# An Adversarial Zero-Shot Learning Approach for Anomaly Detection in Multivariate IoT Traffic Data

arXiv: https://arxiv.org/abs/2609.03505 · HTML: https://mlsanity.com/paper/2609.03505/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 3 of its 27 references that are in the map.
- First posted on arXiv 3 Sep 2026.

## Builds on (most cited first, 3 of 3)

- [Deep Learning for Time Series Anomaly Detection: A Survey](https://mlsanity.com/paper/2211.05244/) (2022)
- [DACAD: Domain Adaptation Contrastive Learning for Anomaly Detection in Multivariate Time Series](https://mlsanity.com/paper/2404.11269/) (2024)
- [Data Analytics-enabled Intrusion Detection: Evaluations of ToN_IoT Linux Datasets](https://mlsanity.com/paper/2010.08521/) (2020)

## Abstract (arXiv)

Anomaly detection in Internet of Things (IoT) networks presents unique challenges due to the diversity of devices, lack of labeled data, and domain variability across environments. In this paper, we propose a novel framework for multivariate time-series anomaly detection that leverages adversarial learning and contrastive loss within a sequence-based Variational Autoencoder (VAE) architecture. Our method enables zero-shot domain adaptation by jointly optimizing domain-invariant latent representations and semantically structured embedding spaces, without requiring labeled data or raw feature transfer. To address the heterogeneity of IoT deployments, we introduce encoder and decoder adaptor layers that align feature distributions across domains while preserving contextual semantics. Additionally, we propose a destination-based segmentation strategy to better model real-world communication structures in IoT traffic. Our framework is comprehensively evaluated on six distinct datasets spanning industrial, enterprise, general-purpose, smart home, and military automation domains across 44 transfer scenarios. Experimental results demonstrate strong zero-shot generalization in several cross-domain settings and competitive performance against a contrastive domain-adaptation baseline under realistic, heterogeneous, and privacy-constrained IoT conditions.