, F. Antonelli, A. Vespignani, A. Pentland, and B. Lepri, “A multi-source dataset of urban life in the city of Milan and the province of Trentino,” Sci. Data, vol. 2, p. 150055, 2015. [36] J. Ho, A. Jain, and P. Abbeel, “Denoising diffusion probabilistic models,” in Adv. Neural Inf. Process. Syst. (NeurIPS), vol. 33, 2020, pp. 6840– 6851. [37] P. Dhariwal and A. Nichol, “Diffusion models beat GANs on image synthesis,” in Adv. Neural Inf. Process. Syst. (NeurIPS), vol. 34, 2021, pp. 8780–8794. [38] T. Xie, C.-Y. Li, J. Tang, and G.-H. Tu, “How voice service threatens cellular-connected IoT devices in the operational 4G LTE networks,” in Proc. IEEE Int. Conf. Commun. (ICC), 2018, pp. 1–6. [39] Z. Aziz and R. Bestak, “Modeling voice traffic patterns for anomaly detection and prediction in cellular networks based on CDR data,” IEEE Trans. Mobile Comput., vol. 23, no. 12, pp. 13 131–13 143, 2024. [40] Y. Siriwardhana, S. Samarakoon, P. Porambage, M. Liyanage, S.-Y. Chang, J. Kim, J. Kim, and M. Ylianttila, “Descriptor: 5G wireless network intrusion detection dataset (5G-NIDD),” IEEE Data Descr., vol. 2, pp. 358–369, 2025. [41] N. C. of Scientific Research “Demokritos” and S. H. (Greece), “NCSRDDS-5GDDoS: 5G radio and core metrics containing sporadic DDoS attacks,” Zenodo, version v3.0, Oct. 2024. [42] W. J. Youden, “Index for rating diagnostic tests,” Cancer, vol. 3, no. 1, pp. 32–35, 1950. [43] T.-Y. Lin, P. Goyal, R. Girshick, K. He, and P. Dollár, “Focal loss for dense object detection,” IEEE Trans. Pattern Anal. Mach. Intell., vol. 42, no. 2, pp. 318–327, 2020. [44] R. R. Selvaraju, M. Cogswell, A. Das, R. Vedantam, D. Parikh, and D. Batra, “Grad-CAM: Visual explanations from deep networks via gradient-based localization,” Int. J. Comput. Vis., vol. 128, no. 2, pp. 336–359, 2020.

Bilal Hussain (Senior Member, IEEE) received the B.E. degree in electrical engineering from Bahria University, Pakistan, in 2010, the M.Sc. degree in information and communications engineering from the University of Leicester, Leicester, U.K., in 2011, and dual Ph.D. degrees in information and communications engineering from The Hong Kong Polytechnic University (PolyU), Hong Kong SAR, China, in 2021, and Xi’an Jiaotong University, Xi’an, China, in 2022. He is currently a Lecturer with the Division of Science, Engineering, and Health Studies, School of Professional Education and Executive Development, PolyU. Previously, he was a Postdoctoral Fellow with the Centre for Advances in Reliability and Safety, Hong Kong. His research focuses on intelligent 6G networks, Agentic AI, real-time edge intelligence, and robust cyber-physical systems security.

Xiao Tang (Member, IEEE) received the B.S. degree in information engineering (Elite Class Named After Tsien Hsue-shen) and the Ph.D. degree (Hons.) in information and communication engineering from Xi’an Jiaotong University, Xi’an, China, in 2011 and 2018, respectively. He is currently an Associate Professor with the School of Information and Communication Engineering, Xi’an Jiaotong University, Xi’an, China.

Qinghe Du (Member, IEEE) received the B.S. and M.S. degrees in electrical engineering from Xi’an Jiaotong University, China, in 2001 and 2004, respectively, and the Ph.D. degree in computer engineering from Texas A&M University, College Station, TX, USA, in 2010. He is currently a Professor with the School of Information and Communications Engineering, Xi’an Jiaotong University. He has published over 150 technical papers in refereed technical journals and international academic conferences. His research interests widely cover related areas of mobile wireless communications and networking. He received several Best Paper Awards from the international academic conferences and technical journals. He served and/or serves as an Associate Editor for the IEEE T RANSAC TIONS ON C OMMUNICATIONS and IEEE C OMMUNICATIONS L ETTERS , an Area Editor for KSII Transactions on Internet and Information Systems, and an Editor for Electronics.

Tan Li (Member, IEEE) received the Ph.D. degree in computer science from City University of Hong Kong, Hong Kong SAR, China, in 2023, the M.Eng. degree in control engineering from the University of Science and Technology of China, Hefei, China, in 2019, and the B.Eng. degree in automation from Central South University, Changsha, China, in 2016. She is currently an Assistant Professor with the Department of Computer Science, The Hang Seng University of Hong Kong, Hong Kong SAR, China. Her research interests include federated learning and machine learning for wireless communications.

Muhammad Azhar (Member, IEEE) received the B.S. degree in computer science from the National University of Computer and Emerging Sciences, Islamabad, Pakistan, the master’s degree in computer science from Sejong University, Seoul, South Korea, and the Ph.D. degree in machine learning and data mining from Shenzhen University, Shenzhen, China. He is currently an Associate Professor and the Associate Head of the Department of Applied Data Science with Hong Kong Shue Yan University, Hong Kong SAR, China. He also serves as the Director of the university’s Big Data Laboratory. His research interests include data mining, natural language processing, and advanced deep-learning techniques.

Danista Khan (Member, IEEE) received the Ph.D. degree in electrical and electronic engineering from The Hong Kong Polytechnic University (PolyU), Hong Kong SAR, China, specializing in applied deep-learning methods for wireless sensing. She received the master’s degree in electrical engineering from the University of Engineering and Technology, Lahore, Pakistan, and the bachelor’s degree in electrical engineering from The University of Lahore, Lahore, Pakistan. She is currently a Lecturer with the Division of Business and Hospitality Management, School of Professional Education and Executive Development, PolyU. Her research interests include wireless communications and networking, wireless sensing, and the Internet of Things.

Related documents

• Feature Attribution in 5G Intrusion Detection: A Statistical vs. Logic-Based Comparison#684263
• Feature Attribution in 5G Intrusion Detection: A Statistical vs. Logic-Based Comparison#682488
• PCDM: A Diffusion-Based Data Poisoning Attack Against Federated Learning Systems#194283
• Network checkpoint#133904
• GNSS Spoofing Detection in TDD Networks: A 3GPP Standards-Based Security Framework#363169