关键词: 未知威胁；网络流量异常检测；无监督学习；自监督学习；多视角表征；在线更新

Abstract: With the continuous growth of network services and the widespread adoption of encrypted communications, complex protocols, and dynamic interaction patterns, network traffic anomaly detection is facing increasing challenges, including the emergence of unknown threats, the scarcity of attack labels, and time-varying data distributions. To address these issues, this paper proposes an unsupervised network traffic anomaly detection method for unknown threats, named Multi-view Unsupervised Self-supervised Traffic Anomaly Detection (MUST-AD). Taking network flows as detection objects, the proposed method constructs multi-view representations by jointly modeling statistical behavior, temporal evolution, and communication relationships. It then establishes a latent representation space for normal traffic through a self-supervised learning strategy that combines masked reconstruction and cross-view contrastive learning. In addition, normal prototype organization, joint anomaly scoring, and drift-aware online updating are integrated to achieve comprehensive detection of unknown anomalous traffic. Experiments are conducted on the UNSW-NB15, CIC-IDS2017, and MAWIFlow datasets. The results show that, in-domain static detection scenarios, MUST-AD improves Accuracy and AUC by 0.1%~0.3% and improves F1 by approximately 0.6~1.0 percentage points compared with baseline methods. Under cross-dataset settings, the AUC is improved by 2~3 percentage points. On MAWIFlow, the AUC reaches 0.915~0.920. In cross-time generalization scenarios, the AUC reaches 0.84, outperforming the compared methods with AUC values of 0.79 and 0.61. The proposed method can simultaneously maintain detection performance, cross-scenario generalization capability.

Key words: unknown threats; network traffic anomaly detection; unsupervised learning; self-supervised learning; multi-view representation; online updating