# On the Usage of Generative Models for Network Anomaly Detection in Multivariate Time-Series

arXiv: https://arxiv.org/abs/2010.08286 · HTML: https://mlsanity.com/paper/2010.08286/

## Key facts

- Cited by 3 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 16 Oct 2020.

## Built on by (most cited first, 3 of 3)

- [StRegA: Unsupervised Anomaly Detection in Brain MRIs using a Compact Context-encoding Variational Autoencoder](https://mlsanity.com/paper/2201.13271/) (2022)
- [Towards Foundation Auto-Encoders for Time-Series Anomaly Detection](https://mlsanity.com/paper/2507.01875/) (2025)
- [Fault Detection in Mobile Networks Using Diffusion Models](https://mlsanity.com/paper/2404.09240/) (2024)

## Abstract (arXiv)

Despite the many attempts and approaches for anomaly detection explored over the years, the automatic detection of rare events in data communication networks remains a complex problem. In this paper we introduce Net-GAN, a novel approach to network anomaly detection in time-series, using recurrent neural networks (RNNs) and generative adversarial networks (GAN). Different from the state of the art, which traditionally focuses on univariate measurements, Net-GAN detects anomalies in multivariate time-series, exploiting temporal dependencies through RNNs. Net-GAN discovers the underlying distribution of the baseline, multivariate data, without making any assumptions on its nature, offering a powerful approach to detect anomalies in complex, difficult to model network monitoring data. We further exploit the concepts behind generative models to conceive Net-VAE, a complementary approach to Net-GAN for network anomaly detection, based on variational auto-encoders (VAE). We evaluate Net-GAN and Net-VAE in different monitoring scenarios, including anomaly detection in IoT sensor data, and intrusion detection in network measurements. Generative models represent a promising approach for network anomaly detection, especially when considering the complexity and ever-growing number of time-series to monitor in operational networks.