Pith. sign in

REVIEW 3 major objections 5 minor 71 references

Disentangling Multi-View Scanning in Mamba for Network Traffic Anomaly Detection

T0 review · 3 major / 5 minor · reviewed 2026-08-01 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read This paper claims that naive multi-view Mamba scanning for network traffic anomaly detection suffers from 'redundancy accumulation'—views capture mostly the same information that naive fusion amplifies—and that a disentangle-then-fuse desig

desk verdict The architecture is solid and the empirical gains look real, but the paper's headline diagnosis of redundancy accumulation is not actually established by the CKA evidence it offers. read the letter →

arxiv 2607.22829 v1 pith:QJ2KVZFO submitted 2026-07-24 cs.AI

Xinglin Lian , Chengtai Cao , Ting Zhong , Fan Zhou This is my paper
classification cs.AI
keywords NetworkTrafficAnomalyDetectionMambaMulti-ViewScanningRedundancyAccumulationDisentangledRepresentationLearningStateSpaceModelsZero-PositiveTraining
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Network traffic anomaly detection must spot subtle malicious flows in encrypted payloads, and Mamba's linear-time scanning makes it a promising backbone. But when Mamba uses multiple scanning views, this paper claims, the views encode largely the same information; naive summation or concatenation amplifies that shared information and drowns out view-specific cues, so multi-view Mamba can underperform single-view Mamba. The paper proposes DisenMamba, which first disentangles each view into shared (view-invariant) and private (view-specific) components, then fuses them separately—shared branches are summed, private branches are concatenated under a low-rank bottleneck with a stop-gradient and a cross-covariance penalty. On CIC-IoT2023, DoHBrw2020, and ISCX-Tor2016, DisenMamba outperforms eleven baselines, including other Mamba and Transformer methods, with millisecond-level inference. The paper's contribution is reframing multi-view Mamba fusion as an explicit disentanglement problem.

What carries the argument

The named machinery is the Disentangled Multi-View Scanning (DMVS) module paired with Multi-View Fusion (MVF). DMVS scans each traffic flow along four views (forward/backward flow-level and packet-level), then projects each view through a shared projection to capture view-invariant content and through a private low-rank projection on the stop-grad residual to capture view-specific content. MVF sums the shared branches and concatenates the private branches through a projection. The cross-covariance loss plus the stop-gradient and low-rank bottleneck enforce that private branches do not re-encode shared information. These lightweight projections add negligible inference cost over a standard Ma

What would settle it

Measure CKA between views and fusion on a deliberately complementary multi-view model—for instance, four independent encoders each fed genuinely different modalities of the same flow, which we know should have high view-specific content. If high CKA can coexist with strong anomaly-detection performance, the paper's CKA-based evidence for harmful redundancy is not uniquely supported. Conversely, if such a complementary model shows low CKA and high performance, the diagnosis is corroborated.

Watch

Extended reading notes

Core claim

The central discovery is a mechanism-level failure mode: in multi-view Mamba scanning for NTAD, each branch's selective scan converges on view-invariant patterns, and the standard summation/concatenation fusion repeatedly re-adds those invariant components, inflating their dominance until the fused representation is homogenized and view-specific signals are suppressed—the 'multi-view degradation problem.' The paper argues that because all views are reorderings of the same traffic sample, this redundancy is structural, not incidental. DisenMamba counteracts it by decomposing each view into a shared branch (parameter-shared projection) and a private branch (residual after removing shared, low-

Load-bearing premise

The paper's motivation rests on the claim that high CKA similarity between a view and the fused representation proves harmful redundancy accumulation; if such similarity is a benign consequence of all views being deterministic reorderings of the same input, the diagnostic story weakens, even though the final model still works.

Editorial extensions

If this is right

  • The multi-view degradation problem explains previously reported cases where multi-view Mamba underperforms unidirectional Mamba on network traffic; it is a fusion design flaw, not a fundamental limit of Mamba for NTAD.
  • Adopting disentangle-then-fuse makes multi-view Mamba preferable to unidirectional Mamba for NTAD, restoring complementary contextual modeling without sacrificing linear-time inference.
  • Component-wise ablations (removing shared, private, low-rank, stop-grad, or loss) each degrade AUC, demonstrating that both view-invariant and view-specific information are needed and the constraints are load-bearing.
  • The method reaches state-of-the-art AUC on CIC-IoT2023 (86.81), DoHBrw2020 (87.34), and ISCX-Tor2016 (96.40) under zero-positive training, suggesting the paradigm transfers across IoT, DoH, and Tor traffic.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The redundancy-accumulation diagnosis is likely not specific to network traffic: any Mamba application that builds multiple views by reordering the same input sequence could exhibit the same dominant-invariant amplification, so the disentangle-then-fuse recipe is a candidate generic patch for vision and time-series Mamba models—a testable extension beyond NTAD.
  • The CKA evidence is open to an alternative reading: since all four views are deterministic reorderings of one sample, high view–fusion similarity may be a benign artifact of shared input statistics rather than proof of harmful redundancy. A cleaner test would compare DisenMamba against a control that diversifies views through random input perturbations or independent feature channels; if the contr
  • An even simpler intervention—per-view normalization or gating before summation—might recover part of the gain; comparing DisenMamba against such lightweight baselines would isolate exactly how much of the improvement comes from the disentanglement constraints and how much from simply preventing scale dominance.
  • Because the paper trains only on normal flows and scores by reconstruction (cosine) error, disentanglement might be acting mainly on the reconstruction bias: separating shared/private content can change which normal patterns the autoencoder commits to memory. That hypothesis could be tested by analyzing reconstruction error distributions per branch on a third dataset with known anomaly families.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The paper identifies a 'redundancy accumulation' problem in multi-view Mamba scanning for network traffic anomaly detection (NTAD), in which distinct scanning branches encode largely view-invariant information that naive summation/concatenation fusion amplifies while diluting view-specific cues. It proposes DisenMamba, an autoencoder-based framework that disentangles each view into shared (view-invariant) and private (view-specific) branches before fusion, using parameter-shared projections, stop-gradient residual extraction, low-rank private projections, and a cross-covariance loss. Experiments on CIC-IoT2023, DoHBrw2020, and ISCX-Tor2016 report state-of-the-art AUC/ACC/F1 with millisecond-level inference latency.

Significance. If the mechanism-level claim were established, DisenMamba would be a useful and timely architectural contribution for efficient NTAD: it addresses a plausible weakness of multi-view Mamba and offers a lightweight, well-motivated fix. The paper ships code, uses three public datasets, and includes a reasonably broad ablation suite. The final AUC gains (about 3.1–3.9 points over the best baseline on the two hardest datasets, and about 2 points on Tor2016) are nontrivial if reproducible. However, the central diagnostic in Section 2.2 is not currently valid, and the evaluation has correctable but important methodological gaps: test-set threshold selection for ACC/F1 and no uncertainty quantification. The architectural contribution may survive those corrections, but the paper's main conceptual claim needs to be substantially reframed or supported by a proper control.

major comments (3)
  1. [Section 2.2, Eq. (1), Fig. 2] The observed CKA signature is not diagnostic of redundancy accumulation. For any two partially correlated view features, the inequality CKA(View_i, Fusion) > CKA(View_1, View_2) is mathematically expected for summation/concatenation fusion, even when private information is fully preserved. Concretely, if H2 = H1 + epsilon*P with P orthogonal to H1 and H = H1 + H2, then CKA(H1,H) = 4/(4+epsilon^2) > CKA(H1,H2) = 1/(1+epsilon^2) for every epsilon > 0. Thus the paper's claim that 'if cross-view specific information were incorporated, fused similarity would decrease' is false for the very fusion rules under study. As written, Fig. 2 cannot support the existence of 'redundancy accumulation' or 'multi-view degradation'. A control baseline with synthetic views of known shared/private composition, or a null distribution of CKA values, is required before this phenomenon is asserted.
  2. [Section 4.1, Table 1, Table 2] ACC and F1 are computed with the anomaly-score threshold selected on the test set ('We determine the anomaly-score threshold by maximizing the F1-score'), which makes these metrics optimistically biased. Since thresholds are fit to test labels, the ACC/F1 columns cannot be used for model comparison as reported. The authors should report only AUC for test evaluation, or select thresholds on a held-out validation split and then evaluate on the test set. In addition, although five runs are performed, no standard deviations, confidence intervals, or significance tests are reported. Several gaps are small (e.g., Table 2: w/o Stop-Gradient 87.01 vs DisenMamba 87.34 on DoHBrw2020; w/o Shared Branches 95.79 vs 96.40 on Tor2016), so the robustness of the conclusions is unclear.
  3. [Section 3.2.3, Eqs. (5)-(8), Fig. 7, Appendix D] The CKA-based evidence of disentanglement is partly circular. In Eq. (5), the private branch is defined as the residual after subtracting a stop-gradient shared projection; Eq. (7) explicitly minimizes CrossCov(shared, private). Low shared-private CKA in Fig. 7 and Fig. 11 is therefore enforced by construction and by the loss, not independent evidence that the components correspond to view-invariant and view-specific semantics. The paper should provide an independent test of semantic separation, e.g., synthetic data with known generative factors, or intervention experiments showing that private features can be selectively corrupted to affect only view-specific behavior. Without such a test, the architecture may be imposing orthogonality without delivering the claimed disentanglement.
minor comments (5)
  1. [Section 3.3.1 and Algorithm 1] Algorithm 1 line 24 computes a batch-level cosine loss, while Eq. (10) sums per-sample losses. Please align the notation and clarify whether the loss is a mean or a sum; the relative weighting of L_REC and L_DIS depends on this.
  2. [Figure 3] The t-SNE visualizations are qualitative. The claim that inter-view distributions are 'highly symmetric' should be supported by a quantitative inter-view metric, not only by visual inspection.
  3. [Figure 7 and Figure 11] CKA density plots are shown without error bars or the number of batches/layers used; please specify the exact computation setup and add error bars across runs.
  4. [Section 5.2] The discussion of prior vision work [16,37,46] states that representation redundancy induced by multi-view scanning has been reported; please cite the specific findings and explain how they relate to the proposed 'redundancy accumulation' concept.
  5. [Section 2.2] The CKA formula in Eq. (1) uses Frobenius norms of cross-covariance matrices; the decentralized notation is not fully defined. Please state explicitly that H_hat_i are centered feature matrices and clarify the exact centering used.

Circularity Check

1 steps flagged · score 5.0 of 10

Central 'redundancy accumulation' diagnostic is forced by CKA arithmetic of the fusion operator; held-out performance evaluations remain independent.

  1. self definitional [Section 2.2, Eq. (1), Fig. 2 (parenthetical claim following Fig. 2)]
    "As evidenced in Figure 2, the fused representations exhibit substantially higher similarities to individual views (View1–Fusion and View2–Fusion) than the original inter-view similarity (View1–View2). This observation indicates that fusion introduces little genuinely view-specific information; instead, dominant invariant components are further amplified (if cross-view specific information were incorporated, fused similarity would decrease)."

    For the fusion rules studied (summation/concatenation), the reported inequality is a mathematical consequence of CKA applied to any two partially overlapping views, not an empirical sign of harmful redundancy. If H2 = H1 + εP with P⊥H1, summation fusion gives H = H1 + H2 = 2H1 + εP, so linear CKA(H1,H) = 4/(4+ε²) > CKA(H1,H2) = 1/(1+ε²) for every ε > 0, even though the private signal P is fully preserved in the fusion; concatenation behaves similarly. Thus the paper's 'multi-view degradation problem' is defined by a CKA signature that is entailed by the fusion operator, making the discovery self-definitional: any two correlated views fused by sum/concat would show the same pattern whether or not view-specific information is diluted.

full rationale

No load-bearing self-citation was found. The definitive performance experiments are self-contained against held-out test sets and eleven baselines, so the SOTA claim is not circular. However, the paper's central motivational diagnosis, 'redundancy accumulation', rests on Fig. 2's claim that CKA(View_i, Fusion) > CKA(View_1, View_2) proves harmful redundancy. For the exact fusion rules studied (summation and concatenation), this inequality is a mathematical identity whenever the second view is H1 + εP with P⊥H1 — it holds even when the private signal P is fully preserved. Hence the 'multi-view degradation problem' is not discovered from the data; it is a restatement of CKA arithmetic under the chosen fusion operators. The proposed method is then explicitly designed to change this ratio, so the before/after CKA evidence in Fig. 6 partly reflects the construction rather than an independent confirmation of the mechanism. The Table 2 ablation (w/ Summation) supplies independent evidence that summation fusion underperforms on these datasets, but it does not uniquely support the claimed redundancy-accumulation explanation. Overall, partial circularity is present in the central motivational diagnosis, while the final performance claim is independently grounded.

Assumptions & free parameters 6 free parameters · 5 assumptions · 0 invented entities

No new physical or mathematical entities are introduced. The method contributes shared/private decomposition branches as model constructs, and relies on several hand-chosen hyperparameters and the unvalidated CKA-as-redundancy interpretation. The most load-bearing free parameter is the test-set-fitted decision threshold, which distorts ACC/F1.

free parameters (6)
  • Anomaly-score threshold = per-dataset, maximizing macro F1 on the test set
    Chosen using test labels, leaking information into reported ACC/F1; AUC is unaffected.
  • Low-rank private dimension R = 8
    Controls private-branch capacity; sensitivity shown in Fig. 9(b); fixed across datasets.
  • Number of Mamba blocks L = 3
    Depth hyperparameter chosen for all datasets.
  • Embedding dimension D = 32
    Token embedding size; no reported tuning.
  • Flow length / packet length (F, P) = 4 / 600
    Data representation hyperparameters tuned in Appendix E; central to the multi-view flow/packet design.
  • Disentanglement loss weight = 1.0 (L = L_REC + L_DIS)
    Equal weighting chosen without a reported sweep; affects the shared-private trade-off.
assumptions (5)
  • domain assumption Normal traffic is learnable and anomalous traffic produces larger reconstruction errors under this autoencoder objective.
    Section 3.1/3.3.2: zero-positive training setting; reconstruction-based anomaly scoring.
  • ad hoc to paper CKA similarity between view/fused features is a diagnostic of harmful redundancy, with higher fused-view similarity meaning amplification.
    Section 2.2, Figure 2: no control baseline for what a benign complementary fusion should look like.
  • domain assumption Flow-level and packet-level forward/backward scanning captures complementary traffic cues.
    Section 3.2.2: design choice motivated by flow-packet structure, not derived.
  • ad hoc to paper Residual subtraction after shared projection, StopGrad, low-rank private projections, and cross-covariance loss separate view-specific from view-invariant information usefully.
    Equations 5–7: the desired separation is partly enforced by the loss, so its success requires external validation; the ablation study partially provides it.
  • standard math Mamba/SSM backbone and its selective scan provide linear-time long-sequence modeling.
    Adopted from prior work [13]; not re-derived in this paper.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Disentangling Multi-View Scanning in Mamba for Network Traffic Anomaly Detection." pith.science (2026). https://pith.science/paper/QJ2KVZFO

@misc{pith2026260722829,
  author       = {Pith},
  title        = {Pith review of: Disentangling Multi-View Scanning in Mamba for Network Traffic Anomaly Detection},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/QJ2KVZFO}},
  note         = {Machine review of arXiv:2607.22829}
}
read the original abstract

Network Traffic Anomaly Detection (NTAD) is a critical task in cybersecurity, yet timely and accurate anomaly detection remains challenging. Mamba has emerged as a particularly promising backbone for NTAD due to its linear-time complexity for long-sequence modeling. It further incorporates a dedicated multi-view scanning mechanism to enhance detection precision through complementary contextual cues. However, we identify a previously overlooked structural deficiency in multi-view Mamba scanning for NTAD: redundancy accumulation. Specifically, distinct scanning branches capture substantial view-invariant information, which is repeatedly amplified during multi-view fusion; conversely, view-specific information is diluted or even suppressed, leading to representation homogenization and multi-view degradation. To address this problem, we propose DisenMamba, a novel disentangled multi-view Mamba framework. DisenMamba reformulates multi-view scanning as a two-stage disentangle-then-fuse process that explicitly separates view-invariant and view-specific components prior to fusion. This design prevents the invariant information accumulation while preserving complementary multi-view cues, yielding more discriminative representations for subtle traffic anomalies. Extensive experiments demonstrate the effectiveness of DisenMamba, establishing a new disentangled multi-view Mamba paradigm. Code is available at https://github.com/ikun0124/DisenMamba.

Figures

Figures reproduced from arXiv: 2607.22829 by the authors.

Figure 1
Figure 1. (a) Redundancy accumulation in conventional [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Inter-view redundancy statistics for baselines. [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 4
Figure 4. (a) Overview of DisenMamba. (b) Disentangled Multi-View Scanning (DMVS module): Decomposing each scanning [PITH_FULL_IMAGE:figures/full_fig_p004_4.png] view at source ↗
Figures from the paper (6 more)
Figure 5
Figure 5. Figure 5: Reconstruction comparison on representative cases. [PITH_FULL_IMAGE:figures/full_fig_p006_5.png]
Figure 6
Figure 6. Figure 6: CKA similarity before and after disentanglement. [PITH_FULL_IMAGE:figures/full_fig_p007_6.png]
Figure 7
Figure 7. Figure 7: Density distributions of CKA similarity for inter [PITH_FULL_IMAGE:figures/full_fig_p007_7.png]
Figure 8
Figure 8. Figure 8: Comparison with other disentanglement methods. [PITH_FULL_IMAGE:figures/full_fig_p008_8.png]
Figure 11
Figure 11. Figure 11: CKA-based inter-branch redundancy statistics under different ablation variants. [PITH_FULL_IMAGE:figures/full_fig_p012_11.png]
Figure 12
Figure 12. Figure 12: Supplementary hyperparameter sensitivity analy [PITH_FULL_IMAGE:figures/full_fig_p012_12.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

71 extracted references · 2 linked inside Pith

  1. [1]

    Jiati Cai, Yuxun Zhao, Yan Liu, Ting Zhong, and Fan Zhou. 2026. SCOPE-Diff: A spatiotemporal comprehensive perception diffusion framework for video anomaly detection.Neurocomputing678 (2026), 133157

    2026

  2. [2]

    Jaehoon Cha and Jeyan Thiyagalingam. 2023. Orthogonality-Enforced Latent Space in Autoencoders: An Approach to Learning Disentangled Representations. InInternational Conference on Machine Learning (ICML). 3913–3948

    2023

  3. [3]

    Bin Chen, Hanting Shen, Zhangtao Cheng, Xueting Liu, Ting Zhong, and Fan Zhou. 2026. Unveiling cross-modal consistency: Taming inter- and intra-modal noise for robust multi-modal knowledge graph completion.Information Processing & Management63, 2 (2026), 104472

    2026

  4. [4]

    Bin Chen, Yi Yang, Zhangtao Cheng, Xueting Liu, Yicheng Xin, Kunpeng Zhang, and Fan Zhou. 2026. Semantic duality in hypergraphs: Uncertainty-aware bipolar evidence aggregation for temporal knowledge graph reasoning.Expert Systems with Applications299 (2026), 130162

    2026

  5. [5]

    Xu-Yang Chen, Lu Han, De-Chuan Zhan, and Han-Jia Ye. 2025. MIETT: Multi- Instance Encrypted Traffic Transformer for Encrypted Traffic Classification. In AAAI conference on artificial intelligence (AAAI). 15922–15929

    2025

  6. [6]

    Zhangtao Cheng, Yang Liu, Ting Zhong, Kunpeng Zhang, Fan Zhou, and Philip S. Yu. 2025. Disentangling Inter- and Intra-Cascades Dynamics for Information Diffusion Prediction.IEEE Transactions on Knowledge and Data Engineering37, 8 (2025), 4548–4563

    2025

  7. [7]

    Zhangtao Cheng, Wenxue Ye, Leyuan Liu, Wenxin Tai, and Fan Zhou. 2023. Enhancing Information Diffusion Prediction with Self-Supervised Disentangled User and Cascade Representations. InInternational Conference on Information and Knowledge Management (CIKM). ACM, 3808–3812

    2023

  8. [8]

    Zhangtao Cheng, Jienan Zhang, Xovee Xu, Goce Trajcevski, Ting Zhong, and Fan Zhou. 2024. Retrieval-Augmented Hypergraph for Multimodal Social Media Popularity Prediction. InACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD). 445–455

    2024

Show all 71 references
  1. [9]

    Zhangxuan Dang, Yu Zheng, Xinglin Lian, Chunlei Peng, Qiuyu Chen, and Xinbo Gao. 2025. Semi-Supervised Learning for Anomaly Traffic Detection via Bidirectional Normalizing Flows.IEEE Transactions on Network and Service Management22, 5 (2025), 5106–5117

    2025

  2. [10]

    Xianwen Deng, Ruijie Zhao, Yanhao Wang, Mingwei Zhan, Zhi Xue, and Yijun Wang. 2025. Countmamba: A Generalized Website Fingerprinting Attack via Coarse-Grained Representation and Fine-Grained Prediction. InIEEE Symposium on Security and Privacy (S&P). 1419–1437

    2025

  3. [11]

    Emadeldeen Eldele, Mohamed Ragab, Zhenghua Chen, Min Wu, and Xiaoli Li

  4. [12]

    Hongfan Gao, Wangmeng Shen, Xiangfei Qiu, Ronghui Xu, Bin Yang, and Jilin Hu

  5. [13]

    Albert Gu and Tri Dao. 2024. Mamba: Linear-time sequence modeling with selective state spaces. InConference on Language Modeling (COLM)

    2024

  6. [14]

    Albert Gu, Tri Dao, Stefano Ermon, Atri Rudra, and Christopher Ré. 2020. Hippo: Recurrent memory with optimal polynomial projections. InAnnual Conference on Neural Information Processing Systems (NeurIPS). 1474–1487

    2020

  7. [15]

    Albert Gu, Karan Goel, and Christopher Ré. 2022. Efficiently modeling long sequences with structured state spaces. InInternational Conference on Learning Representations (ICLR)

    2022

  8. [16]

    Hang Guo, Jinmin Li, Tao Dai, Zhihao Ouyang, Xudong Ren, and Shu-Tao Xia

  9. [17]

    Yaru He, Jiaqi Gao, Daoqi Han, Yueming Lu, and Yaojun Qiao. 2026. Hierar- chical traffic fingerprint-assisted Graph Neural Networks for encrypted traffic classification in Internet of Vehicles.Knowledge-Based Systems343 (2026), 116027

    2026

  10. [18]

    Tao Huang, Xiaohuan Pei, Shan You, Fei Wang, Chen Qian, and Chang Xu. 2024. Localmamba: Visual state space model with windowed selective scan. InEuropean Conference on Computer Vision (ECCV). Springer, 12–22

    2024

  11. [19]

    InEuropean Conference on Computer Vision (ECCV)

    Mambair: A simple baseline for image restoration with state-space model. InEuropean Conference on Computer Vision (ECCV). 222–241

  12. [20]

    Alexander Lappe and Martin A Giese. 2025. Register and [CLS] tokens induce a decoupling of local and global features in large ViTs. InAnnual Conference on Neural Information Processing Systems (NeurIPS)

    2025

  13. [21]

    Ghorbani

    Arash Habibi Lashkari, Gerard Draper-Gil, Mohammad Saiful Islam Mamun, and Ali A. Ghorbani. 2017. Characterization of Tor Traffic using Time based Features. InICISSP. SciTePress, 253–262

    2017

  14. [22]

    Simon Kornblith, Mohammad Norouzi, Honglak Lee, and Geoffrey Hinton. 2019. Similarity of neural network representations revisited. InInternational Conference on Machine Learning (ICML). 3519–3529

    2019

  15. [23]

    Xinglin Lian, Chengtai Cao, Ting Zhong, Yong Wang, Kai Chen, and Fan Zhou

  16. [24]

    Xinglin Lian, Yang Liu, Shanfeng Wang, and Yu Zheng. 2024. Payload Level Anomaly Network Traffic Detection via Semi-Supervised Contrastive Learning. InTrust, Security and Privacy in Computing and Communications (TrustCom). 2559–2566

    2024

  17. [25]

    Xinglin Lian, Chengtai Cao, Yan Liu, Xovee Xu, Yu Zheng, and Fan Zhou. 2025. Facing Anomalies Head-On: Network Traffic Anomaly Detection via Uncertainty- Inspired Inter-Sample Differences. Inthe ACM on Web Conference (WWW). 3908– 3917

    2025

  18. [26]

    Xinglin Lian, Yu Zheng, Yan Liu, Fan Zhou, Chunlei Peng, and Xinbo Gao. 2026. Contextual Masking Distillation for Network Traffic Anomaly Detection.IEEE Transactions on Information Forensics and Security21 (2026), 1273–1286

    2026

  19. [27]

    Zhuomin Liang, Liang Bai, Xian Yang, and Jiye Liang. 2025. Multi-Channel Disentangled Graph Neural Networks With Different Types of Self-Constraints. IEEE Transactions on Pattern Analysis and Machine Intelligence47, 9 (2025), 8001– 8012

    2025

  20. [28]

    Xiao Liu, Chenxu Zhang, Fuxiang Huang, Shuyin Xia, Guoyin Wang, and Lei Zhang. 2025. Vision mamba: A comprehensive survey and taxonomy.IEEE Transactions on Neural Networks and Learning Systems(2025)

    2025

  21. [29]

    Xinglin Lian, Yu Zheng, Zhangxuan Dang, Chunlei Peng, and Xinbo Gao. 2025. Semi-supervised anomaly traffic detection via multi-frequency reconstruction. Pattern Recognition161 (2025), 111215

    2025

  22. [30]

    Willian Tessaro Lunardi, Martin Andreoni Lopez, and Jean Pierre Giacalone. 2023. ARCADE: Adversarially Regularized Convolutional Autoencoder for Network Anomaly Detection.Transactions on Network and Service Management20, 2 (2023), 1305–1318

    2023

  23. [31]

    Stefan Matthes, Zhiwei Han, and Hao Shen. 2023. Towards a Unified Framework of Contrastive Learning for Disentangled Representations. InAnnual Conference on Neural Information Processing Systems (NeurIPS)

    2023

  24. [32]

    Gongxun Miao, Guohua Wu, Zhen Zhang, Yongjie Tong, and Bing Lu. 2024. Boosting Encrypted Traffic Classification Using Feature-Enhanced Recurrent Neural Network with Angle Constraint.IEEE Transactions on Big Data(2024)

    2024

  25. [33]

    Yong Liu, Tengge Hu, Haoran Zhang, Haixu Wu, Shiyu Wang, Lintao Ma, and Mingsheng Long. 2024. iTransformer: Inverted Transformers Are Effective for Time Series Forecasting. InInternational Conference on Learning Representations (ICLR)

    2024

  26. [34]

    Ghorbani

    Euclides Carlos Pinto Neto, Sajjad Dadkhah, Raphael Ferreira, Alireza Zohourian, Rongxing Lu, and Ali A. Ghorbani. 2023. CICIoT2023: A Real-Time Dataset and Benchmark for Large-Scale Attacks in IoT Environment.Sensors23, 13 (2023), 5941

    2023

  27. [35]

    Shuxin Qin, Jing Zhu, Aipeng Guo, Yansong Yang, Lu Wang, and Gaofeng Tao

  28. [36]

    Haohao Qu, Liangbo Ning, Rui An, Wenqi Fan, Tyler Derr, Hui Liu, Xin Xu, and Qing Li. 2024. A survey of mamba.arXiv preprint arXiv:2408.01129(2024)

    2024 arXiv

  29. [37]

    Mohammadreza MontazeriShatoori, Logan Davidson, Gurdip Kaur, and Arash Habibi Lashkari. 2020. Detection of DoH Tunnels using Time-series Classification of Encrypted Traffic. InIEEE DASC/PiCom/CBDCom/CyberSciTech. 63–70

    2020

  30. [38]

    Zexi Tan, Tao Xie, Binbin Sun, Xiang Zhang, Yiqun Zhang, and Yiu-Ming Cheung

  31. [39]

    Hoan My Tran, Damien Lolive, Aghilas Sini, Arnaud Delhay, Pierre-François Marteau, and David Guennec. 2025. Multi-level SSL Feature Gating for Audio Deepfake Detection. InACM International Conference on Multimedia (MM). 11766– 11775

    2025

  32. [40]

    MambaAD: Multivariate time series anomaly detection in IoT via multi-view Mamba.Neurocomputing655 (2025), 131385

    2025

  33. [41]

    Tongze Wang, Xiaohui Xie, Wenduo Wang, Chuyi Wang, Youjian Zhao, and Yong Cui. 2024. Netmamba: Efficient Network Traffic Classification Via Pre-Training Unidirectional Mamba. InInternational Conference on Network Protocols (ICNP). 1–11

    2024

  34. [42]

    Yuheng Shi, Minjing Dong, and Chang Xu. 2024. Multi-scale vmamba: Hierarchy in hierarchy visual state space model. InAnnual Conference on Neural Information Processing Systems (NeurIPS), Vol. 37. 25687–25708

    2024

  35. [43]

    Charles Westphal, Stephen Hailes, and Mirco Musolesi. 2025. Feature Selection for Network Intrusion Detection. InACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD). 1599–1610

    2025

  36. [44]

    InPRICAI: Trends in Artificial Intelligence (PRICAI)

    MEET-Sepsis: Multi-Endogenous-View Enhanced Time-Series Representa- tion Learning for Early Sepsis Prediction. InPRICAI: Trends in Artificial Intelligence (PRICAI)

  37. [45]

    Linhan Xia, Mingzhan Yang, Jingjing Wang, Ziwei Yan, Yakun Ren, Guo Yu, and Kai Lei. 2025. Mamba4Net: Distilled Hybrid Mamba Large Language Models For Networking. InInternational Conference on Network Protocols (ICNP). 1–10

    2025

  38. [46]

    Peihao Wang, Ruisi Cai, Yuehao Wang, Jiajun Zhu, Pragya Srivastava, Zhangyang Wang, and Pan Li. 2025. Understanding and Mitigating Bottlenecks of State Space Models through the Lens of Recency and Over-smoothing. InInternational Conference on Learning Representations (ICLR)

    2025

  39. [47]

    Tao Xie, Zexi Tan, Haoyi Xiao, Binbin Sun, and Yiqun Zhang. 2025. DE3S: Dual-Enhanced Soft-Sparse Shape Learning for Medical Early Time Series Clas- sification. InIEEE International Conference on Bioinformatics and Biomedicine (BIBM). 1891–1896

    2025

  40. [48]

    Zihan Wang, Fanheng Kong, Shi Feng, Ming Wang, Xiaocui Yang, Han Zhao, Dal- ing Wang, and Yifei Zhang. 2025. Is Mamba effective for time series forecasting? Neurocomputing619 (2025), 129178

    2025

  41. [49]

    Luming Yang, Lin Liu, Junjie Huang, Zhuotao Liu, Shiyu Liang, Shaojing Fu, and Yongjun Wang. 2025. MM4flow: A Pre-trained Multi-modal Model for Versatile Network Traffic Analysis. InACM SIGSAC Conference on Computer and Communications Security (CCS). ACM, 1664–1678

    2025

  42. [50]

    Nimesha Wickramasinghe, Arash Shaghaghi, Gene Tsudik, and Sanjay K. Jha

  43. [51]

    In IEEE Symposium on Security and Privacy (S&P)

    SoK: Decoding the Enigma of Encrypted Network Traffic Classifiers. In IEEE Symposium on Security and Privacy (S&P). IEEE, 1825–1843

  44. [52]

    Jure Zbontar, Li Jing, Ishan Misra, Yann LeCun, and Stéphane Deny. 2021. Barlow Twins: Self-Supervised Learning via Redundancy Reduction. InInternational Conference on Machine Learning (ICML). 12310–12320

    2021

  45. [53]

    Haoke Xiao, Lv Tang, Peng-tao Jiang, Hao Zhang, Jinwei Chen, and Bo Li. 2025. Boosting Vision State Space Model with Fractal Scanning. InAAAI Conference on Artificial Intelligence (AAAI). 8646–8654. Disentangling Multi-View Scanning in Mamba for Network Traffic Anomaly Detecti...

    2025

  46. [54]

    Qiao Zhang, Mingwen Shao, Xinyuan Chen, Xiang Lv, and Kai Xu. 2025. Wave- MambaAD: Wavelet-driven State Space Model for Multi-class Unsupervised Anomaly Detection. InIEEE/CVF International Conference on Computer Vision (CVPR). 20868–20877

    2025

  47. [55]

    Jiehui Xu, Haixu Wu, Jianmin Wang, and Mingsheng Long. 2022. Anomaly Transformer: Time Series Anomaly Detection with Association Discrepancy. In International Conference on Learning Representations (ICLR)

    2022

  48. [56]

    Ruijie Zhao, Mingwei Zhan, Xianwen Deng, Fangqi Li, Yanhao Wang, Yijun Wang, Guan Gui, and Zhi Xue. 2024. A Novel Self-Supervised Framework Based on Masked Autoencoder for Traffic Classification.IEEE/ACM Transactions on Networking32, 3 (2024), 2012–2025

    2024

  49. [57]

    Luming Yang, Yongjun Wang, Lin Liu, Junjie Huang, Jiangyong Shi, Shaojing Fu, and Shize Guo. 2025. unFlowS: An Unsupervised Construction Scheme of Flow Spectrum for Network Traffic Detection.IEEE Transactions on Information Forensics and Security20 (2025), 3330–3345

    2025

  50. [58]

    Shuo Yang, Xinran Zheng, Jinze Li, Jinfeng Xu, Xingjun Wang, and Edith C. H. Ngai. 2024. ReCDA: Concept Drift Adaptation with Representation Enhancement for Network Intrusion Detection. InACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD). 3818–3828

    2024

  51. [59]

    Yu Zheng, Zhangxuan Dang, Xinglin Lian, Chunlei Peng, and Xinbo Gao. 2024. Multi-view multi-label network traffic classification based on MLP-Mixer neural network.Computer Networks253 (2024), 110746

    2024

  52. [60]

    Haozhen Zhang, Haodong Yue, Xi Xiao, Le Yu, Qing Li, Zhen Ling, and Ye Zhang

  53. [61]

    InAAAI conference on artificial intelligence (AAAI)

    Revolutionizing Encrypted Traffic Classification with MH-Net: A Multi- View Heterogeneous Graph Model. InAAAI conference on artificial intelligence (AAAI). 1048–1056

  54. [62]

    Meihui Zhong, Ting Zhong, Yong Wang, Kai Chen, and Fan Zhou. 2026. Noise Resistant Encrypted Malicious Traffic Detection Through Kernel-Enhanced Con- trastive View Alignment.IEEE Transactions on Networking34 (2026), 1511–1523

    2026

  55. [63]

    Xinchen Zhang, Running Zhao, Zhihan Jiang, Zhicong Sun, Yulong Ding, Edith C. H. Ngai, and Shuang-Hua Yang. 2024. AOC-IDS: Autonomous Online Frame- work with Contrastive Learning for Intrusion Detection. InIEEE Conference on Computer Communications (INFOCOM). 581–590

    2024

  56. [65]

    Ziming Zhao, Zhaoxuan Li, Zhuoxue Song, Wenhao Li, and Fan Zhang. 2024. Tri- dent: A Universal Framework for Fine-Grained and Class-Incremental Unknown Traffic Detection. Inthe ACM on Web Conference (WWW). 1608–1619

    2024

  57. [66]

    Ziming Zhao, Zhuoxue Song, Xiaofei Xie, Zhaoxuan Li, Jiongchi Yu, Fan Zhang, and Tingting Li. 2025. Towards Context-Aware Traffic Classification via Time- Wavelet Fusion Network. InACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD). 2089–2100

    2025

  58. [68]

    Yu Zheng, Xinglin Lian, Zhangxuan Dang, Chunlei Peng, Chao Yang, and Jianfeng Ma. 2023. A Semi-Supervised Anomaly Network Traffic Detection Framework via Multimodal Traffic Information Fusion. InInternational Conference on Information and Knowledge Management (CIKM). 4455–4459

    2023

  59. [69]

    Meihui Zhong, Chengtai Cao, Wenxin Tai, and Fan Zhou. 2026. Shattering Weak Facades: Trustworthy Detection of Encrypted Malicious Traffic via Uncertainty- Aware Fusion.IEEE Transactions on Dependable and Secure Computing(2026)

    2026

  60. [71]

    Bo Zong, Qi Song, Martin Renqiang Min, Wei Cheng, Cristian Lumezanu, Dae-ki Cho, and Haifeng Chen. 2018. Deep Autoencoding Gaussian Mixture Model for Unsupervised Anomaly Detection. InInternational Conference on Learning Representations (ICLR). A Traffic Data Preprocessing The...

    2018

  61. [2024]

    InInternational Conference on Machine Learning (ICML)

    TSLANet: Rethinking Transformers for Time Series Representation Learn- ing. InInternational Conference on Machine Learning (ICML). 12409–12428

  62. [2025]

    InACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD)

    SSD-TS: Exploring the potential of linear state space models for diffusion models in time series imputation. InACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD). 649–660

  63. [2026]

    Decompose to Understand, Fuse to Detect: Frequency-Decoupled Anomaly Detection for Encrypted Network Traffic.arXiv: 2605.02970(2026)

    2026 arXiv

Pith tools

Reviewed August 1, 2026 · model on record in the stance chip above.