Diff-DDoS: Realistic Cyber-Physical Attack Synthesis and Robust Detection for 5G-Enabled CPS Using Tabular Diffusion Models

Bilal Hussain; Xiao Tang; Qinghe Du; Tan Li; Muhammad Azhar; Danista Khan

cs.CRAug 18, 2026

Diff-DDoS: Realistic Cyber-Physical Attack Synthesis and Robust Detection for 5G-Enabled CPS Using Tabular Diffusion Models

Authors: Bilal Hussain, Xiao Tang, Qinghe Du, Tan Li, Muhammad Azhar, Danista Khan

Organizations: Division of Science, Engineering, and Health Studies, School of Professional Education and Executive Development, The Hong Kong Polytechnic University · School of Information and Communications Engineering, Xi’an Jiaotong University · Department of Computer Science, The Hang Seng University of Hong Kong · Department of Applied Data Science, Hong Kong Shue Yan University ·

Abstract

Deep learning-based DDoS detectors for 5G-enabled cyber-physical systems face scarce labeled attack data and unrealistic synthetic substitutes, which limit robustness against adaptive adversaries. Detectors trained on hand-crafted attacks with fixed scaling multipliers degrade catastrophically (F1-score drops of about 47 percent to 100 percent, depending on scenario) when confronted with realistic, distribution-preserving samples. We propose Diff-DDoS, a three-phase framework for realistic attack synthesis and robust detection using tabular diffusion models. Phase 1 trains a baseline CNN cell-level detector on spatiotemporal grids from call detail records (CDRs). Phase 2 trains a tabular denoising diffusion probabilistic model (TabDDPM) on normal CDR aggregates to generate realistic attacks and expose detector vulnerabilities. Phase 3 introduces adversarial diffusion training (ADT), using inverse classifier guidance to generate hard yet distribution-preserving samples until the detector converges. On a Milano CDR dataset across SMS-flooding, silent-call, Internet-signaling, and blended scenarios, ResNet50 with ADT recovers F1-scores of 79.62 percent (silent-call), 100 percent (Internet), and 92.79 percent (blended). After validation-based threshold calibration, ADT reaches 100 percent SMS F1 versus 47.3 percent for CTGAN, and matches the strongest gradient-based adversarial-training baseline on silent-call. These results support tabular diffusion models for stress-testing and hardening intrusion detectors in data-scarce 5G cyber-physical deployments.

Figures & tables

Symbol	Meaning
$\mathcal{M}(\cdot;\theta)$ , $f_{\theta}$	Multilabel CNN detector ( $81$ sigmoid outputs per grid)
$\Xi_{s}^{r}$ , $\Xi_{s}^{r,\mathrm{orig}}$ , $\Xi_{s}^{r,\mathrm{Tab}}$	Metric bundles (Acc, Prec, Rec, F1, FPR) for attack scenario $s$ at ADT round $r$ ; not the detector
$\theta$ , $\theta_{s}^{*}$ , $\theta_{s}^{r}$	Detector learnable weights
$\epsilon_{\psi}$ , $\phi_{\mathrm{TabDDPM}}$	TabDDPM denoiser network (weights $\psi$ ; distinct from $\theta$ )
$\phi_{s}:\mathbb{R}^{3}\!\to\!\mathbb{R}^{3}$	Mild post-sample scenario scaling on 3D CDR aggregates (Phase 2)
$\mathrm{MapToGrid}(\tilde{\mathbf{x}},B)$	Copy background $B$ , write aggregate $\tilde{\mathbf{x}}$ into attacked cells $\mathcal{C}$ , set $Y_{k}=1$ on $\mathcal{C}$

TABLE I: Main-text notation summary.

Fig. 1: Overview of the proposed Diff-DDoS framework. Phase 1 trains baseline detectors on multiplier-based attacks, Phase 2 uses TabDDPM to generate realistic attacks from normal CDR aggregates, and Phase 3 applies ADT to generate hard on-manifold samples for iterative retraining.

Mechanism	Phase	Action	Purpose
Fixed multipliers	1	$169.5\times$ SMS, $-33.1\times$ Call, $43.3\times$ Internet	Stylized baseline
Heuristic steering $+$ $\phi_{s}$	2	Mild $\gamma$ ranges on target channel(s)	On-manifold vulnerability test
Inverse classifier guidance	3	Minimize $p_{\mathrm{attack}}$ toward $p_{\mathrm{target}}$	Hard robust-training samples

TABLE II: Attack-steering mechanisms across Diff-DDoS phases.

ID	Protocol	Main location
P1	$335$ -grid TabDDPM test; $\tau=0.5$ ; cumulative Phase-3 ADT	Table IV
P2	Same test as P1; fresh 3-round schedule per method; $\tau=0.5$	Fig. 4 (left)
P3	Locked attack test; $\tau_{\mathrm{F1max}}$ or $\tau_{\mathrm{Y}}$ from validation	Fig. 4 (right); Sec. VI-G
P4	Fresh-retrain $\lambda$ / $p_{\mathrm{target}}$ sweep; locked test	Table VII
P5	Multiplier test split; $\tau=0.5$	Table V

TABLE III: Reader’s guide to F1 evaluation protocols.

Scenario	Ph. 1			Ph. 2	Ph. 3 F1
Scenario	Acc	Rec	F1	F1	R1	R2	R3
SMS (SC)	99.96	99.85	99.93	0	9.09	9.09	9.09
SMS (R50) a	100	100	100	0	6.98	9.74	9.58
Call (SC) b	99.85	99.40	99.70	52.63	38.44	12.87	9.71
Call (R50)	99.83	99.32	99.66	7.56	77.22	81.52	79.62
Internet (SC)	100	100	100	0	89.14	96.78	96.62

TABLE IV: Detector performance across phases (protocol P1; all values in %; deployment-default

\tau=0.5

). Ph. 1: multiplier-based test attacks (Acc, Rec, F1); precision is

100\%

for all rows (omitted). Ph. 2: TabDDPM-generated attacks without retraining. Ph. 3: ADT rounds R1–R3. SC: SimpleCNN; R50: ResNet50.

Fig. 2: Dual-axis realism summary on test attack grids (

168

per scenario). Bars (left axis) show target-channel mean absolute

z

-score, and lines (right axis) show joint (3D) MMD 2 to normal, for TabDDPM and multiplier attacks across scenarios. Lower values indicate closer alignment with normal CDR aggregates (higher realism/stealth).

Scenario	Phase 1 (pre-ADT)	ADT round 3
SMS	100.00	100.00
Call	99.66	100.00
Internet	99.60	66.80
Blended	100.00	100.00

TABLE V: Retention on fixed-multiplier attacks (protocol P5; ResNet50): F1 (%) on the locked multiplier test split at

\tau=0.5

, before ADT (Phase 1) and after ADT round 3.

Fig. 3: Cell-level accuracy heatmaps for the Blended scenario before and after ADT.

Fig. 4: Baseline comparison on the locked TabDDPM test set (ResNet50, round 3). Left (P2): F1 at deployment-default

\tau=0.5

(FGSM, PGD, and CTGAN each follow the identical 3-round schedule used for ADT). Right (P3): F1 at

\tau_{\mathrm{F1max}}

(validation-selected; Sec. VI-G ). Compare methods within each panel; each panel applies a single threshold rule. Numeric values appear in Supplementary Table SIII.

Method	Train (s)	Aug. 100
FGSM / PGD	—	${\lesssim}0.01$
CTGAN	62.5	0.007
TabDDPM	1296.0	—
ADT round	—	21.7

TABLE VI: Offline generative and augmentation cost (RTX 4090).

Protocol	$\lambda$	$p_{\mathrm{t}}$	Blended	SMS	Internet
Operational default	1.0	0.3	92.8	9.6	100.0
Fresh-retrain sweep	1.0	0.3	66.8	100.0	66.8
	2.0	0.3	66.8	100.0	100.0
	1.0	0.1	100.0	100.0	65.9

TABLE VII: Inverse-guidance sensitivity summary (ResNet50, round-3 F1 %). The operational default row reports P1 (cumulative Phase-3 ADT on the full

335

-grid TabDDPM test, Table IV ); sweep rows report a fresh-retrain, locked-test one-at-a-time sweep. The full grid is in Supplementary Table SII.

Arch.	Mean (ms)	p95 (ms)	Grids/s
SimpleCNN	35.7	49.5	28.1
ResNet50	42.7	60.4	23.4

TABLE VIII: Online single-grid inference latency for Phase 3 (ADT) detectors (batch

=1

, scenario-averaged; RTX 4090, 500 iterations after 50 warmup). The per-scenario and batch-

=32

breakdown is in Supplementary Table SVIII.

Fig. 5: ROC curves for the Blended scenario on TabDDPM-generated attacks. Left: Phase 2 comparison of SimpleCNN and ResNet50. Right: ResNet50 before and after ADT in Phase 3.

Fig. 6: Locked-test F1 at the default threshold versus validation-calibrated thresholds (

\tau_{\mathrm{F1max}}

\tau_{\mathrm{Y}}

) for the SMS and silent-call scenarios.

Fig. 7: Grad-CAM overlays for TabDDPM silent-call attacks (SimpleCNN): Call-channel input (left) and saliency maps for Phase 2 (trained on multiplier attacks, tested on TabDDPM silent-call grids) vs. Phase 3 ADT (same backbone after retraining). Boxed cells mark ground-truth attacked locations (green on the input panel, white on the overlays). Subplot titles report the mean predicted attack score on attacked cells ( $\hat{p}$ ) and the fraction of Grad-CAM saliency mass on those cells ( attn ).

Fig. 8: Quantitative Grad-CAM summary for SimpleCNN before vs. after ADT on attacked cells. Left: mean predicted attack score on attacked cells for TabDDPM and multiplier attack sets. Right: Grad-CAM saliency mass on attacked cells for the same sets. Bars compare Phase 2 and Phase 3 (ADT); error bars denote

\pm 1

sample standard deviation over

N=40

test grids per condition.

Cybersecurity

Cybersecurity develops methods to protect digital and cyber-physical systems from attacks, vulnerabilities, data loss, and misuse.

See all 347 papers

Adversarial Debiasing of Machine Learning Models for Enhanced Network Security against DDoS Attacks
Sep 28, 2026Aadith Sukumar, Isha Singh, Devershika Mohane +4Network Intrusion Detection Adversarial Debiasing
Symbiosis Institute of Technology Pune, India · Symbiosis Center for Applied Artificial Intelligence, Pune, India · Peoples’ Friendship University of Russia Moscow, Russian Federation
Cognitive Graph Intelligence for Adaptive and Robust DDoS Attack Detection in Next Generation Networks
Aug 18, 2026Mohammad Arif Hossain, Yeahia Sarker, Md Jafrin Hossain +2Network Intrusion Detection Generative Adversarial Networks
Middle Tennessee State University, USA · C2C Tech, Germany · New Jersey Institute of Technology, USA
A GAN-Based Framework for Robust DDoS Attack Detection
Sep 16, 2026Makram Chehayeb, Walid Fahs, Amina Rizk +2Adversarial Training Synthetic Data Augmentation
Islamic University of Lebanon, Faculty of Engineering, Lebanon · Lebanese University, Faculty of Sciences, Lebanon · Polytechnic Institute of Paris, T´el´ecom Paris, LTCI, France

Sep 28, 2026J/K move · Enter open · S save

Adversarial Debiasing of Machine Learning Models for Enhanced Network Security against DDoS Attacks

Aadith Sukumar, Isha Singh, Devershika Mohane, Ankit Mukherjee+3

Symbiosis Institute of Technology Pune, India · Symbiosis Center for Applied Artificial Intelligence, Pune, India · Peoples’ Friendship University of Russia Moscow, Russian Federation

Network Intrusion Detection Adversarial Debiasing

Open paper AskPDF arXiv

Distributed Denial of Service attacks are a growing threat to network infrastructure, and new techniques, including the use of generative AI, make them harder to detect. Traditional detection systems, such as rule based firewalls, often fail to identify these evolving attack patterns. In this study, we propose a new method for detecting DDoS attacks by combining synthetic data generation using Generative Adversarial Networks with a Random Forest classifier. The GAN generated data showed 80.3 percent cosine similarity to real traffic, which helped the model learn underlying traffic patterns more effectively. To address imbalances in the data, especially in packet related features, we applied adversarial debiasing. This reduced the model's sensitivity to skewed distributions in variables such as forward and backward packet counts and total byte lengths. Our results show that models trained on a mix of synthetic and real data achieved significantly better performance: 99.98 percent accuracy on benchmark data and a 22.60 percent improvement when tested on previously unseen synthetic traffic. This suggests that the method can generalize well across different traffic scenarios and adapt quickly to new types of attacks. The proposed approach not only improves DDoS detection but also provides a scalable foundation for security models that account for bias and benefit from data augmentation. Our findings show that combining GANs with adversarial debiasing can lead to more robust and effective DDoS mitigation, supporting the further development of machine learning based cyber security.

Abstract

Cybersecurity

Explore similar work

Adversarial Debiasing of Machine Learning Models for Enhanced Network Security against DDoS Attacks

Cognitive Graph Intelligence for Adaptive and Robust DDoS Attack Detection in Next Generation Networks

A GAN-Based Framework for Robust DDoS Attack Detection