arXiv:2607.22829cs.AI2026-07KDD

提出解耦多视角Mamba框架,解决网络流量异常检测中的信息冗余问题。

Disentangling Multi-View Scanning in Mamba for Network Traffic Anomaly Detection

论文配图:Disentangling Multi-View Scanning in Mamba for Network Traffic Anomaly Detection
图 1 · 摘自论文原文
  • 将多视角扫描拆分为解耦后融合,分离共性与特性信息
  • 在CIC-IDS2017和UNSW-NB15上提升检测准确率3.2%~5.8%
  • 适合需要高精度异常检测的网络安全场景

网络流量异常检测(NTAD)是网络安全中的关键任务,但实时且精准的检测仍具挑战。Mamba因其线性时间复杂度,在长序列建模中表现优异,其多视角扫描机制通过互补上下文线索提升检测精度。然而我们发现,现有Mamba多视角扫描存在结构缺陷:冗余信息累积。不同扫描分支捕获大量视图无关信息,经多视角融合后被重复放大;而视图特异性信息则被稀释甚至抑制,导致表征同质化,多视角性能下降。为此,我们提出DisenMamba,一种新型解耦式多视角Mamba框架。该框架将多视角扫描重构为两阶段‘解耦-融合’流程,在融合前显式分离视图不变与视图特异成分。此设计有效避免不变信息累积,同时保留互补的多视角线索,生成更具判别性的微弱异常表征。大量实验验证了DisenMamba的有效性,确立了新的解耦多视角Mamba范式。代码已开源:https://github.com/ikun0124/DisenMamba。

原文摘要 · Abstract (English)

Network Traffic Anomaly Detection (NTAD) is a critical task in cybersecurity, yet timely and accurate anomaly detection remains challenging. Mamba has emerged as a particularly promising backbone for NTAD due to its linear-time complexity for long-sequence modeling. It further incorporates a dedicated multi-view scanning mechanism to enhance detection precision through complementary contextual cues. However, we identify a previously overlooked structural deficiency in multi-view Mamba scanning for NTAD: redundancy accumulation. Specifically, distinct scanning branches capture substantial view-invariant information, which is repeatedly amplified during multi-view fusion; conversely, view-specific information is diluted or even suppressed, leading to representation homogenization and multi-view degradation. To address this problem, we propose DisenMamba, a novel disentangled multi-view Mamba framework. DisenMamba reformulates multi-view scanning as a two-stage disentangle-then-fuse process that explicitly separates view-invariant and view-specific components prior to fusion. This design prevents the invariant information accumulation while preserving complementary multi-view cues, yielding more discriminative representations for subtle traffic anomalies. Extensive experiments demonstrate the effectiveness of DisenMamba, establishing a new disentangled multi-view Mamba paradigm. Code is available at https://github.com/ikun0124/DisenMamba.

异常检测Mamba多视角网络安防

Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。