Abstract
Network Traffic Anomaly Detection (NTAD) is critical in cybersecurity, yet timely and accurate detection remains challenging. Mamba has emerged as a promising backbone for NTAD due to its linear-time complexity for long-sequence modeling. It incorporates a dedicated multi-view scanning mechanism to enhance detection precision through complementary contextual cues.
However, we identify a previously overlooked structural deficiency in multi-view Mamba scanning for NTAD: redundancy accumulation. Distinct scanning branches capture substantial view-invariant information, which is repeatedly amplified during multi-view fusion; conversely, view-specific information is diluted or suppressed, leading to representation homogenization and multi-view degradation. To address this, we propose DisenMamba, a novel disentangled multi-view Mamba framework. DisenMamba reformulates multi-view scanning as a two-stage disentangle-then-fuse process that explicitly separates view-invariant and view-specific components prior to fusion. This design prevents invariant information accumulation while preserving complementary multi-view cues, yielding more discriminative representations for subtle traffic anomalies. Extensive experiments demonstrate the effectiveness of DisenMamba, establishing a new disentangled multi-view Mamba paradigm.
Code is available at this link.
Blogger's Review: The DisenMamba framework significantly enhances the capability of network traffic anomaly detection by effectively decoupling information, particularly in complex traffic scenarios. Its innovative two-stage processing approach is noteworthy and provides a fresh perspective for the cybersecurity domain.