A Privacy-Conscious and Explainable IDS-Oriented Triage and Response Pipeline for Mobile Network Infrastructure Using Aggregated Cellular Traffic Signatures

Mobile-network operators must interpret spatial anomalies in aggregated cell-level telemetry and decide whether, where, and how to respond. This paper presents a privacy-conscious, intrusion detection system (IDS)-oriented triage and response architecture that consumes cell-level anomaly signatures and couples spatial reconstruction, short-horizon forecasting, origin inference, self-resolution and remaining-time estimation, adaptive gating, ETA-aware team selection, conservative redeployment, explanation, and audit logging. It is a downstream spatial-attribution and response-orchestration layer, not a packet- or flow-level attack detector. The evaluated configuration uses transparent deterministic, heuristic, and optimization-based procedures and synthetic aggregated signatures without subscriber identifiers; aggregation is treated as data minimization, not a formal privacy guarantee. Across 20 paired synthetic scenarios, the full policy reduced conditional mean response time from 37.58 to 22.86 min, total travel from 576.0 to 273.5 min, and coverage ETA from 32.28 to 26.76 min, while on-time service increased from 54.0% to 60.0%. These benefits were accompanied by lower persistent-incident coverage (91.1% to 72.1%) and a higher miss rate (8.9% to 27.9%). The inverse-origin configuration showed no repeated localization-error advantage, and conservative redeployment had only a marginal average effect. The results therefore demonstrate a configurable downstream triage trade-off under controlled synthetic conditions, not attack-classification accuracy, adversarial robustness, formal privacy, or deployment readiness.