The plots appear to be made with stft(). The SNR appears to be lower in the second plot. The vertical axis label is "Normalized Amplitude". Did you normalize before you computed the STFT, or after? Did you normalize by the standard deviation, by the mean value, by the maxmum value, or some other way? I am asking these questions because it could affect how you determine the detector threshold.
The "best" threshold depends on the statistical properties of the signal, such as noise amplitude. I recommend not normalizing, so that the signal stays in its raw form while you are estimating the noise amplitude or other signal properties.
A simple approach is to compute the mean amplitude over the entire STFT surface, in case 1 and case 2. Set the alarm threshold to a constant times the mean amplitude. Determine the constant by experimentation and simulation, in order to acheive the desired tradeoff between type I error (false alarms) and type II errors (failures to detect real threats).
A drawback of the approach above is that it includes the events, the non-random pulses, when estimating the noise. It would be better not to include the events. It appears that there are two events in each surfaces - i.e. two brief times in each surface when there is a burst of power. The signal is mostly noise, most of the time. Estimate the noise by avoiding the times when there is an event. In this example, it appears that you can do this by discarding the time slices whose mean amplitude is above the median ampltude of all the time slices for that surface. The mean amplitude within the remaining slices is your estimate of the noise amplitude. As before, set the threshold to a constant value times this estimated noise amplitude. Determine the optimal value of the constant by experimentation, simulation, and analysis of the costs of type I and type II errors.
