# Semi-Supervised Learning for Anomaly Traffic Detection via Bidirectional Normalizing Flows

arXiv: https://arxiv.org/abs/2403.10550 · HTML: https://mlsanity.com/paper/2403.10550/

## Key facts

- Cited by 3 papers in the map (data through 14 Oct 2026).
- Builds on 26 of its 63 references that are in the map.
- First posted on arXiv 13 Mar 2024.

## Builds on (most cited first, 26 of 26)

- [Density estimation using Real NVP](https://mlsanity.com/paper/1605.08803/) (2016)
- [Improved Regularization of Convolutional Neural Networks with Cutout](https://mlsanity.com/paper/1708.04552/) (2017)
- [Glow: Generative Flow with Invertible 1x1 Convolutions](https://mlsanity.com/paper/1807.03039/) (2018)
- [Towards Total Recall in Industrial Anomaly Detection](https://mlsanity.com/paper/2106.08265/) (2021)
- [Improving Variational Inference with Inverse Autoregressive Flow](https://mlsanity.com/paper/1606.04934/) (2016)
- [PaDiM: a Patch Distribution Modeling Framework for Anomaly Detection and Localization](https://mlsanity.com/paper/2011.08785/) (2020)
- [CutPaste: Self-Supervised Learning for Anomaly Detection and Localization](https://mlsanity.com/paper/2104.04015/) (2021)
- [Using Self-Supervised Learning Can Improve Model Robustness and Uncertainty](https://mlsanity.com/paper/1906.12340/) (2019)
- [DRAEM -- A discriminatively trained reconstruction embedding for surface anomaly detection](https://mlsanity.com/paper/2108.07610/) (2021)
- [Anomaly Detection via Reverse Distillation from One-Class Embedding](https://mlsanity.com/paper/2201.10703/) (2022)
- [GANomaly: Semi-Supervised Anomaly Detection via Adversarial Training](https://mlsanity.com/paper/1805.06725/) (2018)
- [CFLOW-AD: Real-Time Unsupervised Anomaly Detection with Localization via Conditional Normalizing Flows](https://mlsanity.com/paper/2107.12571/) (2021)
- [Deep Anomaly Detection Using Geometric Transformations](https://mlsanity.com/paper/1805.10917/) (2018)
- [Classification-Based Anomaly Detection for General Data](https://mlsanity.com/paper/2005.02359/) (2020)
- [Anomalib: A Deep Learning Library for Anomaly Detection](https://mlsanity.com/paper/2202.08341/) (2022)
- [Deep Packet: A Novel Approach For Encrypted Traffic Classification Using Deep Learning](https://mlsanity.com/paper/1709.02656/) (2017)
- [MemSeg: A semi-supervised method for image surface defect detection using differences and commonalities](https://mlsanity.com/paper/2205.00908/) (2022)
- [Probabilistic Modeling of Deep Features for Out-of-Distribution and Adversarial Detection](https://mlsanity.com/paper/1909.11786/) (2019)
- [Improved anomaly detection by training an autoencoder with skip connections on images corrupted with Stain-shaped noise](https://mlsanity.com/paper/2008.12977/) (2020)
- [Flow-based Network Traffic Generation using Generative Adversarial Networks](https://mlsanity.com/paper/1810.07795/) (2018)
- [Adversarial Machine Learning in Network Intrusion Detection Systems](https://mlsanity.com/paper/2004.11898/) (2020)
- [AnoSeg: Anomaly Segmentation Network Using Self-Supervised Learning](https://mlsanity.com/paper/2110.03396/) (2021)
- [STAN: Synthetic Network Traffic Generation with Generative Neural Models](https://mlsanity.com/paper/2009.12740/) (2020)
- [Generating Practical Adversarial Network Traffic Flows Using NIDSGAN](https://mlsanity.com/paper/2203.06694/) (2022)
- [GADoT: GAN-based Adversarial Training for Robust DDoS Attack Detection](https://mlsanity.com/paper/2201.13102/) (2022)
- [Multi-view Multi-label Anomaly Network Traffic Classification based on MLP-Mixer Neural Network](https://mlsanity.com/paper/2210.16719/) (2022)

## Built on by (most cited first, 3 of 3)

- [Decompose to Understand, Fuse to Detect: Frequency-Decoupled Anomaly Detection for Encrypted Network Traffic](https://mlsanity.com/paper/2605.02970/) (2026)
- [Research on CNN-BiLSTM Network Traffic Anomaly Detection Model Based on MindSpore](https://mlsanity.com/paper/2504.21008/) (2025)
- [Disentangling Multi-View Scanning in Mamba for Network Traffic Anomaly Detection](https://mlsanity.com/paper/2607.22829/) (2026)

## Abstract (arXiv)

With the rapid development of the Internet, various types of anomaly traffic are threatening network security. We consider the problem of anomaly network traffic detection and propose a three-stage anomaly detection framework using only normal traffic. Our framework can generate pseudo anomaly samples without prior knowledge of anomalies to achieve the detection of anomaly data. Firstly, we employ a reconstruction method to learn the deep representation of normal samples. Secondly, these representations are normalized to a standard normal distribution using a bidirectional flow module. To simulate anomaly samples, we add noises to the normalized representations which are then passed through the generation direction of the bidirectional flow module. Finally, a simple classifier is trained to differentiate the normal samples and pseudo anomaly samples in the latent space. During inference, our framework requires only two modules to detect anomalous samples, leading to a considerable reduction in model size. According to the experiments, our method achieves the state of-the-art results on the common benchmarking datasets of anomaly network traffic detection. The code is given in the https://github.com/ZxuanDang/ATD-via-Flows.git