Technical Summary: Disentangling Multi-View Scanning in Mamba for Network Traffic Anomaly Detection

1. Problem Statement

Network Traffic Anomaly Detection (NTAD) is a critical cybersecurity task aimed at identifying malicious connections in real-time. While deep learning methods have become dominant, existing architectures face specific limitations: MLPs and CNNs struggle with long-range dependencies and multi-view interactions; Transformers suffer from quadratic computational complexity; and RNNs lack parallelism. Recently, Mamba, a State Space Model (SSM) with linear-time complexity, has emerged as a promising backbone for NTAD, particularly due to its multi-view scanning mechanism designed to capture complementary contextual cues.

However, this paper identifies a previously overlooked structural deficiency in applying multi-view Mamba to NTAD: redundancy accumulation.

• The Phenomenon: Distinct scanning branches in standard multi-view Mamba capture substantial view-invariant information (common patterns across views). During conventional fusion (e.g., simple summation or concatenation), these invariant components are repeatedly amplified.
• The Consequence: Conversely, view-specific information (directional, complementary cues) is diluted or suppressed. This leads to representation homogenization, where the fused output becomes increasingly similar to the invariant patterns of individual views.
• The Result: This "multi-view degradation problem" causes multi-view Mamba architectures to perform worse than their single-view counterparts, as the model loses sensitivity to subtle, directional anomalous traffic patterns.

2. Methodology: DisenMamba

To address redundancy accumulation, the authors propose DisenMamba, a novel framework that reformulates multi-view scanning as a two-stage "disentangle-then-fuse" process.

2.1 Multi-View Scanning Strategy

Recognizing the hierarchical nature of network traffic (flows composed of packets), the model employs a task-specific scanning strategy across four views:

1. Forward Flow-View
2. Backward Flow-View
3. Forward Packet-View
4. Backward Packet-View
   This bidirectional, multi-granularity approach captures complementary dependencies that unidirectional scanning misses.

2.2 Disentangled Multi-View Scanning (DMVS)

Instead of fusing raw features, each scanning view is decomposed into two distinct branches before fusion:

• Shared Branch (View-Invariant): Uses a parameter-shared projection matrix to extract common patterns across all views.
• Private Branch (View-Specific): Uses a residual-based extraction mechanism. It first removes the shared (invariant) component from the view representation and then applies low-rank projections to extract incremental, view-specific information. This low-rank constraint prevents shared information from leaking into the private branch.
• Stop-Gradient: A stop-gradient operation is applied to the shared branch during private feature extraction to prevent gradient interference.

2.3 Multi-View Fusion (MVF)

The fusion process is designed to balance contributions:

• Shared Features: Aggregated via feature-level summation to reinforce invariant patterns.
• Private Features: Concatenated and projected to integrate complementary directional cues.
• Final Output: The invariant and specific representations are fused to generate the final encoded representation, ensuring that view-specific signals are not drowned out by invariant noise.

2.4 Training Objective

The model operates under a zero-positive learning setting (training only on normal traffic). The loss function combines:

1. Reconstruction Loss ($L_{REC}$): Cosine similarity loss between input and reconstructed traffic to learn normal patterns.
2. Disentanglement Constraint ($L_{DIS}$): A lightweight cross-covariance loss that explicitly minimizes statistical dependency between the shared and private representations, ensuring effective separation.

3. Key Contributions

1. Identification of Redundancy Accumulation: The authors are the first to systematically identify and quantify the "redundancy accumulation" phenomenon in Mamba-based NTAD, defining it as a fundamental bottleneck causing multi-view degradation.
2. DisenMamba Framework: A novel architecture that explicitly separates view-invariant and view-specific components via a disentangle-then-fuse paradigm, effectively mitigating representation homogenization.
3. Efficient Disentanglement Mechanisms: Introduction of lightweight projection modules, residual-based extraction, low-rank constraints, and a specific disentanglement loss to achieve separation with negligible inference overhead.
4. Empirical Validation: Comprehensive experiments demonstrating that the proposed method outperforms state-of-the-art NTAD methods while maintaining the linear-time efficiency of Mamba.

4. Experimental Results

The authors evaluated DisenMamba on three real-world datasets: CIC-IoT2023, DoHBrw2020, and ISCX-Tor2016.

• Performance: DisenMamba achieved state-of-the-art results across all metrics (AUC, Accuracy, F1-Score). For instance, it improved AUC by 3.1% on CIC-IoT2023 and 3.9% on DoHBrw2020 compared to the best baseline (SMamba).
• Ablation Studies:
  • Removing the disentanglement design or using simple summation resulted in significant performance drops, confirming the necessity of the proposed mechanism.
  • Removing the low-rank projection or stop-gradient operations degraded performance, validating the importance of structural constraints in preventing information leakage.
• Redundancy Analysis: CKA (Centered Kernel Alignment) similarity analysis showed that while standard fusion increases similarity between views (homogenization), DisenMamba successfully reduces this similarity, preserving complementary information.
• Efficiency: The framework maintains millisecond-level inference latency, comparable to original Mamba models, with only negligible overhead from the lightweight projection modules.

5. Significance and Claims

The paper claims to establish a new disentangled multi-view Mamba paradigm for network traffic analysis. Its primary significance lies in resolving the counterintuitive finding that naive multi-view extensions can degrade performance in NTAD. By explicitly addressing the structural deficiency of redundancy accumulation, DisenMamba unlocks the full potential of Mamba's multi-view scanning capabilities.

The authors position their work not merely as an incremental improvement but as a fundamental correction to how multi-view scanning is applied in SSMs for network traffic. They assert that their "disentangle-then-fuse" approach is essential for capturing the heterogeneous, multi-view anomalies inherent in encrypted network traffic, offering a path toward more sensitive and efficient anomaly detection systems. The paper concludes by suggesting this framework could be extended to other domains like computer vision and time-series analysis, though the current work focuses strictly on NTAD.