Paper deep dive
Diffusion-Based Stress Testing of Overload Monitoring for Resilient Emergency Cellular Networks Using Internet CDR Proxies
Bilal Hussain, Xiao Tang, Tan Li, Muhammad Azhar, Danista Khan, Fawad Ahmad
Intelligence
Status: not_run | Model: - | Prompt: - | Confidence: 0%
Entities (0)
Relation Signals (0)
No relation signals yet.
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Disasters can overload cellular control-plane signaling within minutes, yet fine-grained Radio Resource Control (RRC) or Next Generation (NG) Application Protocol (NGAP) telemetry is privacy-sensitive and costly to collect for analytics. Many emergency monitoring pipelines therefore rely on coarse Call Detail Record (CDR) aggregates. We treat Internet activity in CDR grids as a practical proxy for hidden signaling stress under that constraint. We train a lightweight convolutional neural network (CNN) on stylized overload injections, stress-test it with diffusion-synthesized surges that preserve normal traffic structure, and adapt the detector by retraining on hard synthetic samples. Under stress-test conditions, the default alert threshold fails even though receiver operating characteristic (ROC) curves stay strong: the detector still assigns overloaded cells a larger overload probability than normal cells, but those probabilities fall below the default cutoff 0.5 and are labeled normal, so the F1-maximizing threshold -- selected post hoc on the same stress-test grids (oracle $\tau^*$) -- shifts by $0.32 \pm 0.03$ (operating-point drift). Across three random seeds, hard-sample adaptation raises thresholded performance (F1) from 0% (no alerts at the default cutoff 0.5 on any seed) to $85.67 \pm 14.37$% and ranking from ROC-AUC $0.886 \pm 0.040$ to $0.99996 \pm 0.00007$. Diffusion-synthesized surges expose threshold fragility that matched-condition training -- training and testing on the same stylized injections -- hides, and hard-sample adaptation restores usable alerts at the default cutoff. Together, these steps define a reusable pre-deployment stress test for emergency monitors. Internet-only CDR input further supports lightweight AI-native workflows that combine monitoring, recalibration, and adaptation.
Tags
Links
- Source: https://arxiv.org/abs/2610.04526v1
- Canonical: https://arxiv.org/abs/2610.04526v1
Trouble viewing inline? Open PDF directly →
Full Text
34,911 characters extracted from source content.
Expand or collapse full text
Diffusion-Based Stress Testing of Overload Monitoring for Resilient Emergency Cellular Networks Using Internet CDR Proxies Bilal Hussain1, Xiao Tang2, Tan Li3, Muhammad Azhar4, Danista Khan1, and Fawad Ahmad1 Affiliation: 1College of Professional and Continuing Education, The Hong Kong Polytechnic University, Hong Kong, China Affiliation: 2School of Information and Communication Engineering, Xi’an Jiaotong University, Xi’an, China Affiliation: 3Department of Computer Science, The Hang Seng University of Hong Kong, Hong Kong, China Affiliation: 4Department of Applied Data Science, Hong Kong Shue Yan University, Hong Kong, China Abstract Disasters can overload cellular control-plane signaling within minutes, yet fine-grained Radio Resource Control (RRC) or Next Generation (NG) Application Protocol (NGAP) telemetry is privacy-sensitive and costly to collect for analytics. Many emergency monitoring pipelines therefore rely on coarse Call Detail Record (CDR) aggregates. We treat Internet activity in CDR grids as a practical proxy for hidden signaling stress under that constraint. We train a lightweight convolutional neural network (CNN) on stylized overload injections, stress-test it with diffusion-synthesized surges that preserve normal traffic structure, and adapt the detector by retraining on hard synthetic samples. Under stress-test conditions, the default alert threshold fails even though receiver operating characteristic (ROC) curves stay strong: the detector still assigns overloaded cells a larger overload probability than normal cells, but those probabilities fall below the default cutoff 0.50.5 and are labeled normal, so the F1-maximizing threshold—selected post hoc on the same stress-test grids (oracle τ∗τ^*)—shifts by 0.32±0.030.32± 0.03 (operating-point drift). Across three random seeds, hard-sample adaptation raises thresholded performance (F1) from 0%0\% (no alerts at the default cutoff 0.50.5 on any seed) to 85.67±14.3785.67± 14.37% and ranking from ROC-AUC 0.886±0.0400.886± 0.040 to 0.99996±0.000070.99996± 0.00007. Diffusion-synthesized surges expose threshold fragility that matched-condition training—training and testing on the same stylized injections—hides, and hard-sample adaptation restores usable alerts at the default cutoff. Together, these steps define a reusable pre-deployment stress test for emergency monitors. Internet-only CDR input further supports lightweight AI-native workflows that combine monitoring, recalibration, and adaptation. Index Terms: Emergency network resilience, AI-native monitoring, disaster-induced traffic overload, cellular signaling overload, diffusion models, threshold calibration I Introduction Earthquakes, floods, evacuations, and mass-casualty incidents can overload control-plane signaling long before user-plane capacity fails [1, 2], degrading cellular service within minutes when coordination matters most. The November 2025 Wang Fuk Court fire in Tai Po, Hong Kong—which killed 168 people, displaced nearly 5,000 residents, and led a subsequent public inquiry to report that territory-wide mobile emergency alerts can take up to one hour to reach users—illustrates why alert and overload monitoring must remain dependable during urban disasters [3]. Emergency operators therefore need rapid, coarse-grained stress indicators so that slicing, traffic steering, aerial backhaul, and priority signaling can activate before collapse [4, 5]. Fine-grained control-plane telemetry (e.g., RRC or NGAP message traces) is privacy-sensitive and costly to collect for security measurement [8], so many analytics pipelines instead use Call Detail Record (CDR) aggregates [9]. Aggregated CDR views support cell-level spatial monitoring [10, 11], but no single CDR channel is a direct measurement of signaling overload. Following our earlier CDR-grid formulation, in which elevated Internet activity approximates a signaling storm [12], we therefore treat Internet CDR activity as an indirect proxy for that hidden control-plane stress when only such coarse aggregates are available. The Milano CDR collection [13] supplies the real cell-level traffic grids on which we learn normal behavior and construct labeled synthetic surges for this study. Fig. 1: Emergency overload monitoring framework. Online (top): 9×99× 9 snapshots scored by a compact CNN and thresholded at fixed τ=0.5τ=0.5. Offline (bottom): diffusion stress testing and hard-sample adaptation; τ∗τ^* is selected offline on stress-test grids and is not the online cutoff. Main detector: Internet-only; ablation: three-channel input. A second challenge is evaluation realism. Detectors trained and tested on the same stylized overload injections can look reliable yet fail under realistic surge shift. Diffusion models can generate harder, structure-preserving traffic samples [14, 15, 7]. We train on stylized Internet-channel surges, stress-test with diffusion-synthesized events, and adapt using difficult synthetic samples. Whereas prior CDR-grid studies often emphasize grid representation or channel-aligned detection [12, 11, 16], this paper emphasizes emergency overload monitoring under distribution shift, explicit threshold-drift analysis, and post-shift adaptation. This work complements our companion IEEE Transactions on Industrial Informatics (TII) paper [17], which evaluates multi-scenario malicious-traffic detection (Short Message Service (SMS), silent-call, Internet, blended) with guided diffusion retraining and fast gradient sign method (FGSM), projected gradient descent (PGD), and conditional tabular generative adversarial network (CTGAN) baselines in a CPS-security setting. Relative to that study and the CDR-grid multiplier construction in [12], this paper adds Internet-only emergency-overload framing, operating-point drift Δτ τ, multi-seed thresholded F1, and calibration-only versus hard-sample adaptation on a lightweight single-channel detector—not a re-run of the TII attack-suite benchmarks. We aim to (i) formulate Internet CDR proxies for signaling-overload monitoring; (i) stress-test fixed-threshold detectors with diffusion-synthesized surges; and (i) quantify recovery through Δτ τ, adaptation, and calibration. Our contributions are: • An emergency-oriented signaling-overload monitoring formulation using Internet CDR proxies. • A diffusion-based stress-test protocol that exposes threshold fragility under realistic distribution shift. • A resilience interpretation based on operating-point drift and post-adaptation recovery, with multi-seed evaluation. • A comparison of internet_only (compact CNN) versus three_channel (ResNet50) input–architecture pairs on this proxy task. • A calibration-versus-adaptation comparison and diffusion realism validation that address matched-condition over-optimism in emergency monitoring evaluation. Relative to next-generation intelligent wireless emergency communications, this study supports network planning and scheduling through operating-point drift analysis and threshold recalibration before overload actions, and contributes a reusable testing platform through the diffusion-based stress-test protocol for evaluating monitors under disaster-like surge shift. Section I reviews related work; Sections I–IV present methods and results; Section V discusses limitations; Section VI concludes. I Related Work Signaling overload and disaster-driven surges. Signaling storms and control-plane overload threaten modern cellular networks when attach, paging, and session-management activity overwhelms core and radio access network (RAN) resources [1, 2, 18]. Emergency surges resemble these patterns even without intentional traffic manipulation [19, 20]. Monitors must remain useful under naturally occurring shift, not only under stylized laboratory conditions. CDR-based cellular analytics. CDR aggregates are widely used for anomaly detection, traffic forecasting, and cell-level network analytics [10, 11, 16], and public corpora such as Milano enable reproducible studies [13]. Prior CDR-grid studies usually monitor the channel that directly reflects the event (SMS flooding in SMS counts, data overload in Internet counts) [12, 11, 16]. In this paper the target event is control-plane signaling stress. Because fine-grained Radio Resource Control (RRC) or NG Application Protocol (NGAP) telemetry is often costly to expose for analytics, Internet activity in CDR aggregates remains a practical observable for cell-level overload monitoring. Relative to those channel-aligned detectors, we evaluate the Internet-proxy monitor under distribution shift, treat operating-point drift (Δτ τ) as a resilience metric, compare adaptation against threshold-only recalibration, and check diffusion-surge realism. Diffusion models for synthetic traffic. Denoising diffusion probabilistic models (DDPMs) [14] and the tabular extension TabDDPM [15] generate realistic low-dimensional traffic samples while preserving aggregate structure; diffusion also supports harder out-of-distribution sample generation [21]. Matched train–test evaluation on stylized surges can overstate deployment reliability [22], so this paper uses diffusion as an emergency-network evaluation platform and threshold-calibration probe rather than only as a data-augmentation tool. Our companion TII work [17] applies the same idea to multi-scenario malicious-traffic robustness in the context of CPS security. I Methodology We study cell-level overload monitoring using CDR aggregates under three evaluation stages: Stage 1 / baseline (matched stylized surges), Stage 2 / stress-test (diffusion-synthesized surges), and Stage 3 / adaptation (retraining on hard synthetic samples), as summarized in Fig. 1. I-A Problem Setting and System Model Each observation is a grid snapshot ∈ℝ9×9×CX ^9× 9× C, where C is the number of CDR channels. The main detector uses internet_only input (C=1C=1) with a compact CNN (three convolution–pooling blocks, 8/16/328/16/32 filters, 256256-unit dense layer, 8181 sigmoids). A three_channel comparison (C=3C=3) uses ResNet50: 9×99× 9 grids are zero-padded by 55 pixels to 19×1919× 19 before the 7×77× 7 stem, then residual stages and an 8181-way sigmoid head. The two settings also change the backbone, so they are input–architecture pairs, not a controlled channel-only ablation. Binary labels ∈0,181y∈\0,1\^81 mark each cell as normal (00) or overload-affected (11); because the Milano CDR corpus provides no overload ground truth, these labels are assigned by the synthetic surge construction in Sec. I-C. The detector outputs cell-wise overload probabilities ^∈[0,1]81 y∈[0,1]^81. Fig. 1 separates an online monitoring path (CDR aggregates to 9×99× 9 grid snapshots, compact CNN scores, thresholding at fixed τ=0.5τ=0.5, and a spatial alert map) from an offline path (diffusion-based stress testing, detector adaptation, and oracle τ∗τ^* on stress-test grids). The lightweight single-channel design targets disaster-response settings where full three-channel processing may be unavailable. I-B Proxy Validity Rationale Fine-grained control-plane telemetry is privacy-sensitive and costly to collect for security measurement [8], so practical analytics often operate on CDR aggregates [9]. Internet activity recorded in CDRs captures data-session bursts that co-occur with control-plane overload during disasters and signaling storms [1, 2, 18], although they do not measure signaling directly. We evaluate whether an Internet-proxy monitor still assigns higher overload probabilities to overloaded cells than to normal cells under shift and whether recalibration or adaptation restores usable alerts—without claiming one-to-one equivalence to RRC load without paired signaling traces. I-C Dataset Scope, Grid Construction, and Baseline Surges We evaluate on the public Milano CDR corpus (2013–2014) [13], which reflects 3G/4G-era metropolitan traffic rather than a 5G standalone core capture. We do not claim that decade-old traffic statistics match modern 5G loads; rather, coarse per-cell service aggregates remain a generation-agnostic observability layer for operator-side monitoring [16], and disaster-driven signaling overload remains relevant in contemporary 5G/Open Radio Access Network (O-RAN) deployments [1, 2]. Aziz and Bestak [16] argue that although individual CDR fields evolve across radio-access generations, the core record format and service-count semantics remain comparable, so CDR-based analytics can extend forward without redesigning the monitoring representation. Following [12, 17], Milano is retained as a reproducibility benchmark so that diffusion stress testing and operating-point drift analysis are isolated from dataset changes; the empirical question is whether fixed-threshold monitors fail under realistic surge shift on the CDR aggregate manifold and whether adaptation restores usable alerts. To our knowledge, no public labeled per-cell cellular overload CDR corpus offers a drop-in replacement, so we learn normal traffic from real CDR, synthesize labeled surge grids, and stress-test monitors under distribution shift, consistent with established CDR-grid practice [11, 12]. Grid construction follows the CDR-grid preprocessing pipeline in [12] and our companion IEEE TII diffusion study [17]; snapshot counts, temporal window, and train/test splits match Table I. TABLE I: Experimental setup for the emergency overload study. Item Value Dataset Telecom Italia Big Data Challenge [13] Scenario Internet activity as signaling-overload proxy Grid, cells 9×99× 9, 81 Window, slots 11:00–14:00, 18 per day Days or files 62 Normal train, test 614, 167 Stress train, test 167, 168 Overload-affected cells 40 To obtain labeled baseline overload grids, we select a fixed overload-affected cell subset C (||=40|C|=40) and scale only the Internet activity of those cells by a constant multiplier α: Xk,Internet←αXk,Internet,k∈,X_k,Internet←α X_k,Internet, k , (1) where the left arrow denotes in-place replacement of the original Internet count in cell k, and α=43.3α=43.3 follows the Internet-signaling emulation derived in the appendix of [12]. We set yk=1y_k=1 for k∈k and yk=0y_k=0 otherwise, so overload is defined operationally by this synthesized Internet surge, not by measured RRC. Normal grids are unperturbed Milano snapshots (Table I). This stylized surge is strongly separated from normal Internet aggregates (≈59σ≈59σ), making matched-condition training diagnostically easy. Training uses weighted multilabel binary cross-entropy on the backbone assigned to each input mode in Sec. I-A. I-D Diffusion Stress-Test Generator To move beyond stylized surges, the Diffusion-Based Stress Test block in Fig. 1 fits a tabular diffusion model on normal 3D CDR aggregates 0=[xSMS,xCall,xInternet]∈ℝ3x_0=[x_SMS,x_Call,x_Internet] ^3. Following DDPM [14], the forward noising process is q(t∣0)=(α¯t0,(1−α¯t)),q(x_t _0)=N\! ( α_tx_0,\,(1- α_t)I ), (2) where t is the diffusion step and α¯t α_t is the cumulative noise-schedule coefficient. A denoiser ϵψ _ψ is trained with the standard noise-prediction objective ℒDDPM=0,t,ϵ[‖ϵ−ϵψ(t,t)‖22],L_DDPM=E_x_0,t,ε [ \|ε- _ψ(x_t,t) \|_2^2 ], (3) with t=α¯t0+1−α¯tϵx_t= α_tx_0+ 1- α_t\,ε and ϵ∼(,)ε (0,I). At sampling time, the learned reverse process generates realistic aggregate rows on the normal CDR manifold. Tabular design choices follow TabDDPM [15]; CDR-specific instantiation details are deferred to [17]. Synthetic surge rows are drawn from the learned normal sampler and perturbed only on Internet activity by a milder random multiplier γ: xInternet←γxInternet,γ drawn uniformly from [2.0,5.0],x_Internet←γ x_Internet, γ drawn uniformly from [2.0,5.0], (4) then mapped back into C on a background grid. Relative to the fixed baseline multiplier α=43.3α=43.3 (≈59σ≈59σ), these milder Internet shifts (≈3.6σ≈3.6σ) are used as near-manifold emergency-like stress tests (Sec. IV-B), not as paired disaster traces. This procedure is used only during stress-test evaluation. I-E Adaptation with Hard Synthetic Samples Adaptation corresponds to the Detector Adaptation block in Fig. 1 and applies a lightweight variant of the guided retraining procedure in [17]: the diffusion sampler generates candidate surge events, and detector feedback steers sampling toward hard yet overload-like examples. Those hard samples are added to the training set, and the detector is fine-tuned for a small number of epochs to stabilize monitoring under shifted conditions [6]. I-F Threshold and Resilience Metrics Because realistic surges can shift score distributions [23], overload probabilities on affected cells may remain higher than on normal cells, yielding a high area under the receiver operating characteristic curve (ROC-AUC), yet still fall below a fixed cutoff such as τ=0.5τ=0.5. Every cell is then labeled normal and F1—the harmonic mean of precision and recall on micro-averaged cell decisions—collapses at the Thresholding stage in Fig. 1. We therefore report both ROC-AUC and threshold-dependent F1 after sweeping τ∈0.05,0.10,…,0.95τ∈\0.05,0.10,…,0.95\. As a diagnostic for fixed-threshold emergency deployment, we additionally define the operating-point drift magnitude Δτ=|τdefault−τF1max|, τ= | _default- _F1max |, (5) where τdefault=0.5 _default=0.5 is the online cutoff and τF1max _F1max (also denoted τ∗τ^*) is the F1-maximizing threshold on a given evaluation set. Reported τ∗τ^* and Δτ τ are oracle (post-hoc) values on those grids, not independently validated operating points. When reporting multi-seed results we use the mean ± std of per-seed τ∗τ^* values. Large Δτ τ indicates that the default alert rule has become fragile under surge shift. I-G Evaluation Protocol The protocol contains three stages: (i) Stage 1 (baseline evaluation) on matched stylized surges along the online detector path in Fig. 1; (i) Stage 2 (stress-test evaluation) on diffusion-synthesized surge events (Diffusion-Based Stress Test); and (i) Stage 3 (adaptation evaluation) after retraining on hard synthetic samples (Detector Adaptation). Multi-seed runs vary initialization, shuffling, and overload-affected cell selection. For the calibration-only baseline, we keep the baseline-trained detector fixed and select τF1max _F1max by sweeping τ on the same stress-test grids used for reporting (oracle; no held-out calibration split and no weight updates). All reported metrics use this multi-seed configuration: seeds 11–33 (a workshop-scale budget, not a safety-certification sample); detector training for 2424 epochs; TabDDPM with T=300T=300 and 3030 training epochs; and guided hard-sample retraining for 22 rounds with 6464 samples/round and 1212 fine-tuning epochs/round. IV Results Unless noted otherwise, results average three seeds. Snapshot counts and splits follow Table I. IV-A Baseline and Stress-Test Behavior Under baseline conditions, internet_only reaches 99.94±0.0599.94± 0.05% F1 (Table I, Fig. 2), so the lightweight single-channel detector looks near-perfect when train and test surges match. Operationally, a lightweight monitor would pass validation if checked only under matched laboratory-style surges. The three-channel pair stays much weaker (49.21±10.3649.21± 10.36%): the stylized surge scales only Internet activity, so SMS and call channels remain near-normal distractors and dilute the proxy signature even under matched conditions. TABLE I: Multi-seed summary across Stage 1–3 evaluation (baseline, stress-test, and adaptation). Abbrev.: Eval., evaluation. Mode Eval. Runs F1 Mean ± Std (%) ROC-AUC Mean ± Std internet_only Baseline 3 99.94 ± 0.05 −a-^\,a internet_only Stress-test 3 0.00 ± 0.00 0.886 ± 0.040 internet_only Adaptation 3 85.67 ± 14.37 0.99996 ± 0.00007 three_channel Baseline 3 49.21 ± 10.36 −a-^\,a three_channel Stress-test 3 0.00 ± 0.00 0.264 ± 0.033 three_channel Adaptation 3 66.80 ± 0.00b^\,b 0.964 ± 0.059 a Baseline ROC-AUC ≈ 1.0; omitted as uninformative. b Mixed-set F1; stress-only F1 is 100% (Section IV-D). Fig. 2: Multi-seed F1 by evaluation stage (Stage 1: baseline; Stage 2: stress-test; Stage 3: adaptation). Error bars show one standard deviation across three runs. The stress-test stage tells a different story. At τ=0.5τ=0.5, internet_only F1 collapses to 0.00±0.000.00± 0.00%, yet ROC-AUC remains 0.886±0.0400.886± 0.040 (Table I). The mean oracle F1-maximizing threshold τ∗τ^* shifts to 0.18±0.030.18± 0.03 (Fig. 3, left panel, Stage 2), giving Δτ=0.32±0.03 τ=0.32± 0.03. An apparently failed monitor can still assign higher overload probabilities to overloaded cells than to normal cells while needing immediate threshold recalibration; fixed τ=0.5τ=0.5 rules risk false negatives during disaster surges even when the model stays informative. The three_channel pair degrades further under stress-test conditions (ROC-AUC 0.264±0.0330.264± 0.033), with Δτ=0.45 τ=0.45. That larger drift signals broader score miscalibration and higher false-alarm risk if deployed without careful calibration during emergency response. IV-B Diffusion Sample Realism Table I compares Internet-proxy surges from our lightweight TabDDPM checkpoint (T=300T=300, 3030 training epochs). We extract one 3D aggregate vector per stress-test grid (mean over ||=40|C|=40 overload-affected cells) and compare it against 5,0005,000 normal cell-level references using target-channel mean |z||z| and radial basis function (RBF) maximum mean discrepancy (MMD)2, following [17]. TabDDPM stress samples deviate by 3.61σ3.61σ (joint MMD2=0.877^2=0.877), whereas the α=43.3α=43.3 multiplier deviates by 58.76σ58.76σ, explaining matched-condition over-optimism [22]. As a coarse spatial check, Internet-channel patterns on stress-test grids remain weakly correlated with the mean normal spatial template (0.219±0.1460.219± 0.146 for TabDDPM vs. 0.248±0.1170.248± 0.117 for multipliers); fine-grained spatial realism remains future work. TABLE I: Realism of Internet-proxy surge construction (168 stress-test grids; TabDDPM, T=300T=300). Surge source |z||z| MMDI2^2_I MMD3D2^2_3D TabDDPM + γ∈[2,5]γ∈[2,5] 3.61 0.874 0.877 Multiplier (α=43.3α=43.3) 58.76 0.603 0.602 TabDDPM raw (5k5k draws) — — 0.509 Recomputed on the pipeline checkpoint used in this study; |z||z| on Internet; MMDI2^2_I on Internet; MMD3D2^2_3D on joint 3D aggregates. IV-C Input Representation Comparison Table IV summarizes the input–architecture comparison. The compact-CNN internet_only pair dominates every stress-relevant metric: higher stress-test AUC (0.8860.886 vs. 0.2640.264), higher post-adaptation F1 (85.6785.67 vs. 66.8066.80), and smaller stress-test drift (Δτ=0.317 τ=0.317 vs. 0.4500.450); stress-test F1 is 0.000.00 for both modes at τ=0.5τ=0.5. Because backbone and channels change together, we do not isolate a pure channel effect. Fig. 3 shows F1 versus τ (predict overload if score ≥τ≥τ; left: internet_only; right: three_channel): Internet-only recovers a wider usable threshold band after adaptation, whereas three-channel stays brittle at low τ under stress-test. Dotted τ∗τ^* lines are multi-seed means of per-seed oracle F1-maxima, not necessarily the peak of the plotted single-run curve. TABLE IV: Input–architecture comparison and operating-point drift. Abbrev.: St.-test, stress-test; Adapt., adaptation; AUC, area under the curve. Mode St.-test AUC Adapt. F1 Adapt. AUC Δτ τ (St., Ad.) internet_only 0.886 85.67 0.99996 0.317, 0.167 three_channel 0.264 66.80 0.96421 0.450, 0.167 Stress-test F1 is 0.000.00 for both modes at τ=0.5τ=0.5 (Table I). Δτ τ uses oracle τ∗τ^* on evaluation grids. Modes differ in both input and backbone (compact CNN vs. ResNet50). Fig. 3: Threshold sweep under the Internet overload-proxy scenario (left: internet_only; right: three_channel). Curves show representative single-run F1–τ sweeps; dotted lines (annotated) mark the multi-seed mean of per-seed oracle F1-maximizing thresholds τ∗τ^* for Stage 2 and Stage 3. When only coarse CDR summaries can run locally, monitoring the Internet channel alone reduces compute load while yielding clearer overload signatures for this proxy task. IV-D Recovery After Adaptation After adaptation, internet_only recovers to 85.67±14.3785.67± 14.37% F1 and 0.99996±0.000070.99996± 0.00007 ROC-AUC. The F1 standard deviation is large for a safety-critical claim: ranking is near-perfect, but thresholded F1 varies across three seeds, so τ=0.5τ=0.5 F1 is not a certified operating point. Oracle τ∗τ^* moves to 0.33±0.060.33± 0.06 (Δτ=0.17 τ=0.17; Table IV; Fig. 3, Stage 3). Fig. 4 shows that adaptation restores strong separability and narrows the gap between ranking and decision quality. For emergency workflows, this supports a two-step response: detect drift under stress-test conditions, then retrain or recalibrate before the next incident window. Fig. 4: ROC curves before and after adaptation for internet_only (representative single-run curves). Multi-seed mean AUC values appear in Table I. The three-channel model attains 100% F1 on stress-only samples after adaptation but only 66.80±0.0066.80± 0.00% on the mixed normal-plus-stress set. During emergency response, that specificity failure can trigger unnecessary rerouting or priority-service actions over large urban areas. Under this protocol, the compact Internet-only CNN is the stronger of the two input–architecture pairs. IV-E Calibration-Only Baseline vs. Adaptation Table V compares recovery strategies under stress-test shift. Threshold-only recalibration (τF1max _F1max, no retraining) raises F1 from 0.00±0.000.00± 0.00% to 67.07±5.4867.07± 5.48%, while hard-sample adaptation reaches 85.67±14.3785.67± 14.37% at τ=0.5τ=0.5 and 98.95±1.1998.95± 1.19% with post-adaptation τF1max _F1max. Adaptation improves both ranking (AUC →0.99996→ 0.99996) and thresholded performance beyond calibration alone. TABLE V: Calibration-only baseline vs. hard-sample adaptation on stress-test grids (internet_only, three seeds). Strategy τ F1 (%) AUC Fixed threshold 0.5 0.00± 0.00 0.886± 0.04 Threshold only τ∗τ^* 67.07± 5.48 0.886± 0.04 Adaptation 0.5 85.67± 14.37 0.99996± 0.00007 Adapt. + threshold τ∗τ^* 98.95± 1.19 0.99996± 0.00007 τ∗τ^*: oracle F1-maximizing threshold on the same stress-test grids used for reporting; no retraining for rows 1–2. IV-F Spatial Consistency Fig. 5 shows cell-level monitoring quality. Before adaptation, accuracy is spatially uneven: some cells classify easily while others fail under threshold mismatch. After adaptation, the heatmap becomes more uniform across the 9×99× 9 grid. Spatial uniformity matters because overload actions—local offload, temporary aerial coverage, or selective service restriction—should not depend on a handful of easy cells. Fig. 5: Per-cell accuracy heatmaps under diffusion-synthesized surges before (left) and after (right) adaptation. V Discussion and Limitations We found that baseline evaluation alone overstates emergency monitoring reliability. Diffusion-synthesized surges expose hidden threshold fragility while preserving useful ranking quality; adaptation largely restores usable alerts at τ=0.5τ=0.5, with remaining seed variance. Practical relevance. Operating-point drift and calibration-versus-adaptation inform network planning and scheduling by showing when fixed alert rules must be recalibrated before overload actions. The diffusion protocol is a reusable testing platform under disaster-like surge shift. Limitations and Future work. Internet CDR is an indirect proxy with no paired RRC/NGAP trace. Labels and surges are synthetic on one Milano window; three seeds leave post-adaptation F1 std. 14.37%14.37\%, so this is not a certified alert rule. Reported τ∗τ^* and Δτ τ are oracle values on evaluation grids. The internet_only versus three_channel comparison confounds channels with compact CNN versus ResNet50. Spatial realism is coarse (z-score/MMD2, correlation). Disaster-period traces, a held-out calibration split, same-backbone ablations, cross-city transfer, and online recalibration remain future work. VI Conclusion Fixed-threshold monitoring can fail under realistic surge shift even when ranking quality stays strong; guided adaptation can restore usable cell-level alerts from coarse Internet CDR proxies at τ=0.5τ=0.5, subject to the oracle-τ∗τ^* and seed-variance caveats above. Relative to our companion IEEE TII work on multi-scenario malicious-traffic robustness in a CPS-security setting, this paper contributes a focused emergency-monitoring view centered on threshold drift, multi-seed behavior, and lightweight single-channel evaluation. References [1] M. Q. Khan, F. Malik, F. Alturise, and N. Rahman, “Modeling and comprehensive review of signaling storms in 3GPP-based mobile broadband networks: Causes, solutions, and countermeasures,” Comput. Model. Eng. Sci., vol. 142, no. 1, p. 123–153, 2025, doi: 10.32604/cmes.2024.057272. [2] D. K. Nguyen, R. El Malki, and F. Rebecchi, “RRC signaling storm detection in O-RAN,” in Proc. IEEE Int. Symp. Comput. Commun. (ISCC), Jul. 2025, p. 1–7, doi: 10.1109/ISCC65549.2025.11326128. [3] B. Wong and J. Ma, “Hong Kong fire services declined Tai Po alert over confusion fears, inquiry hears,” South China Morning Post, Apr. 23, 2026. [Online]. Available: https://w.scmp.com/news/hong-kong/society/article/3351135/hong-kong-fire-services-declined-tai-po-alert-over-confusion-fears-inquiry-hears [4] W. Saad et al., “Artificial General Intelligence (AGI)-Native Wireless Systems: A Journey Beyond 6G,” Proc. IEEE, vol. 113, no. 9, p. 849–887, Sep. 2025, doi: 10.1109/JPROC.2025.3526887. [5] Y. Zhang, Z. Yao, W. Cheng, and W. Saad, “MA-HEAD-Net: Adaptive rule-guided multi-agent DRL for AoI minimization in UAV-assisted emergency networks,” IEEE Trans. Cogn. Commun. Netw., vol. 12, p. 9962–9978, 2026, doi: 10.1109/TCCN.2026.3711100. [6] Y. Xiao, Q. Du, Y. Zhang, and C. Lu, “Secure vehicular communications with varying QoS and environments: A unified cross-layer policy-adaptation approach,” IEEE Trans. Intell. Transp. Syst., vol. 24, no. 11, p. 13462–13471, Nov. 2023, doi: 10.1109/TITS.2023.3283259. [7] K. Zhang et al., “Semantic successive refinement: A generative AI-aided semantic communication framework,” IEEE Trans. Cogn. Commun. Netw., vol. 11, no. 2, p. 687–699, Apr. 2025, doi: 10.1109/TCCN.2025.3526839. [8] L. He, Z. Yan, and M. Atiquzzaman, “LTE/LTE-A network security data collection and analysis for security measurement: A survey,” IEEE Access, vol. 6, p. 4220–4242, 2018, doi: 10.1109/ACCESS.2018.2792534. [9] M. S. Parwez, D. B. Rawat, and M. Garuba, “Big data analytics for user-activity analysis and user-anomaly detection in mobile wireless network,” IEEE Trans. Ind. Informat., vol. 13, no. 4, p. 2058–2065, Aug. 2017, doi: 10.1109/TII.2017.2650206. [10] D. Naboulsi, M. Fiore, S. Ribot, and R. Stanica, “Large-scale mobile traffic analysis: A survey,” IEEE Commun. Surveys Tuts., vol. 18, no. 1, p. 124–161, 2016, doi: 10.1109/COMST.2015.2491361. [11] K. Sultan, H. Ali, and Z. Zhang, “Call detail records driven anomaly detection and traffic prediction in mobile cellular networks,” IEEE Access, vol. 6, p. 41728–41737, 2018, doi: 10.1109/ACCESS.2018.2859756. [12] B. Hussain, Q. Du, B. Sun, and Z. Han, “Deep learning-based DDoS-attack detection for cyber-physical system over 5G network,” IEEE Trans. Ind. Informat., vol. 17, no. 2, p. 860–870, Feb. 2021, doi: 10.1109/TII.2020.2974520. [13] G. Barlacchi et al., “A multi-source dataset of urban life in the city of Milan and the Province of Trentino,” Sci. Data, vol. 2, 2015, Art. no. 150055, doi: 10.1038/sdata.2015.55. [14] J. Ho, A. N. Jain, and P. Abbeel, “Denoising diffusion probabilistic models,” in Proc. Adv. Neural Inf. Process. Syst. (NeurIPS), vol. 33, 2020, p. 6840–6851. [15] A. Kotelnikov, D. Baranchuk, I. Rubachev, and A. Babenko, “TabDDPM: Modelling tabular data with diffusion models,” in Proc. Int. Conf. Mach. Learn. (ICML), vol. 202, 2023, p. 17564–17579. [16] Z. Aziz and R. Bestak, “Modeling voice traffic patterns for anomaly detection and prediction in cellular networks based on CDR data,” IEEE Trans. Mobile Comput., vol. 23, no. 12, p. 13131–13143, Dec. 2024, doi: 10.1109/TMC.2024.3430032. [17] B. Hussain, X. Tang, Q. Du, T. Li, M. Azhar, and D. Khan, “Diff-DDoS: Realistic cyber-physical attack synthesis and robust detection for 5G-enabled CPS using tabular diffusion models,” IEEE Trans. Ind. Informat., early access, Sep. 2026, doi: 10.1109/TII.2026.3725775. [18] S. Park, B. Cho, D. Kim, and I. You, “Machine learning based signaling DDoS detection system for 5G stand alone core network,” Appl. Sci., vol. 12, no. 23, Dec. 2022, Art. no. 12456, doi: 10.3390/app122312456. [19] M. T. Cazzolato et al., “TgrApp: Anomaly detection and visualization of large-scale call graphs,” in Proc. AAAI Conf. Artif. Intell., vol. 37, no. 13, 2023, p. 16410–16412, doi: 10.1609/aaai.v37i13.27062. [20] A. Lakhina, M. Crovella, and C. Diot, “Diagnosing network-wide traffic anomalies,” in Proc. ACM SIGCOMM Conf., 2004, p. 219–230, doi: 10.1145/1015467.1015492. [21] W. Nie et al., “Diffusion models for adversarial purification,” in Proc. Int. Conf. Mach. Learn. (ICML), vol. 162, 2022, p. 16805–16827. [22] D. Arp et al., “Dos and don’ts of machine learning in computer security,” in Proc. USENIX Security Symp., 2022, p. 3971–3988. [23] C. Guo, G. Pleiss, Y. Sun, and K. Q. Weinberger, “On calibration of modern neural networks,” in Proc. Int. Conf. Mach. Learn. (ICML), vol. 70, 2017, p. 1321–1330.