Disentangling Multi-View Scanning in Mamba for Network Traffic Anomaly Detection

2026-07-24

AI Summary

This work addresses the challenge in multi-view Mamba-based network traffic anomaly detection (NTAD), where redundant information accumulation across views often dilutes view-specific features and leads to representation homogenization. To mitigate this issue, we propose DisenMamba, a novel framework that, for the first time, explicitly identifies this limitation and introduces a disentangled multi-view modeling paradigm. DisenMamba employs a two-stage mechanism to separate view-invariant and view-specific components explicitly before fusing them, thereby preserving complementary contextual cues. Built upon the Mamba architecture and integrating view disentanglement, two-stage fusion, and long-sequence modeling capabilities, DisenMamba achieves significant improvements in detection accuracy, establishing a new state-of-the-art benchmark for NTAD.

Abstract

Network Traffic Anomaly Detection (NTAD) is a critical task in cybersecurity, yet timely and accurate anomaly detection remains challenging. Mamba has emerged as a particularly promising backbone for NTAD due to its linear-time complexity for long-sequence modeling. It further incorporates a dedicated multi-view scanning mechanism to enhance detection precision through complementary contextual cues. However, we identify a previously overlooked structural deficiency in multi-view Mamba scanning for NTAD: redundancy accumulation. Specifically, distinct scanning branches capture substantial view-invariant information, which is repeatedly amplified during multi-view fusion; conversely, view-specific information is diluted or even suppressed, leading to representation homogenization and multi-view degradation. To address this problem, we propose DisenMamba, a novel disentangled multi-view Mamba framework. DisenMamba reformulates multi-view scanning as a two-stage disentangle-then-fuse process that explicitly separates view-invariant and view-specific components prior to fusion. This design prevents the invariant information accumulation while preserving complementary multi-view cues, yielding more discriminative representations for subtle traffic anomalies. Extensive experiments demonstrate the effectiveness of DisenMamba, establishing a new disentangled multi-view Mamba paradigm. Code is available at https://github.com/ikun0124/DisenMamba.

Problem

• multi-view scanning
• redundancy accumulation
• view-invariant information
• view-specific information
• representation homogenization

Innovation

• disentangled representation
• multi-view Mamba
• network traffic anomaly detection
• view-specific information
• redundancy accumulation