No More Shortcuts: Network Traffic Anomaly Detection via Bidirectional Prediction
TL;DR
This work proposes BiPred, the first prediction-based detection paradigm for NTAD, which not only eliminates shortcut learning by design but also establishes explicit bidirectional contextual dependencies, making it more sensitive to anomalous traffic.
Abstract
Network Traffic Anomaly Detection (NTAD), particularly under zero-positive settings, is a critical task in cybersecurity. Existing zero-positive NTAD approaches primarily rely on reconstruction-based pipelines. Nevertheless, these methods are susceptible to an identical shortcut issue, where models indiscriminately reconstruct both normal and anomalous inputs, leading to anomaly overgeneralization. To address this limitation, we propose BiPred, the first prediction-based detection paradigm for NTAD. BiPred symmetrically divides each network traffic sample into two segments and reformulates the NTAD task as a bidirectional prediction across these two segments. Unlike reconstruction-based methods, our BiPred not only eliminates shortcut learning by design but also establishes explicit bidirectional contextual dependencies, making it more sensitive to anomalous traffic. Moreover, we develop a novel Residual Scanning Mamba block that encodes multi-view contextual information to support bidirectional prediction. A residual fusion mechanism is proposed for the multi-view scanning Mamba to suppress the accumulation of inter-view redundancy. This design prevents representation degradation and provides multi-view contextual details for prediction. Extensive experiments demonstrate the superiority of our BiPred paradigm, highlighting a new research direction for NTAD. Code is available at https://github.com/ikun0124/BiPred.