Search papers, labs, and topics across Lattice.
This paper introduces Diff-DDoS, a novel framework that synthesizes realistic cyber-physical attacks and enhances detection robustness for 5G-enabled systems using tabular diffusion models. By training a CNN detector on call detail records and employing a tabular denoising diffusion probabilistic model to generate realistic attack scenarios, the framework reveals vulnerabilities in existing detection systems. The results demonstrate significant improvements in F1-scores, achieving up to 100% accuracy in certain attack scenarios, thereby validating the effectiveness of diffusion models in enhancing cybersecurity measures in data-scarce environments.
Realistic attack synthesis using tabular diffusion models can boost DDoS detection accuracy in 5G systems from catastrophic failures to perfect scores.
Deep learning-based DDoS detectors for 5G-enabled cyber-physical systems face scarce labeled attack data and unrealistic synthetic substitutes, which limit robustness against adaptive adversaries. Detectors trained on hand-crafted attacks with fixed scaling multipliers degrade catastrophically (F1-score drops of about 47 percent to 100 percent, depending on scenario) when confronted with realistic, distribution-preserving samples. We propose Diff-DDoS, a three-phase framework for realistic attack synthesis and robust detection using tabular diffusion models. Phase 1 trains a baseline CNN cell-level detector on spatiotemporal grids from call detail records (CDRs). Phase 2 trains a tabular denoising diffusion probabilistic model (TabDDPM) on normal CDR aggregates to generate realistic attacks and expose detector vulnerabilities. Phase 3 introduces adversarial diffusion training (ADT), using inverse classifier guidance to generate hard yet distribution-preserving samples until the detector converges. On a Milano CDR dataset across SMS-flooding, silent-call, Internet-signaling, and blended scenarios, ResNet50 with ADT recovers F1-scores of 79.62 percent (silent-call), 100 percent (Internet), and 92.79 percent (blended). After validation-based threshold calibration, ADT reaches 100 percent SMS F1 versus 47.3 percent for CTGAN, and matches the strongest gradient-based adversarial-training baseline on silent-call. These results support tabular diffusion models for stress-testing and hardening intrusion detectors in data-scarce 5G cyber-physical deployments.
