# GEE: A Gradient-based Explainable Variational Autoencoder for Network Anomaly Detection

arXiv: https://arxiv.org/abs/1903.06661 · HTML: https://mlsanity.com/paper/1903.06661/

## Key facts

- Cited by 36 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 15 Mar 2019.

## Built on by (most cited first, 30 of 36)

- [A Survey on Explainable Anomaly Detection](https://mlsanity.com/paper/2210.06959/) (2022)
- [One-Class Classification: A Survey](https://mlsanity.com/paper/2101.03064/) (2021)
- [Markov Chain Monte Carlo-Based Machine Unlearning: Unlearning What Needs to be Forgotten](https://mlsanity.com/paper/2202.13585/) (2022)
- [Explainable Intrusion Detection Systems (X-IDS): A Survey of Current Methods, Challenges, and Opportunities](https://mlsanity.com/paper/2207.06236/) (2022)
- [Utilizing XAI technique to improve autoencoder based model for computer network anomaly detection with shapley additive explanation(SHAP)](https://mlsanity.com/paper/2112.08442/) (2021)
- [Explainable Machine Learning for Fraud Detection](https://mlsanity.com/paper/2105.06314/) (2021)
- [A Survey on XAI for 5G and Beyond Security: Technical Aspects, Challenges and Research Directions](https://mlsanity.com/paper/2204.12822/) (2022)
- [Machine Learning in NextG Networks via Generative Adversarial Networks](https://mlsanity.com/paper/2203.04453/) (2022)
- [Trustworthy Anomaly Detection: A Survey](https://mlsanity.com/paper/2202.07787/) (2022)
- [Framing Algorithmic Recourse for Anomaly Detection](https://mlsanity.com/paper/2206.14384/) (2022)
- [Robust online active learning](https://mlsanity.com/paper/2302.00422/) (2023)
- [A new interpretable unsupervised anomaly detection method based on residual explanation](https://mlsanity.com/paper/2103.07953/) (2021)
- [Explaining Anomalies using Denoising Autoencoders for Financial Tabular Data](https://mlsanity.com/paper/2209.10658/) (2022)
- [Fine-grained Anomaly Detection in Sequential Data via Counterfactual Explanations](https://mlsanity.com/paper/2210.04145/) (2022)
- [MixedTeacher : Knowledge Distillation for fast inference textural anomaly detection](https://mlsanity.com/paper/2306.09859/) (2023)
- [Targeted collapse regularized autoencoder for anomaly detection: black hole at the center](https://mlsanity.com/paper/2306.12627/) (2023)
- [Robustness of ML-Enhanced IDS to Stealthy Adversaries](https://mlsanity.com/paper/2104.10742/) (2021)
- [VAE-iForest: Auto-encoding Reconstruction and Isolation-based Anomalies Detecting Fallen Objects on Road Surface](https://mlsanity.com/paper/2203.01193/) (2022)
- [ENCODE: Encoding NetFlows for Network Anomaly Detection](https://mlsanity.com/paper/2207.03890/) (2022)
- [FABLE : Fabric Anomaly Detection Automation Process](https://mlsanity.com/paper/2306.10089/) (2023)
- [Transfer learning applications for anomaly detection in wind turbines](https://mlsanity.com/paper/2404.03011/) (2024)
- [Improved Anomaly Detection through Conditional Latent Space VAE Ensembles](https://mlsanity.com/paper/2410.12328/) (2024)
- [UniNet: A Unified Multi-granular Traffic Modeling Framework for Network Security](https://mlsanity.com/paper/2503.04174/) (2025)
- [A systematic literature review of unsupervised learning algorithms for anomalous traffic detection based on flows](https://mlsanity.com/paper/2503.08293/) (2025)
- [Improving Botnet Detection with Recurrent Neural Network and Transfer Learning](https://mlsanity.com/paper/2104.12602/) (2021)
- [Coalitional Bayesian Autoencoders -- Towards explainable unsupervised deep learning](https://mlsanity.com/paper/2110.10038/) (2021)
- [Statistics and Deep Learning-based Hybrid Model for Interpretable Anomaly Detection](https://mlsanity.com/paper/2202.12720/) (2022)
- [Explanation Method for Anomaly Detection on Mixed Numerical and Categorical Spaces](https://mlsanity.com/paper/2209.04173/) (2022)
- [Adaptable and Interpretable Framework for Novelty Detection in Real-Time IoT Systems](https://mlsanity.com/paper/2304.02947/) (2023)
- [Detection of Sensor-To-Sensor Variations using Explainable AI](https://mlsanity.com/paper/2306.10850/) (2023)

## Abstract (arXiv)

This paper looks into the problem of detecting network anomalies by analyzing NetFlow records. While many previous works have used statistical models and machine learning techniques in a supervised way, such solutions have the limitations that they require large amount of labeled data for training and are unlikely to detect zero-day attacks. Existing anomaly detection solutions also do not provide an easy way to explain or identify attacks in the anomalous traffic. To address these limitations, we develop and present GEE, a framework for detecting and explaining anomalies in network traffic. GEE comprises of two components: (i) Variational Autoencoder (VAE) - an unsupervised deep-learning technique for detecting anomalies, and (ii) a gradient-based fingerprinting technique for explaining anomalies. Evaluation of GEE on the recent UGR dataset demonstrates that our approach is effective in detecting different anomalies as well as identifying fingerprints that are good representations of these various attacks.