Hybrid Latent-Structural Fusion (HLSF) for Cyber Anomaly Detection

# Hybrid Latent-Structural Fusion (HLSF) for Cyber Anomaly Detection
Source: [https://arxiv.org/html/2607.18479](https://arxiv.org/html/2607.18479)
Dorianis Mercedes Perez111Present address: Center for Computing Research, Sandia National Laboratory, Albuquerque, NM 87185Maksim Ekin Eren[maksim@lanl\.gov](https://arxiv.org/html/2607.18479v1/mailto:[email protected])Bryan Edward Kaiser[bkaiser@lanl\.gov](https://arxiv.org/html/2607.18479v1/mailto:[email protected])

###### Abstract

Malicious anomalous activity detection is a fundamental challenge for cyber security systems\. Both tensor decomposition under statistical framework with CANDECOMP\-PARAFAC alternating Poisson regression \(CP\-APR\) and normalizing flows have proven to be powerful unsupervised machine learning methods that model multi\-dimensional data and capture complex and multi\-faceted details of behavior profiles in cyber security applications\. In this study, we propose Hybrid Latent\-Structural Fusion \(HLSF\), a weighted anomaly fusion framework integrating CP\-APR structural anomaly scores with latent\-space density scores derived from normalizing flows\. In our experiments, we show that the HLSF framework improves anomaly detection performance on a dataset of real\-world compromised user credentials collected from the large enterprise network of Los Alamos National Laboratory \(LANL\) during a red\-teaming exercise, compared with using CP\-APR or normalizing flows alone\.

###### keywords:

cyber anomaly detection , non\-negative tensor factorization , unsupervised learning , normalizing flows

\\csdef

WGMwgm\\xspace\\csdefQEqe\\xspace

\\affiliation

\[1\]organization=X Computational Physics Division, addressline=Los Alamos National Laboratory, city=Los Alamos, postcode=87545, state=NM, country=USA

\\affiliation

\[2\]organization=Analytics, Intelligence, and Technology Division, addressline=Los Alamos National Laboratory, city=Los Alamos, postcode=87545, state=NM, country=USA

## 1Introduction

Digital information has been vulnerable to attacks since the earliest days of computing\. Networked systems first emerged in the 1960s and 1970s and so did early malware and cyber breaches\[[29](https://arxiv.org/html/2607.18479#bib.bib33)\]\. Anderson’s report in 1980 introduced the idea that security audit trails can be examined for unauthorized access to systems\[[4](https://arxiv.org/html/2607.18479#bib.bib48)\]\. Detection of intrusions via anomaly\-based approaches was then founded in 1987 when Denning formalized the idea of anomaly\-based detection by monitoring system behavior against statistical profiles of normal usage\[[13](https://arxiv.org/html/2607.18479#bib.bib34)\]\. Today, detection of cyber anomalies, such as compromised accounts, insider threats, malware traffic, and phishing, continues to be a significant challenge for cyber defenders\[[20](https://arxiv.org/html/2607.18479#bib.bib8)\]\. These challenges underscore the need for methods that can automatically identify subtle deviations from normal behavior in large, complex cyber environments\.

Recent work has demonstrated that latent\-factor models based on dimensionality reduction, originally developed for recommendation systems with collaborative filtering, provide a powerful framework for modeling cyber behavior\[[21](https://arxiv.org/html/2607.18479#bib.bib2)\]\. Matrix factorization can identify ”peer groups” of users and devices, which allow data\-driven predictions of future user actions\[[12](https://arxiv.org/html/2607.18479#bib.bib11),[46](https://arxiv.org/html/2607.18479#bib.bib13),[36](https://arxiv.org/html/2607.18479#bib.bib12)\]\. More recently, tensor factorization methods have extended these ideas to higher\-order dimensionality reduction on cyber data that capture interactions among users, devices, resources, and time simultaneously\. Eren et al\. showed that extending tensor factorization methods within a statistical framework enables state\-of\-the\-art unsupervised anomaly detection across a range of cybersecurity applications\[[20](https://arxiv.org/html/2607.18479#bib.bib8)\]\. Their approach used an implementation of the CANDECOMP\-PARAFAC alternating Poisson regression \(CP\-APR\) algorithm originally introduced by\[[11](https://arxiv.org/html/2607.18479#bib.bib35)\]and achieved stronger anomaly detection performance than statistical matrix factorization, as well as other supervised and unsupervised methods, on tasks involving spam e\-mail traffic, anomalous credit card transactions, botnet network traffic, and detecting users with compromised credentials\.

In parallel, normalizing flows have emerged as an approach for out\-of\-distribution \(OOD\) detection in real\-world applications spanning autonomous driving, medical diagnosis, and security systems\[[51](https://arxiv.org/html/2607.18479#bib.bib18),[48](https://arxiv.org/html/2607.18479#bib.bib27),[6](https://arxiv.org/html/2607.18479#bib.bib28),[24](https://arxiv.org/html/2607.18479#bib.bib29),[9](https://arxiv.org/html/2607.18479#bib.bib30),[7](https://arxiv.org/html/2607.18479#bib.bib31),[49](https://arxiv.org/html/2607.18479#bib.bib32)\]\. Normalizing flows have been recognized across the deep learning community to be a powerful tool because of their ability to model complex probability distributions and perform exact likelihood estimation\[[51](https://arxiv.org/html/2607.18479#bib.bib18),[14](https://arxiv.org/html/2607.18479#bib.bib19),[15](https://arxiv.org/html/2607.18479#bib.bib20),[35](https://arxiv.org/html/2607.18479#bib.bib21),[27](https://arxiv.org/html/2607.18479#bib.bib65)\]\. Normalizing flows learn an exact, flexible density model via bijective mappings from data space to latent space\[[35](https://arxiv.org/html/2607.18479#bib.bib21),[51](https://arxiv.org/html/2607.18479#bib.bib18)\]\. This makes them effective in extracting features from in\-distribution \(ID\) data by training them on high level features of ID data, via maximization of likelihoods, and then using low likelihood as a score function for OOD detection\[[51](https://arxiv.org/html/2607.18479#bib.bib18),[32](https://arxiv.org/html/2607.18479#bib.bib22),[41](https://arxiv.org/html/2607.18479#bib.bib23),[26](https://arxiv.org/html/2607.18479#bib.bib24),[50](https://arxiv.org/html/2607.18479#bib.bib25),[2](https://arxiv.org/html/2607.18479#bib.bib26)\]\. Because of this, normalizing flows have become a popular and successful method in unsupervised anomaly detection across many applications\[[53](https://arxiv.org/html/2607.18479#bib.bib50),[25](https://arxiv.org/html/2607.18479#bib.bib49),[22](https://arxiv.org/html/2607.18479#bib.bib51),[39](https://arxiv.org/html/2607.18479#bib.bib52)\]\.

In this study, we propose the use of a hybrid approach, named Hybrid Latent\-Structural Fusion \(HLSF\), where CP\-APR allows the structured representation via latent factors of the tensorized sparse data and normalizing flows, via Real\-valued Non\-Volume Preserving \(RealNVP\), helps us model the density of the latent behavior\[[15](https://arxiv.org/html/2607.18479#bib.bib20)\]\. This makes the normalizing flow the detector of latent combinations not seen during training, which is the cyber anomaly signal\. CP\-APR learns what patterns exist while normalizing flows learn how likely a specific pattern configuration is\. Combining them improves anomaly detection by capturing both structure and distribution\. Our results make a compelling case that this methodology can outperform either method on its own\. Starting with sparse tensors constructed from the publicly available Unified Host and Network Dataset, which contains anomalies involving users with compromised credentials recorded on the large real\-world Los Alamos National Laboratory \(LANL\) network during a cyber red\-teaming event, we use the CP\-APR algorithm to decompose a specified\-rank tensor via Poisson tensor factorization \(CP\-APR\)\[[45](https://arxiv.org/html/2607.18479#bib.bib14)\]\. The resulting latent factors are then used to score anomalies using p\-values from the fitted model\. The second approach uses normalizing flows to learn a transformation of the data into a latent distribution and produces anomaly scores via the negative log likelihood \(NLL\)\. The hybrid approach scores the anomalies via a weighted sum\. These approaches were then compared and we found that in certain matrix and tensor configurations, where we select different variables to represent the dimensions in the tensor, normalizing flows and, subsequently, the hybrid approach tend to outperform the CP\-APR\-based anomaly scores for all datasets\. By modeling CP\-APR latent factors instead of the raw tensor, the flow operates on a structured, continuous representation where simplicity reflects meaningful patterns rather than sparsity\. This prevents degenerate or random inputs from receiving artificially high likelihood, mitigating the known bias of normalizing flows toward low\-complexity data\[[51](https://arxiv.org/html/2607.18479#bib.bib18),[38](https://arxiv.org/html/2607.18479#bib.bib40),[32](https://arxiv.org/html/2607.18479#bib.bib22),[41](https://arxiv.org/html/2607.18479#bib.bib23),[34](https://arxiv.org/html/2607.18479#bib.bib41)\]\. In summary, our contributions are as follows:

1. 1\.Leveraged normalizing flows to detect cyber anomalies in network\-flow data, focusing on users with compromised credentials in a real\-world network dataset\.
2. 2\.Compared the anomaly detection performance of normalizing flows with tensor decomposition using CP\-APR\.
3. 3\.Introduced a hybrid framework, named HLSF, that fuses anomaly scores from tensor decomposition and normalizing flows to improve detection performance\.

The remainder of the paper is organized as follows\. Section 2 describes related work in anomaly detection methods and the motivation for choosing these specific methods, Section 3 describes our methodology and presents the mathematical formulations for each approach, Section 4 presents the experimental setup and the results, and Section 5 concludes the paper with key findings\.

## 2Related Work

Recent advances in cyber anomaly detection have increasingly focused on latent\-factor models that capture underlying behavioral structure in large\-scale security data\[[31](https://arxiv.org/html/2607.18479#bib.bib53),[28](https://arxiv.org/html/2607.18479#bib.bib54),[8](https://arxiv.org/html/2607.18479#bib.bib55),[47](https://arxiv.org/html/2607.18479#bib.bib56)\]\. Early work used Poisson matrix factorization \(PMF\) to model interactions among users, hosts, and resources while identifying statistically unlikely events through Poisson distribution\-based anomaly scores\[[46](https://arxiv.org/html/2607.18479#bib.bib13),[37](https://arxiv.org/html/2607.18479#bib.bib15),[36](https://arxiv.org/html/2607.18479#bib.bib12)\]\. These approaches demonstrated that recommendation\-system methodologies can effectively discover peer groups and behavioral patterns in an unsupervised fashion, without need of labels, that are difficult to identify using rule\-based or signature\-based techniques\.

Tensor factorization methods extended latent\-factor modeling from pairwise relationships up to higher\-order relationships\. Cyber events are, by nature, multi\-relational, involving users, devices, destinations, applications, and temporal attributes including cyclostationary processes simultaneously\. Tensor representations model higher\-order relationships with dimensionality reduction to uncover latent behavioral structure across dimensions\. Eren et al\. introduced a generalized version of a tensor decomposition method for unsupervised anomaly detection that surpasses state\-of\-the\-art supervised and semi\-supervised learning baselines across an array of challenging and diverse cyber application areasErenet al\.\[[20](https://arxiv.org/html/2607.18479#bib.bib8)\]\. They use binary tensors to represent user, source, and destination, for example Figure[1](https://arxiv.org/html/2607.18479#S2.F1), and perform tensor factorization via canonical polyadic decomposition \(CPD\) to obtain a weighted sum of rank\-1 tensors\. Their tensor analysis\-based method is sensitive to anomalous activity over a diverse set of attributes\. The publicly availablepyCP\_APRPython library they developed allows tensor factorization using a graphics processing unit \(GPU\) and combines factorization with an anomaly scoring and prediction interface\[[20](https://arxiv.org/html/2607.18479#bib.bib8),[18](https://arxiv.org/html/2607.18479#bib.bib46),[19](https://arxiv.org/html/2607.18479#bib.bib47)\]\. In this work, we use the Python librarypyCP\_APRfor tensor factorization\.

A key ability of CP\-APR is modeling sparse count and binary cyber data through a Poisson likelihood formulation\. Anomaly scores are derived from deviations relative to the reconstructed tensor representation which may not fully capture complex nonlinear dependencies among latent factors\. For this reason, we explore complementary density\-estimation approaches capable of learning richer probability distributions over latent behavioral representations\.

![Refer to caption](https://arxiv.org/html/2607.18479v1/USD_plot.png)Figure 1:Binary tensor with User\-Source\-Destination dimensions showing background traffic in gray and anomalies in red from Eren et al\.Erenet al\.\[[20](https://arxiv.org/html/2607.18479#bib.bib8)\]Deep generative models have emerged as a powerful class of methods for unsupervised anomaly detection because they learn probability distributions directly from observed data\. Variational autoencoders \(VAEs\), generative adversarial networks \(GANs\), and normalizing flows have all been applied to an array of cyber security problems, including intrusion detections, malware analysis, and network traffic monitoring\[[5](https://arxiv.org/html/2607.18479#bib.bib57),[42](https://arxiv.org/html/2607.18479#bib.bib58),[44](https://arxiv.org/html/2607.18479#bib.bib61),[17](https://arxiv.org/html/2607.18479#bib.bib62),[40](https://arxiv.org/html/2607.18479#bib.bib63),[33](https://arxiv.org/html/2607.18479#bib.bib64),[1](https://arxiv.org/html/2607.18479#bib.bib59),[16](https://arxiv.org/html/2607.18479#bib.bib60),[43](https://arxiv.org/html/2607.18479#bib.bib43),[3](https://arxiv.org/html/2607.18479#bib.bib42),[23](https://arxiv.org/html/2607.18479#bib.bib38)\]\. Normalizing flows are particularly attractive because they provide exact likelihood estimation through an invertible mapping between observed data and a tractable latent distribution\.

Recent studies have demonstrated the success of using normalizing flows for cyber anomaly detection\.Stepashkina and Hushchyn \[[43](https://arxiv.org/html/2607.18479#bib.bib43)\]used a transformer\-based autoencoder architecture enhanced by transitioning to a variational autoencoder \(VAE\) and integration of normalizing flows to detect anomalies in multivariate time series\.Guoet al\.\[[23](https://arxiv.org/html/2607.18479#bib.bib38)\]used a semi\-supervised learning framework with normalizing flows to model the distribution of both labeled and unlabeled data while incorporating sensitivity threshold management to enhance detection performance\.Ammar and Al Bassam \[[3](https://arxiv.org/html/2607.18479#bib.bib42)\]used a RealNVP architecture trained using only benign traffic data to successfully detect anomalies including Denial of Service \(DoS\), Distributed Denial of Service \(DDoS\), port scans, infiltration, and botnet activities\.

While these studies demonstrate that normalizing flows can effectively model complex cyber data distributions, existing approaches primarily operate on network\-flow features, packet statistics, or temporal sensor measurements\. To the best of our knowledge, this is the first time flow\-based density estimation are applied to latent behavioral representations derived from tensor factorization methods\.

## 3Methods

In this section, we describe the three methods compared in this study: CP\-APR tensor factorization, RealNVP normalizing flows, and the proposed Hybrid Latent\-Structural Fusion \(HLSF\) method\. We first introduce the tensor notation used throughout the paper, since both CP\-APR and HLSF operate on sparse, multi\-way event tensors\. We then describe CP\-APR, the RealNVP density estimator, and finally the proposed fusion framework\. Although CP\-APR was first introduced by\[[11](https://arxiv.org/html/2607.18479#bib.bib35)\]and later used for cyber anomaly detection by\[[18](https://arxiv.org/html/2607.18479#bib.bib46),[20](https://arxiv.org/html/2607.18479#bib.bib8)\], we include a brief description for completeness\.

### 3\.1Tensor Representation and Terminology

The authentication data are represented as sparse count \(pr binary\) tensors\. A tensor generalizes a matrix to more than two dimensions, or modes\. Let

𝒳∈ℝN1×N2×⋯×ND\\mathcal\{X\}\\in\\mathbb\{R\}^\{N\_\{1\}\\times N\_\{2\}\\times\\cdots\\times N\_\{D\}\}\(1\)denote aDD\-dimensional tensor, whereDDis the number of modes andNdN\_\{d\}is the dimension size of modedd\. The total number of possible tensor entries is

\|𝒳\|=∏d=1DNd\.\|\\mathcal\{X\}\|=\\prod\_\{d=1\}^\{D\}N\_\{d\}\.\(2\)Each entry is indexed by a multi\-index

𝐢=\(i1,…,iD\),\\mathbf\{i\}=\(i\_\{1\},\\ldots,i\_\{D\}\),\(3\)whereid∈\{1,…,Nd\}i\_\{d\}\\in\\\{1,\\ldots,N\_\{d\}\\\}identifies a specific entity in modedd\. The corresponding tensor value is denoted by𝒳𝐢\\mathcal\{X\}\_\{\\mathbf\{i\}\}or equivalently𝒳i1,…,iD\\mathcal\{X\}\_\{i\_\{1\},\\ldots,i\_\{D\}\}\. For example, Figure[1](https://arxiv.org/html/2607.18479#S2.F1)shows aD=3D=3tensor with modes corresponding toUser,Source, andDestination\. In this case, a tensor entry

𝒳i1,i2,i3\\mathcal\{X\}\_\{i\_\{1\},i\_\{2\},i\_\{3\}\}\(4\)represents the observed count for useri1i\_\{1\}authenticating from source devicei2i\_\{2\}to destination devicei3i\_\{3\}within a specified time window\. If the entry is nonzero, the corresponding event combination occurred at least once during that window\. If the entry is zero, the combination was not observed\.

Because cyber event tensors are extremely sparse, most possible combinations of users, devices, hosts, or other entities are never observed\. We denote the number of nonzero entries in the tensor by

n​n​z​\(𝒳\)=\|\{𝐢:𝒳𝐢≠0\}\|\.nnz\(\\mathcal\{X\}\)=\\left\|\\left\\\{\\mathbf\{i\}:\\mathcal\{X\}\_\{\\mathbf\{i\}\}\\neq 0\\right\\\}\\right\|\.\(5\)The density of the tensor is therefore

ρ​\(𝒳\)=n​n​z​\(𝒳\)∏d=1DNd,\\rho\(\\mathcal\{X\}\)=\\frac\{nnz\(\\mathcal\{X\}\)\}\{\\prod\_\{d=1\}^\{D\}N\_\{d\}\},\(6\)and the sparsity is

1−ρ​\(𝒳\)=1−n​n​z​\(𝒳\)∏d=1DNd\.1\-\\rho\(\\mathcal\{X\}\)=1\-\\frac\{nnz\(\\mathcal\{X\}\)\}\{\\prod\_\{d=1\}^\{D\}N\_\{d\}\}\.\(7\)Thus, larger mode sizes increase the number of possible entries multiplicatively, whilen​n​z​\(𝒳\)nnz\(\\mathcal\{X\}\)counts only the entries that are actually observed\. This distinction is important because the methods considered here are designed for sparse tensors wheren​n​z​\(𝒳\)≪∏d=1DNdnnz\(\\mathcal\{X\}\)\\ll\\prod\_\{d=1\}^\{D\}N\_\{d\}\.

### 3\.2CP\-APR Tensor Factorization

CP\-APR is an efficient algorithm for optimizing sparse Poisson likelihood functions\[[11](https://arxiv.org/html/2607.18479#bib.bib35)\]\. It is based on the Poisson canonical polyadic decomposition \(CPD\), which represents a sparse count tensor using a low\-rank factorization\. For aDD\-dimensional tensor with shapeN1,…,NDN\_\{1\},\\ldots,N\_\{D\}, each entry is modeled as an independent draw from a Poisson distribution:

𝒳𝐢∼Poisson⁡\(λ𝐢\),\\mathcal\{X\}\_\{\\mathbf\{i\}\}\\sim\\operatorname\{Poisson\}\(\\lambda\_\{\\mathbf\{i\}\}\),\(8\)where the Poisson rateλ𝐢\\lambda\_\{\\mathbf\{i\}\}is determined by a rank\-RRCPD:

λ𝐢=∑r=1Rγr​∏d=1Dθr,id\(d\)\.\\lambda\_\{\\mathbf\{i\}\}=\\sum\_\{r=1\}^\{R\}\\gamma\_\{r\}\\prod\_\{d=1\}^\{D\}\\theta^\{\(d\)\}\_\{r,i\_\{d\}\}\.\(9\)Here,γr\\gamma\_\{r\}is the weight of componentrr, andθr,id\(d\)\\theta^\{\(d\)\}\_\{r,i\_\{d\}\}is the value associated with entityidi\_\{d\}in modeddfor componentrr\. Equivalently, the fitted CP\-APR model can be written as

Θ=\{A\(1\),…,A\(D\),γ\},\\Theta=\\\{A^\{\(1\)\},\\ldots,A^\{\(D\)\},\\gamma\\\},\(10\)where each factor matrix

A\(d\)∈ℝNd×RA^\{\(d\)\}\\in\\mathbb\{R\}^\{N\_\{d\}\\times R\}\(11\)contains the rank\-RRlatent factors for modedd\.

The model is trained by maximizing the joint log\-likelihood of the observed tensor counts, or equivalently by minimizing the generalized Kullback–Leibler divergence between the observed tensor and the fitted Poisson rates:

log⁡P​\(𝒳\)=∑i1=1N1⋯​∑iD=1ND\[𝒳𝐢​log⁡λ𝐢−log⁡Γ​\(𝒳𝐢\+1\)\]−Λ,\\log P\(\\mathcal\{X\}\)=\\sum\_\{i\_\{1\}=1\}^\{N\_\{1\}\}\\cdots\\sum\_\{i\_\{D\}=1\}^\{N\_\{D\}\}\\left\[\\mathcal\{X\}\_\{\\mathbf\{i\}\}\\log\\lambda\_\{\\mathbf\{i\}\}\-\\log\\Gamma\(\\mathcal\{X\}\_\{\\mathbf\{i\}\}\+1\)\\right\]\-\\Lambda,\(12\)where

Λ=∑i1=1N1⋯​∑iD=1NDλ𝐢\.\\Lambda=\\sum\_\{i\_\{1\}=1\}^\{N\_\{1\}\}\\cdots\\sum\_\{i\_\{D\}=1\}^\{N\_\{D\}\}\\lambda\_\{\\mathbf\{i\}\}\.\(13\)Equation \([12](https://arxiv.org/html/2607.18479#S3.E12)\) is computationally attractive for sparse tensors because the terms involving𝒳𝐢\\mathcal\{X\}\_\{\\mathbf\{i\}\}contribute only at nonzero entries, reducing the main likelihood computation to the observed entries\[[20](https://arxiv.org/html/2607.18479#bib.bib8)\]\.

Rank selection is performed by fitting CP\-APR models on the training set for ranksR∈\{1,2,…,100\}R\\in\\\{1,2,\\ldots,100\\\}and evaluating the log\-likelihood on the validation set\. The rank with the highest validation log\-likelihood is selected for subsequent training and testing\. After rank selection, the training and validation sets are combined to fit the final CP\-APR model\[[20](https://arxiv.org/html/2607.18479#bib.bib8)\]\.

Because the tensors are extremely sparse, the fitted rank\-RRmodel can assign zero or near\-zero Poisson rates to some entries during testing\. To reduce the effect of zero\-rate estimates, the predicted Poisson rate for each entry is smoothed using a convex combination of the fitted rank\-RRmodel and a rank\-1 baseline model\. Following Eren et al\.\[[20](https://arxiv.org/html/2607.18479#bib.bib8)\], binary entries are inflated so that the mean nonzero tensor value is approximately one:

𝒳𝐢=∏d=1DNdn​n​z​\(𝒳\),for​𝒳𝐢≠0\.\\mathcal\{X\}\_\{\\mathbf\{i\}\}=\\frac\{\\prod\_\{d=1\}^\{D\}N\_\{d\}\}\{nnz\(\\mathcal\{X\}\)\},\\qquad\\text\{for \}\\mathcal\{X\}\_\{\\mathbf\{i\}\}\\neq 0\.\(14\)A rank\-1 factorization is then estimated in addition to the selected rank\-RRfactorization\. Since the marginal sums across tensor modes are nonzero in the training data, the rank\-1 model provides nonzero baseline rates\. The final smoothed Poisson rate is

λ𝐢=a​λ𝐢1\+\(1−a\)​λ𝐢R,\\lambda\_\{\\mathbf\{i\}\}=a\\lambda^\{1\}\_\{\\mathbf\{i\}\}\+\(1\-a\)\\lambda^\{R\}\_\{\\mathbf\{i\}\},\(15\)whereλ𝐢1\\lambda^\{1\}\_\{\\mathbf\{i\}\}is the rank\-1 rate,λ𝐢R\\lambda^\{R\}\_\{\\mathbf\{i\}\}is the selected rank\-RRrate, anda∈\[0,1\]a\\in\[0,1\]controls the amount of smoothing\. Based on Eren et al\.\[[20](https://arxiv.org/html/2607.18479#bib.bib8)\], we seta=0\.1a=0\.1\.

CP\-APR anomaly scores are computed using the Poisson survival function\. For an observed test entry𝒳𝐢\\mathcal\{X\}\_\{\\mathbf\{i\}\}, the p\-value is the probability of observing a count at least as large as the observed value under the fitted model:

P​\(X𝐢≥𝒳𝐢∣λ𝐢\)\.P\\left\(X\_\{\\mathbf\{i\}\}\\geq\\mathcal\{X\}\_\{\\mathbf\{i\}\}\\mid\\lambda\_\{\\mathbf\{i\}\}\\right\)\.\(16\)Lower p\-values indicate events that are less likely under the learned low\-rank relational structure\. We define the CP\-APR anomaly score as

sCP​\(𝐢\)=−log⁡P​\(X𝐢≥𝒳𝐢∣λ𝐢\)\.s\_\{\\mathrm\{CP\}\}\(\\mathbf\{i\}\)=\-\\log P\\left\(X\_\{\\mathbf\{i\}\}\\geq\\mathcal\{X\}\_\{\\mathbf\{i\}\}\\mid\\lambda\_\{\\mathbf\{i\}\}\\right\)\.\(17\)

### 3\.3Normalizing Flows

Normalizing flows model a target distributionp∗​\(𝐱\)p^\{\*\}\(\\mathbf\{x\}\)using an invertible transformation of a tractable base distribution\[[27](https://arxiv.org/html/2607.18479#bib.bib65),[35](https://arxiv.org/html/2607.18479#bib.bib21)\]\. In this work, we use the RealNVP architecture\. Let

fϕ:ℝM→ℝMf\_\{\\phi\}:\\mathbb\{R\}^\{M\}\\rightarrow\\mathbb\{R\}^\{M\}\(18\)denote an invertible mapping from an input representation𝐱\\mathbf\{x\}to a latent variable

𝐳=fϕ​\(𝐱\),\\mathbf\{z\}=f\_\{\\phi\}\(\\mathbf\{x\}\),\(19\)where the latent variable follows a standard Gaussian base distribution,

pZ​\(𝐳\)=𝒩​\(𝟎,𝐈\)\.p\_\{Z\}\(\\mathbf\{z\}\)=\\mathcal\{N\}\(\\mathbf\{0\},\\mathbf\{I\}\)\.\(20\)By the change\-of\-variables formula, the likelihood of a sample is

log⁡pX​\(𝐱\)=log⁡pZ​\(fϕ​\(𝐱\)\)\+log⁡\|det∂fϕ∂𝐱\|\.\\log p\_\{X\}\(\\mathbf\{x\}\)=\\log p\_\{Z\}\(f\_\{\\phi\}\(\\mathbf\{x\}\)\)\+\\log\\left\|\\det\\frac\{\\partial f\_\{\\phi\}\}\{\\partial\\mathbf\{x\}\}\\right\|\.\(21\)
RealNVP constructsfϕf\_\{\\phi\}as a composition ofKKaffine coupling layers\. For an input partitioned into\(𝐱1,𝐱2\)\(\\mathbf\{x\}\_\{1\},\\mathbf\{x\}\_\{2\}\), one coupling layer is defined as

𝐲1\\displaystyle\\mathbf\{y\}\_\{1\}=𝐱1,\\displaystyle=\\mathbf\{x\}\_\{1\},\(22\)𝐲2\\displaystyle\\mathbf\{y\}\_\{2\}=𝐱2⊙exp⁡\(sϕ​\(𝐱1\)\)\+tϕ​\(𝐱1\),\\displaystyle=\\mathbf\{x\}\_\{2\}\\odot\\exp\\big\(s\_\{\\phi\}\(\\mathbf\{x\}\_\{1\}\)\\big\)\+t\_\{\\phi\}\(\\mathbf\{x\}\_\{1\}\),\(23\)wheresϕ​\(⋅\)s\_\{\\phi\}\(\\cdot\)andtϕ​\(⋅\)t\_\{\\phi\}\(\\cdot\)are neural networks that output scale and translation parameters\. This structure produces a triangular Jacobian, allowing the log\-determinant to be computed efficiently:

log⁡\|det∂𝐲∂𝐱\|=∑jsϕ​\(𝐱1\)j\.\\log\\left\|\\det\\frac\{\\partial\\mathbf\{y\}\}\{\\partial\\mathbf\{x\}\}\\right\|=\\sum\_\{j\}s\_\{\\phi\}\(\\mathbf\{x\}\_\{1\}\)\_\{j\}\.\(24\)Because of this triangular Jacobian structure, RealNVP scales efficiently with both the input dimensionality and the number of coupling layers\.

For anomaly detection, the flow assigns lower likelihood to samples that deviate from the learned nominal distribution\. The corresponding negative log\-likelihood \(NLL\) anomaly score is

𝒜​\(𝐱\)=−log⁡pX​\(𝐱\),\\mathcal\{A\}\(\\mathbf\{x\}\)=\-\\log p\_\{X\}\(\\mathbf\{x\}\),\(25\)where higher values indicate lower probability under the learned density and therefore greater deviation from nominal behavior\. In our experiments, the RealNVP model is trained and evaluated with respect to its ability to detect anomalies, using average precision, computed as the area under the precision\-recall curve \(PR\-AUC\), and area under the receiver operator characteristics \(ROC\-AUC\) curve\.

### 3\.4Hybrid Latent\-Structural Fusion \(HLSF\)

Tensor factorization and normalizing flows capture complementary notions of normality\. CP\-APR models higher\-order relational structure through a low\-rank Poisson factorization, whereas normalizing flows perform flexible density estimation over continuous representations\. To the best of our knowledge, prior work has not combined these approaches for cyber anomaly detection\. We therefore propose Hybrid Latent\-Structural Fusion \(HLSF\), which applies flow\-based density estimation to latent representations derived from CP\-APR and combines the resulting anomaly scores\.

HLSF first uses the fitted CP\-APR model to construct an event\-level latent representation\. Given the fitted model

Θ=\{A\(1\),…,A\(D\),γ\},\\Theta=\\\{A^\{\(1\)\},\\ldots,A^\{\(D\)\},\\gamma\\\},\(26\)each observed tensor entry indexed by

𝐢=\(i1,…,iD\)\\mathbf\{i\}=\(i\_\{1\},\\ldots,i\_\{D\}\)\(27\)is mapped to a feature vector by concatenating the corresponding rows of the learned factor matrices:

𝐱~​\(𝐢\)=\[log⁡\(Ai1,:\(1\)\+ϵ\),…,log⁡\(AiD,:\(D\)\+ϵ\)\]∈ℝD​R\.\\tilde\{\\mathbf\{x\}\}\(\\mathbf\{i\}\)=\\Big\[\\log\(A^\{\(1\)\}\_\{i\_\{1\},:\}\+\\epsilon\),\\ldots,\\log\(A^\{\(D\)\}\_\{i\_\{D\},:\}\+\\epsilon\)\\Big\]\\in\\mathbb\{R\}^\{DR\}\.\(28\)Here,ϵ\>0\\epsilon\>0is a small constant used to avoid undefined logarithms\. The resulting feature vector has dimensionalityD×RD\\times R, becauseRRlatent factor values are extracted from each of theDDtensor modes\.

Returning to the example in Figure[1](https://arxiv.org/html/2607.18479#S2.F1), aD=3D=3entry representing useri1i\_\{1\}authenticating from source devicei2i\_\{2\}to destination devicei3i\_\{3\}is represented by concatenating the CP\-APR latent factor row for that user, the latent factor row for that source device, and the latent factor row for that destination device\. Thus, the raw sparse tensor entry𝒳i1,i2,i3\\mathcal\{X\}\_\{i\_\{1\},i\_\{2\},i\_\{3\}\}is transformed into a dense latent representation𝐱~​\(i1,i2,i3\)\\tilde\{\\mathbf\{x\}\}\(i\_\{1\},i\_\{2\},i\_\{3\}\)that summarizes the learned behavioral factors associated with each entity in the event\.

The transformed representations are used as inputs to the RealNVP normalizing flow\. The flow estimates the density

pflow​\(𝐱~\)=pZ​\(fϕ​\(𝐱~\)\)​\|det\(∂fϕ∂𝐱~\)\|\.p\_\{\\mathrm\{flow\}\}\\left\(\\tilde\{\\mathbf\{x\}\}\\right\)=p\_\{Z\}\\left\(f\_\{\\phi\}\\left\(\\tilde\{\\mathbf\{x\}\}\\right\)\\right\)\\left\|\\det\\left\(\\frac\{\\partial f\_\{\\phi\}\}\{\\partial\\tilde\{\\mathbf\{x\}\}\}\\right\)\\right\|\.\(29\)Unlike the Poisson likelihood, which evaluates whether an observed count is compatible with the learned low\-rank tensor structure, the flow density evaluates whether the event’s latent representation lies in a high\- or low\-density region of the learned behavioral representation space\. Since the flow is trained on compact latent representations rather than directly on the full tensor space, the additional computational cost is substantially smaller than performing density estimation over all possible tensor entries\.

The flow\-based anomaly score for an event is the negative log\-likelihood of its latent representation:

sflow​\(𝐢\)=−log⁡pflow​\(𝐱~​\(𝐢\)\)\.s\_\{\\mathrm\{flow\}\}\(\\mathbf\{i\}\)=\-\\log p\_\{\\mathrm\{flow\}\}\\big\(\\tilde\{\\mathbf\{x\}\}\(\\mathbf\{i\}\)\\big\)\.\(30\)The CP\-APR score in Equation \([17](https://arxiv.org/html/2607.18479#S3.E17)\) and the flow score in Equation \([30](https://arxiv.org/html/2607.18479#S3.E30)\) are first z\-score normalized using validation data\. The final HLSF anomaly score is then computed as

shybrid​\(𝐢\)=α​sCP​\(𝐢\)\+\(1−α\)​sflow​\(𝐢\),α∈\[0,1\]\.s\_\{\\text\{hybrid\}\}\(\\mathbf\{i\}\)=\\alpha s\_\{\\text\{CP\}\}\(\\mathbf\{i\}\)\+\(1\-\\alpha\)s\_\{\\text\{flow\}\}\(\\mathbf\{i\}\),\\qquad\\alpha\\in\[0,1\]\.\(31\)The fusion weightα\\alphacontrols the relative contribution of the structural CP\-APR score and the latent density score\. We selectedα\\alphausing validation data by evaluating several candidate values\. Becauseα=0\.5\\alpha=0\.5consistently achieved strong performance across datasets, equal weighting was used in all reported experiments\.

The two components therefore capture distinct but complementary signals\. CP\-APR identifies events that deviate from the learned relational structure of the sparse tensor, while the normalizing flow identifies events whose latent representations occupy low\-density regions of the learned behavioral manifold\. By combining these sources of information, HLSF can detect both structurally anomalous events and events that appear structurally plausible but exhibit unusual latent behavioral characteristics\. In the following section, we compare CP\-APR, RealNVP, and HLSF across the experimental datasets\.

## 4Dataset and Experimental Setup

In this section, we describe the datasets used to evaluate the proposed method and the experimental setup used to compare CP\-APR, RealNVP, and HLSF\.

### 4\.1Dataset & Tensors

Table 1:LANL Authentication dataset attribute counts and selected days for dataset splits\. The table summarizes the number of users, source computers, destination computers, benign events, anomalous events, and day ranges used for training, validation, combined training\-validation, and testing\.Table 2:Tensor statistics for each LANL dataset, including tensor dimensions, sparsity, decomposed rank, and benign and anomalous event counts as tensor entries𝒳i\\mathcal\{X\}\_\{\\textbf\{i\}\}in the test set\. The LANL tensors span large, high\-dimensional spaces, but only a very small fraction of entries are nonzero, making sparse tensor representations memory efficient despite the large nominal tensor sizes\. The event counts also illustrate the severe class imbalance in the test set, where anomalous events are rare relative to benign events, creating a needle\-in\-a\-haystack detection setting\.We evaluate the methods on six cyber tensors constructed from the Unified Host and Network Dataset introduced by\[[45](https://arxiv.org/html/2607.18479#bib.bib14)\]\. The dataset contains authentication activity collected at LANL and includes red\-team activity in which user credentials were compromised\. In this setting, an anomalous event corresponds to a successful authentication by a red\-team actor using a compromised user account\. This produces a highly imbalanced anomaly\-detection problem in which anomalous events are rare relative to benign authentication events\.

The authentication records are represented as sparse, nonnegative count tensors\. A transaction dataset can be tensorized as

𝒳∈ℝ≥0I1×I2×⋯×IN,\\mathcal\{X\}\\in\\mathbb\{R\}\_\{\\geq 0\}^\{I\_\{1\}\\times I\_\{2\}\\times\\cdots\\times I\_\{N\}\},where each mode corresponds to an attribute of the event, such as*user*,*source device*,*destination device*,*hour*,*day*, or authentication*status*\. The goal of anomaly detection is to assign an anomaly score to tensor entries, where larger scores indicate more suspicious behavior\. In this paper, tensor entries are binary: an entry value of 1 indicates that at least one corresponding event occurred, while an entry value of 0 indicates that the event combination was not observed\.

The six tensors used in the experiments increase in dimensionality and behavioral specificity\. TheUser–Source\(US\) tensor records whether a user authenticated from a source device\. TheUser–Destination\(UD\) tensor records whether a user authenticated to a destination device\. TheUser–Source–Destination\(USD\) tensor captures the joint relationship among users, source devices, and destination devices\. TheUser–Source–Destination–status\(USDs\) tensor additionally includes whether the authentication attempt succeeded or failed\. TheUser–Source–Destination–Hour–status\(USDHs\) tensor further incorporates the hour of day, and theUser–Source–Destination–Hour–Day–status\(USDHDs\) tensor includes both hour of day and day of week\. Here,Userdenotes the user initiating the logon,Sourcedenotes the device from which the authentication originated,Destinationdenotes the device being authenticated to,Hourdenotes the hour of day from 0 to 23,Daydenotes the day of week, andstatusdenotes whether the logon attempt failed or succeeded\.

Table[1](https://arxiv.org/html/2607.18479#S4.T1)summarizes the train, validation, train\-validation, and test splits used in the experiments\. The training and validation periods contain only benign events, while the test period contains both benign and anomalous events\. The combined train\-validation period is used after model selection to fit the final CP\-APR model before evaluating on the test set\. These split statistics follow the setup used by Eren et al\.\[[20](https://arxiv.org/html/2607.18479#bib.bib8)\]\.

Table[2](https://arxiv.org/html/2607.18479#S4.T2)reports the tensor dimensions, percent of nonzero entries, selected CP\-APR rank, and the number of benign and anomalous tensor entries in the test set\. Although the nominal tensor sizes are very large because the mode sizes multiply across dimensions, only a small fraction of entries are nonzero\. This makes sparse tensor representations memory efficient and motivates the use of sparse tensor factorization methods\. The test\-set counts also show the severe class imbalance of the detection problem, where anomalous entries are rare relative to benign entries\. Additional details on the CP\-APR preprocessing procedure and prior analysis of these tensors are provided by Eren et al\.\[[20](https://arxiv.org/html/2607.18479#bib.bib8)\]\.

### 4\.2Experimental Setup

Table 3:RealNVP normalizing\-flow hyperparameters selected for each LANL tensor dataset using Hyperband tuning\.For CP\-APR, we follow the initialization and rank\-selection procedure used by Eren et al\.\[[20](https://arxiv.org/html/2607.18479#bib.bib8)\]\. CP\-APR models are fit on the training set for ranks from 1 to 100, and the validation log\-likelihood is used to select the best rank\. The selected decomposed ranks for each tensor are reported in Table[2](https://arxiv.org/html/2607.18479#S4.T2)\. After selecting the rank, the training and validation sets are combined to fit the final CP\-APR model\. The learned latent factors are then used to estimate the Poisson rateλi\\lambda\_\{i\}for each test entry, and the Poisson survival function is used to assign a p\-value\-based anomaly score\.

For RealNVP, hyperparameters are selected using Hyperband\[[30](https://arxiv.org/html/2607.18479#bib.bib39)\]\. Hyperband is computationally efficient because it adaptively allocates resources across candidate configurations and terminates poorly performing configurations early\. It combines random search with successive halving, allowing many configurations to be evaluated with small training budgets before increasing resources for the most promising configurations\[[30](https://arxiv.org/html/2607.18479#bib.bib39)\]\. This is well suited for normalizing flows because training can be expensive and the hyperparameter space is high\-dimensional\. The selected RealNVP hyperparameters for each tensor are shown in Table[3](https://arxiv.org/html/2607.18479#S4.T3)\.

During tuning, the RealNVP model is trained on unlabeled data\. Because labeled anomalies are often scarce or unavailable during training, we use a semi\-supervised model\-selection procedure in which the labeled test period is partitioned into validation and fully held\-out test subsets\[[10](https://arxiv.org/html/2607.18479#bib.bib45),[52](https://arxiv.org/html/2607.18479#bib.bib44)\]\. The split is performed temporally so that the validation subset contains anomalies for model selection and the held\-out test subset contains additional anomalies for final evaluation\. Hyperparameter optimization maximizes average precision \(AP\), equivalent to the area under the precision\-recall curve \(PR\-AUC\), on the validation subset\. The best configuration for each dataset is then evaluated on the fully held\-out labeled test subset\.

The same evaluation protocol is used to compare CP\-APR, RealNVP, and HLSF\. CP\-APR provides a structural anomaly score based on the fitted sparse Poisson tensor model, RealNVP provides a latent density score based on negative log\-likelihood, and HLSF combines these two scores after normalization\. This setup enables a direct comparison between tensor\-structural anomaly detection, flow\-based density estimation, and the proposed hybrid method\.

Table 4:Anomaly detection performance across CP\-APR, RealNVP normalizing flows, and the proposed HLSF framework\. The best ROC\-AUC and PR\-AUC score for each tensor dataset is shown in bold\. HLSF provides the strongest overall performance, achieving the best ROC\-AUC on five of the six LANL tensor datasets and the best PR\-AUC on four of the six datasets\. The gains are most pronounced for the higher\-order tensor representations, including USD, USDs, USDHs, and USDHDs, where HLSF consistently improves over both CP\-APR and RealNVP\. The low absolute PR\-AUC values reflect the extreme rarity of anomalous events relative to benign events, underscoring the needle\-in\-a\-haystack nature of the LANL anomaly detection task\.

## 5Results

![Refer to caption](https://arxiv.org/html/2607.18479v1/US_roc.png)a

![Refer to caption](https://arxiv.org/html/2607.18479v1/US_pr.png)b

![Refer to caption](https://arxiv.org/html/2607.18479v1/US_recall.png)c

![Refer to caption](https://arxiv.org/html/2607.18479v1/US_lift.png)d

Figure 2:Method comparisons using ensemble runs of the US dataset for \(a\) ROC, \(b\) precision\-recall, \(c\) recall versus fraction of dataset reviewed, and \(d\) lift versus fraction reviewed\.![Refer to caption](https://arxiv.org/html/2607.18479v1/UD_roc.png)a

![Refer to caption](https://arxiv.org/html/2607.18479v1/UD_pr.png)b

![Refer to caption](https://arxiv.org/html/2607.18479v1/UD_recall.png)c

![Refer to caption](https://arxiv.org/html/2607.18479v1/UD_lift.png)d

Figure 3:Method comparisons using ensemble runs of the UD dataset for \(a\) ROC, \(b\) precision\-recall, \(c\) recall versus fraction of dataset reviewed, and \(d\) lift versus fraction reviewed\.![Refer to caption](https://arxiv.org/html/2607.18479v1/USD_roc.png)a

![Refer to caption](https://arxiv.org/html/2607.18479v1/USD_pr.png)b

![Refer to caption](https://arxiv.org/html/2607.18479v1/USD_recall.png)c

![Refer to caption](https://arxiv.org/html/2607.18479v1/USD_lift.png)d

Figure 4:Method comparisons using ensemble runs of the USD dataset for \(a\) ROC, \(b\) precision\-recall, \(c\) recall versus fraction of dataset reviewed, and \(d\) lift versus fraction reviewed\.![Refer to caption](https://arxiv.org/html/2607.18479v1/USDs_roc.png)a

![Refer to caption](https://arxiv.org/html/2607.18479v1/USDs_pr.png)b

![Refer to caption](https://arxiv.org/html/2607.18479v1/USDs_recall.png)c

![Refer to caption](https://arxiv.org/html/2607.18479v1/USDs_lift.png)d

Figure 5:Method comparisons using ensemble runs of the USDs dataset for \(a\) ROC, \(b\) precision\-recall, \(c\) recall versus fraction of dataset reviewed, and \(d\) lift versus fraction reviewed\.![Refer to caption](https://arxiv.org/html/2607.18479v1/USDHs_roc.png)a

![Refer to caption](https://arxiv.org/html/2607.18479v1/USDHs_pr.png)b

![Refer to caption](https://arxiv.org/html/2607.18479v1/USDHs_recall.png)c

![Refer to caption](https://arxiv.org/html/2607.18479v1/USDHs_lift.png)d

Figure 6:Method comparisons using ensemble runs of the USDHs dataset for \(a\) ROC, \(b\) precision\-recall, \(c\) recall versus fraction of dataset reviewed, and \(d\) lift versus fraction reviewed\.![Refer to caption](https://arxiv.org/html/2607.18479v1/USDHDs_roc.png)a

![Refer to caption](https://arxiv.org/html/2607.18479v1/USDHDs_pr.png)b

![Refer to caption](https://arxiv.org/html/2607.18479v1/USDHDs_recall.png)c

![Refer to caption](https://arxiv.org/html/2607.18479v1/USDHDs_lift.png)d

Figure 7:Method comparisons using ensemble runs of the USDHDs dataset for \(a\) ROC, \(b\) precision\-recall, \(c\) recall versus fraction of dataset reviewed, and \(d\) lift versus fraction reviewed\.All results are reported over 10 ensemble runs for each tensor representation and each method\. Quantities of interest are reported as mean±1​σ\\pm 1\\sigma, corresponding to the variability across ensemble runs shown in Figures[2](https://arxiv.org/html/2607.18479#S5.F2)–[7](https://arxiv.org/html/2607.18479#S5.F7)\. We compare CP\-APR, RealNVP, and the proposed HLSF framework using ROC\-AUC, PR\-AUC, recall as a function of the fraction of the dataset reviewed, and lift as a function of the fraction reviewed\. Table[4](https://arxiv.org/html/2607.18479#S4.T4)summarizes the ROC\-AUC and PR\-AUC values across all methods and tensor representations\. ROC\-AUC evaluates whether anomalous red\-team events are ranked as more suspicious than benign events\. For CP\-APR, this corresponds to assigning lower Poisson survival\-function p\-values to anomalous events\. For RealNVP, this corresponds to assigning larger negative log\-likelihood scores to anomalous latent representations\. HLSF combines both scores after normalization\.

Overall, HLSF achieves the strongest ROC\-AUC performance, obtaining the best ROC\-AUC on all tensors exceptUser–Destination\(UD\)\. The improvement is especially clear for the higher\-order tensors\. On USD, USDs, USDHs, and USDHDs, HLSF consistently improves over both CP\-APR and RealNVP, suggesting that the structural information captured by tensor factorization and the latent\-density information captured by normalizing flows provide complementary anomaly signals\. CP\-APR remains competitive in ROC\-AUC and performs best on UD, which is the least expressive representation considered in this study\.

Precision\-recall performance provides a stricter evaluation in this setting because the data are highly imbalanced\. Although ROC\-AUC values are often high, PR\-AUC remains comparatively low because red\-team events constitute a very small fraction of all observations\. In operational cyber anomaly detection, PR\-AUC is therefore especially important because it reflects the quality of the ranked alert list under severe class imbalance\. RealNVP improves PR\-AUC relative to CP\-APR on most tensors, and HLSF achieves the best PR\-AUC on USD, USDs, USDHs, and USDHDs\. The only exception is UD, where CP\-APR achieves the strongest ROC\-AUC and PR\-AUC\.

Figures[2](https://arxiv.org/html/2607.18479#S5.F2)–[7](https://arxiv.org/html/2607.18479#S5.F7)provide a more detailed comparison of the three methods across four metrics for each tensor representation\. In each figure, panel \(a\) shows ROC performance, panel \(b\) shows precision\-recall performance, panel \(c\) shows recall as a function of the fraction of the dataset reviewed, and panel \(d\) shows lift as a function of the fraction reviewed\. Recall\-versus\-review and lift curves are operationally important because analysts typically investigate only a small fraction of events\. We show the first 20% of the reviewed data because the curves plateau after this range and performance at larger review fractions can be inferred\. Higher early recall and lift indicate that a method identifies more red\-team events while requiring fewer records to be reviewed\.

Figure[2](https://arxiv.org/html/2607.18479#S5.F2)shows results for theUser–Source\(US\) tensor\. HLSF provides the highest ROC\-AUC, while RealNVP achieves the highest PR\-AUC by a small margin\. Both RealNVP and HLSF substantially improve PR\-AUC relative to CP\-APR\. In Figure[2](https://arxiv.org/html/2607.18479#S5.F2)\(b\), CP\-APR achieves high precision for a very small number of top\-ranked anomalies, producing a visually tall curve near the earliest ranks\. However, its precision deteriorates rapidly as recall increases, resulting in a lower overall average precision\. By contrast, RealNVP and HLSF maintain stronger precision over a broader recall range\. Figures[2](https://arxiv.org/html/2607.18479#S5.F2)\(c\) and[2](https://arxiv.org/html/2607.18479#S5.F2)\(d\) show that RealNVP and HLSF also provide stronger early recall and lift at small review fractions, indicating that they retrieve more anomalies when only a small portion of the dataset is inspected\.

Figure[3](https://arxiv.org/html/2607.18479#S5.F3)shows results for theUser–Destination\(UD\) tensor\. Unlike the other tensor representations, CP\-APR outperforms RealNVP and HLSF in both ROC\-AUC and PR\-AUC\. This result suggests that the UD representation does not provide enough contextual structure for the latent density model to improve over the tensor factorization baseline\. The UD tensor preserves only user\-destination relationships and omits source, status, and temporal context\. As a result, the CP\-APR latent representations are less informative for downstream density estimation, limiting the benefit of HLSF\. Even so, Figures[3](https://arxiv.org/html/2607.18479#S5.F3)\(c\) and[3](https://arxiv.org/html/2607.18479#S5.F3)\(d\) show that RealNVP and HLSF remain competitive at very small review fractions, while CP\-APR improves more substantially after approximately 8% of the dataset has been reviewed\.

Figure[4](https://arxiv.org/html/2607.18479#S5.F4)shows that adding source\-destination context produces a clearer benefit for the hybrid approach\. For theUser–Source–Destination\(USD\) tensor, HLSF achieves the highest ROC\-AUC and PR\-AUC and shows stronger early recall and lift than either standalone method\. This indicates that once the tensor representation includes richer relational structure, the CP\-APR factors provide useful latent event representations for RealNVP density estimation\.

Figure[5](https://arxiv.org/html/2607.18479#S5.F5)shows that including authentication status further improves detection performance\. HLSF achieves the strongest ROC\-AUC and PR\-AUC, while RealNVP also substantially improves PR\-AUC relative to CP\-APR\. This pattern suggests that status information provides useful behavioral context that is captured in the CP\-APR latent factors and further exploited by the flow\-based density model\.

Figure[6](https://arxiv.org/html/2607.18479#S5.F6)shows results for the tensor that incorporates hour\-of\-day information\. HLSF again achieves the best ROC\-AUC and PR\-AUC and maintains stronger early retrieval performance in the recall and lift curves\. Adding temporal context helps distinguish routine authentication patterns from unusual behavior, and the hybrid model appears to benefit from this additional structure\.

Figure[7](https://arxiv.org/html/2607.18479#S5.F7)shows results for the highest\-order tensor, which includes user, source, destination, hour, day, and status\. HLSF achieves the strongest overall performance, with the highest ROC\-AUC and PR\-AUC among all methods\. This tensor provides the most detailed behavioral representation, and the results indicate that the proposed hybrid model is especially effective when the tensor contains enough relational and temporal context for both low\-rank structure and latent density information to be informative\.

Taken together, the results show three main patterns\. First, higher\-order tensor representations generally improve anomaly detection because they encode richer behavioral context than lower\-order matrices\. Second, RealNVP often improves PR\-AUC relative to CP\-APR, indicating that density estimation over CP\-derived latent representations can improve early anomaly ranking under severe class imbalance\. Third, HLSF provides the most consistent overall performance, particularly for USD, USDs, USDHs, and USDHDs\. This suggests that Poisson low\-rank structure and latent\-space density capture complementary anomaly signals: events that appear structurally plausible under CP\-APR may still occupy low\-density regions of latent space, while events with unusual relational structure remain detectable through the tensor model\. By combining both views, HLSF yields a more robust ranking of anomalous events than either constituent method alone\.

## 6Conclusions

This work summarizes a novel method for improving anomaly detection in authentication datasets for cybersecurity applications\. We demonstrate that when compared to both CP\-APR and the RealNVP architecture of normalizing flows alone, the Hybrid Latent\-Structural Fusion method \(HLSF\) outperforms the ability to detect anomalies when looking at the receiver operating characteristic \(ROC\), average precision scores \(AP/PR\), and recall and lift budgets as tensor dimensions increase\.\[[20](https://arxiv.org/html/2607.18479#bib.bib8)\]had previously shown that CP\-APR outperformed other state\-of\-the\-art supervised and unsupervised methods for anomaly detection\. We validate their findings that higher\-order representations enhance the detections of anomalies because tensor factorization techniques extract more predictive information over multiple dimensions\[[20](https://arxiv.org/html/2607.18479#bib.bib8)\]\.

Specifically, the performance gains observed for USD, USDs, USDHs, and USDHDs are consistent with the proposed HLSF framework\. As additional tensor modes are incorporated, the latent representations produced by CP\-APR become increasingly informative, providing richer behavioral embeddings for density estimation by the normalizing flow\. The growing advantage of HLSF relative to either constituent method suggests that structural and latent space anomaly signals become increasingly complementary as relational context is added\. Our results ultimately show the expressive power when combining the the latent representation of the tensor provided by normalizing flows with the structural representation provided by CP\-APR\.

The primary limitation of HLSF is that its effectiveness depends on the quality of the underlying tensor factorization\. In low\-dimensional representations such as UD, the latent embeddings may not contain sufficient information for effective density estimation\. Future work should investigate adaptive fusion strategies and richer tensor representations that incorporate additional contextual attributes\. Further work will also evaluate the generalizability of our method to other cyber datasets, as well as other anomaly detection domains\.

## 7Acknowledgments

This manuscript has been approved for unlimited release and has been assigned LA\-UR\-26\-25362\. This research was supported by the Advanced Simulation and Computing program of Los Alamos National Laboratory \(LANL\)\. LANL is operated by Triad National Security, LLC, for the National Nuclear Security Administration of the U\.S\. Department of Energy \(Contract No\. 89233218CNA000001\)\.

## Declaration of competing interest

The authors declare that they have no known competing financial interests or personal relationships that could have appeared to influence the work reported in this paper\.

## References

- \[1\]M\. Adiban, S\. M\. Siniscalchi, and G\. Salvi\(2023\)A step\-by\-step training method for multi generator gans with application to anomaly detection and cybersecurity\.Neurocomputing537,pp\. 296–308\.External Links:ISSN 0925\-2312,[Document](https://dx.doi.org/https%3A//doi.org/10.1016/j.neucom.2023.03.056),[Link](https://www.sciencedirect.com/science/article/pii/S0925231223003065)Cited by:[§2](https://arxiv.org/html/2607.18479#S2.p4.1)\.
- \[2\]A\. Ahmadian and F\. Lindsten\(2021\)Likelihood\-free out\-of\-distribution detection with invertible generative models\.InProceedings of the Thirtieth International Joint Conference on Artificial Intelligence \(IJCAI\-21\),pp\. 2119–2125\.External Links:[Document](https://dx.doi.org/10.24963/ijcai.2021/292)Cited by:[§1](https://arxiv.org/html/2607.18479#S1.p3.1)\.
- \[3\]A\. Ammar and A\. Al Bassam\(2025\-07\)Normalizing\-flow\-based anomaly scoring for intelligent network intrusion detection\.In2025 International Conference on Quantum Photonics, Artificial Intelligence, and Networking \(QPAIN\),Rangpur, Bangladesh\.External Links:ISBN 979\-8\-3315\-9694\-1Cited by:[§2](https://arxiv.org/html/2607.18479#S2.p4.1),[§2](https://arxiv.org/html/2607.18479#S2.p5.1)\.
- \[4\]J\. P\. Anderson\(1980\)Computer security threat monitoring and surveillance\.Technical Report, James P\. Anderson Company\.Cited by:[§1](https://arxiv.org/html/2607.18479#S1.p1.1)\.
- \[5\]A\. Arora and Shantanu\(2022\)A review on application of gans in cybersecurity domain\.IETE Technical Review39\(2\),pp\. 433–441\.External Links:[Document](https://dx.doi.org/10.1080/02564602.2020.1854058),[Link](https://doi.org/10.1080/02564602.2020.1854058),https://doi\.org/10\.1080/02564602\.2020\.1854058Cited by:[§2](https://arxiv.org/html/2607.18479#S2.p4.1)\.
- \[6\]T\. Cao, C\. Huang, D\. Y\.\-T\. Hui, and J\. P\. Cohen\(2020\)A benchmark of medical out\-of\-distribution detection\.arXiv preprint arXiv:2007\.04250\.External Links:[Link](https://arxiv.org/abs/2007.04250)Cited by:[§1](https://arxiv.org/html/2607.18479#S1.p3.1)\.
- \[7\]R\. Chalapathy and S\. Chawla\(2019\)Deep learning for anomaly detection: a survey\.arXiv preprint arXiv:1901\.03407\.External Links:[Link](https://arxiv.org/abs/1901.03407)Cited by:[§1](https://arxiv.org/html/2607.18479#S1.p3.1)\.
- \[8\]C\. I\. Challu, P\. Jiang, Y\. Nian Wu, and L\. Callot\(2022\-28–30 Mar\)Deep generative model with hierarchical latent factors for time series anomaly detection\.InProceedings of The 25th International Conference on Artificial Intelligence and Statistics,G\. Camps\-Valls, F\. J\. R\. Ruiz, and I\. Valera \(Eds\.\),Proceedings of Machine Learning Research, Vol\.151,pp\. 1643–1654\.External Links:[Link](https://proceedings.mlr.press/v151/challu22a.html)Cited by:[§2](https://arxiv.org/html/2607.18479#S2.p1.1)\.
- \[9\]V\. Chandola, A\. Banerjee, and V\. Kumar\(2009\)Anomaly detection: a survey\.ACM Computing Surveys41\(3\)\.External Links:[Document](https://dx.doi.org/10.1145/1541880.1541882)Cited by:[§1](https://arxiv.org/html/2607.18479#S1.p3.1)\.
- \[10\]X\. Chen, R\. Xiao, Z\. Zeng, S\. Zhang, and X\. Du\(2025\)Semi\-supervised anomaly detection via reinforcement learning\-enabled method with causal inference\.Information Sciences719,pp\. 122463\.External Links:ISSN 0020\-0255,[Document](https://dx.doi.org/https%3A//doi.org/10.1016/j.ins.2025.122463),[Link](https://www.sciencedirect.com/science/article/pii/S002002552500595X)Cited by:[§4\.2](https://arxiv.org/html/2607.18479#S4.SS2.p3.1)\.
- \[11\]E\. C\. Chi and T\. G\. Kolda\(2012\)On tensors, sparsity, and nonnegative factorizations\.SIAM Journal on Matrix Analysis and Applications33\(4\),pp\. 1272–1299\.External Links:[Document](https://dx.doi.org/10.1137/110859063),[Link](https://doi.org/10.1137/110859063)Cited by:[§1](https://arxiv.org/html/2607.18479#S1.p2.1),[§3\.2](https://arxiv.org/html/2607.18479#S3.SS2.p1.2),[§3](https://arxiv.org/html/2607.18479#S3.p1.1)\.
- \[12\]J\. M\. Conroy\(2018\)Classification of red team authentication events in an enterprise network\.InMachine Learning and Knowledge Discovery for Cybersecurity,pp\. 179–194\.External Links:[Document](https://dx.doi.org/10.1142/9781786345646%5F009)Cited by:[§1](https://arxiv.org/html/2607.18479#S1.p2.1)\.
- \[13\]D\. E\. Denning\(1987\)An intrusion\-detection model\.IEEE Transactions on Software EngineeringSE\-13\(2\),pp\. 222–232\.External Links:[Document](https://dx.doi.org/10.1109/TSE.1987.232894)Cited by:[§1](https://arxiv.org/html/2607.18479#S1.p1.1)\.
- \[14\]L\. Dinh, D\. Krueger, and Y\. Bengio\(2014\)NICE: non\-linear independent components estimation\.arXiv preprint arXiv:1410\.8516\.External Links:[Link](https://arxiv.org/abs/1410.8516)Cited by:[§1](https://arxiv.org/html/2607.18479#S1.p3.1)\.
- \[15\]L\. Dinh, J\. Sohl\-Dickstein, and S\. Bengio\(2016\)Density estimation using real nvp\.arXiv preprint arXiv:1605\.08803\.External Links:[Link](https://arxiv.org/abs/1605.08803)Cited by:[§1](https://arxiv.org/html/2607.18479#S1.p3.1),[§1](https://arxiv.org/html/2607.18479#S1.p4.1)\.
- \[16\]A\. Dunmore, J\. Jang\-Jaccard, F\. Sabrina, and J\. Kwak\(2023\)A comprehensive survey of generative adversarial networks \(gans\) in cybersecurity intrusion detection\.IEEE Access11\(\),pp\. 76071–76094\.External Links:[Document](https://dx.doi.org/10.1109/ACCESS.2023.3296707)Cited by:[§2](https://arxiv.org/html/2607.18479#S2.p4.1)\.
- \[17\]A\. P\. Durai Pandian\(2024\)Variational autoencoders using convolutional neural network for highly advanced cyber threats\.In2024 IEEE Integrated STEM Education Conference \(ISEC\),pp\. 01–06\.External Links:[Document](https://dx.doi.org/10.1109/ISEC61299.2024.10664944)Cited by:[§2](https://arxiv.org/html/2607.18479#S2.p4.1)\.
- \[18\]M\. E\. Eren, J\. S\. Moore, and B\. S\. Alexandrov\(2020\)Multi\-dimensional anomalous entity detection via poisson tensor factorization\.In2020 IEEE International Conference on Intelligence and Security Informatics \(ISI\),pp\. 1–6\.External Links:[Document](https://dx.doi.org/10.1109/ISI49825.2020.9280524)Cited by:[§2](https://arxiv.org/html/2607.18479#S2.p2.1),[§3](https://arxiv.org/html/2607.18479#S3.p1.1)\.
- \[19\]M\. E\. Eren, J\. S\. Moore, E\. Skau, M\. Bhattarai, G\. Chennupati, and B\. S\. Alexandrov\(2021\)PyCP\_APR\.GitHub\.Note:[https://github\.com/lanl/pyCP\_APR](https://github.com/lanl/pyCP_APR)External Links:[Document](https://dx.doi.org/10.5281/zenodo.4840598)Cited by:[§2](https://arxiv.org/html/2607.18479#S2.p2.1)\.
- \[20\]M\. E\. Eren, J\. S\. Moore, E\. Skau, E\. Moore, M\. Bhattarai, G\. Chennupati, and B\. S\. Alexandrov\(2023\-03\)General\-purpose unsupervised cyber anomaly detection via non\-negative tensor factorization\.Digital Threats: Research and Practice4\(1\),pp\. 1–28\.External Links:[Document](https://dx.doi.org/10.1145/3519602)Cited by:[§1](https://arxiv.org/html/2607.18479#S1.p1.1),[§1](https://arxiv.org/html/2607.18479#S1.p2.1),[Figure 1](https://arxiv.org/html/2607.18479#S2.F1),[§2](https://arxiv.org/html/2607.18479#S2.p2.1),[§3\.2](https://arxiv.org/html/2607.18479#S3.SS2.p2.1),[§3\.2](https://arxiv.org/html/2607.18479#S3.SS2.p3.1),[§3\.2](https://arxiv.org/html/2607.18479#S3.SS2.p4.2),[§3\.2](https://arxiv.org/html/2607.18479#S3.SS2.p4.8),[§3](https://arxiv.org/html/2607.18479#S3.p1.1),[§4\.1](https://arxiv.org/html/2607.18479#S4.SS1.p4.1),[§4\.1](https://arxiv.org/html/2607.18479#S4.SS1.p5.1),[§4\.2](https://arxiv.org/html/2607.18479#S4.SS2.p1.1),[§6](https://arxiv.org/html/2607.18479#S6.p1.1)\.
- \[21\]D\. Goldberg, D\. Nichols, B\. M\. Oki, and D\. Terry\(1992\-12\)Using collaborative filtering to weave an information tapestry\.Commun\. ACM35\(12\),pp\. 61–70\.External Links:ISSN 0001\-0782,[Link](https://doi.org/10.1145/138859.138867),[Document](https://dx.doi.org/10.1145/138859.138867)Cited by:[§1](https://arxiv.org/html/2607.18479#S1.p2.1)\.
- \[22\]D\. Gudovskiy, S\. Ishizaka, and K\. Kozuka\(2022\-01\)CFLOW\-ad: real\-time unsupervised anomaly detection with localization via conditional normalizing flows\.InProceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision \(WACV\),pp\. 98–107\.Cited by:[§1](https://arxiv.org/html/2607.18479#S1.p3.1)\.
- \[23\]C\. Guo, S\. Yang, J\. Cheng, and D\. Zhang\(2025\-08\)A normalizing flow\-based semi\-supervised method for imbalanced network intrusion detection\.International Journal of Computers Communications & Control20\(4\)\.External Links:[Document](https://dx.doi.org/10.15837/ijccc.2025.4.6890)Cited by:[§2](https://arxiv.org/html/2607.18479#S2.p4.1),[§2](https://arxiv.org/html/2607.18479#S2.p5.1)\.
- \[24\]Z\. Hong, Y\. Yue, Y\. Chen, L\. Cong, H\. Lin, Y\. Luo,et al\.\(2024\)Out\-of\-distribution detection in medical image analysis: a survey\.arXiv preprint arXiv:2404\.18279\.External Links:[Link](https://arxiv.org/abs/2404.18279)Cited by:[§1](https://arxiv.org/html/2607.18479#S1.p3.1)\.
- \[25\]Z\. Hu, X\. Zeng, Y\. Li, Z\. Yin, E\. Meng, Z\. Wei, L\. Zhu, and Z\. Wang\(2025\)MSAttnFlow: normalizing flow for unsupervised anomaly detection with multi\-scale attention\.Pattern Recognition161,pp\. 111220\.External Links:ISSN 0031\-3203,[Document](https://dx.doi.org/https%3A//doi.org/10.1016/j.patcog.2024.111220),[Link](https://www.sciencedirect.com/science/article/pii/S0031320324009713)Cited by:[§1](https://arxiv.org/html/2607.18479#S1.p3.1)\.
- \[26\]P\. Kirichenko, P\. Izmailov, and A\. G\. Wilson\(2020\)Why normalizing flows fail to detect out\-of\-distribution data\.InAdvances in Neural Information Processing Systems \(NeurIPS\),Vol\.33,pp\. 20578–20589\.External Links:[Link](https://proceedings.neurips.cc/paper/2020/file/ecb9fe2fbb99c31f567e9823e884dbec-Paper.pdf)Cited by:[§1](https://arxiv.org/html/2607.18479#S1.p3.1)\.
- \[27\]I\. Kobyzev, S\. J\. Prince, and M\. A\. Brubaker\(2020\)Normalizing flows: an introduction and review of current methods\.IEEE Transactions on Pattern Analysis and Machine Intelligence43\(11\),pp\. 3964–3979\.Cited by:[§1](https://arxiv.org/html/2607.18479#S1.p3.1),[§3\.3](https://arxiv.org/html/2607.18479#S3.SS3.p1.1)\.
- \[28\]W\. Lee, T\. H\. McCormick, J\. Neil, C\. Sodja, and Y\. Cui\(2022\)Anomaly detection in large\-scale networks with latent space models\.Technometrics64\(2\),pp\. 241–252\.External Links:[Document](https://dx.doi.org/10.1080/00401706.2021.1952900),[Link](https://doi.org/10.1080/00401706.2021.1952900),https://doi\.org/10\.1080/00401706\.2021\.1952900Cited by:[§2](https://arxiv.org/html/2607.18479#S2.p1.1)\.
- \[29\]S\. Levy and J\. R\. Crandall\(2020\)The program with a personality: analysis of elk cloner, the first personal computer virus\.CoRRabs/2007\.15759\.External Links:[Link](https://arxiv.org/abs/2007.15759),2007\.15759Cited by:[§1](https://arxiv.org/html/2607.18479#S1.p1.1)\.
- \[30\]L\. Li and K\. Jamieson\(2018\)Hyperband: a novel bandit\-based approach to hyperparameter optimization\.Journal of Machine Learning Research18\(185\),pp\. 1–52\.External Links:[Link](http://jmlr.org/papers/v18/16-558.html)Cited by:[§4\.2](https://arxiv.org/html/2607.18479#S4.SS2.p2.1)\.
- \[31\]M\. Momtazpour, J\. Zhang, S\. Rahman, R\. Sharma, and N\. Ramakrishnan\(2015\)Analyzing invariants in cyber\-physical systems using latent factor regression\.InProceedings of the 21th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining,KDD ’15,New York, NY, USA,pp\. 2009–2018\.External Links:ISBN 9781450336642,[Link](https://doi.org/10.1145/2783258.2788605),[Document](https://dx.doi.org/10.1145/2783258.2788605)Cited by:[§2](https://arxiv.org/html/2607.18479#S2.p1.1)\.
- \[32\]E\. Nalisnick, A\. Matsukawa, Y\. W\. Teh, D\. Görür, and B\. Lakshminarayanan\(2019\)Do deep generative models know what they don’t know?\.InInternational Conference on Learning Representations \(ICLR\),External Links:[Link](https://openreview.net/forum?id=H1xwNhCcYm)Cited by:[§1](https://arxiv.org/html/2607.18479#S1.p3.1),[§1](https://arxiv.org/html/2607.18479#S1.p4.1)\.
- \[33\]R\. R\. Nuiaa Al Ogaili, M\. I\. Mahdi, A\. F\. Neamah, S\. A\. A\. Alradha Alsaidi, A\. H\. Alsaeedi, Z\. A\. Dashoor, and S\. Manickam\(2025\)PhishNetVAE cybersecurity approach: an integrated variational autoencoder and deep neural network approach for enhancing cybersecurity strategies by detecting phishing attacks\.\.International Journal of Intelligent Engineering & Systems18\(3\)\.Cited by:[§2](https://arxiv.org/html/2607.18479#S2.p4.1)\.
- \[34\]G\. Osada, T\. Takahashi, and T\. Nishide\(2024\-Mar\.\)Understanding likelihood of normalizing flow and image complexity through the lens of out\-of\-distribution detection\.Proceedings of the AAAI Conference on Artificial Intelligence38\(19\),pp\. 21492–21500\.External Links:[Link](https://ojs.aaai.org/index.php/AAAI/article/view/30146),[Document](https://dx.doi.org/10.1609/aaai.v38i19.30146)Cited by:[§1](https://arxiv.org/html/2607.18479#S1.p4.1)\.
- \[35\]G\. Papamakarios, E\. Nalisnick, D\. J\. Rezende, S\. Mohamed, and B\. Lakshminarayanan\(2021\)Normalizing flows for probabilistic modeling and inference\.Journal of Machine Learning Research22\(57\),pp\. 1–64\.External Links:[Link](http://jmlr.org/papers/v22/19-1028.html)Cited by:[§1](https://arxiv.org/html/2607.18479#S1.p3.1),[§3\.3](https://arxiv.org/html/2607.18479#S3.SS3.p1.1)\.
- \[36\]F\. S\. Passino, M\. J\. M\. Turcotte, and N\. A\. Heard\(2020\)Graph link prediction in computer networks using poisson matrix factorisation\.arXiv preprint arXiv:2001\.09456\.External Links:[Link](https://arxiv.org/abs/2001.09456)Cited by:[§1](https://arxiv.org/html/2607.18479#S1.p2.1),[§2](https://arxiv.org/html/2607.18479#S2.p1.1)\.
- \[37\]M\. Price\-Williams, M\. J\. Turcotte, and N\. Heard\(2018\)Time of day anomaly detection\.In2018 European Intelligence and Security Informatics Conference \(EISIC\),pp\. 1–6\.External Links:[Document](https://dx.doi.org/10.1109/EISIC.2018.00009)Cited by:[§2](https://arxiv.org/html/2607.18479#S2.p1.1)\.
- \[38\]J\. Ren, P\. J\. Liu, E\. Fertig, J\. Snoek, R\. Poplin, M\. DePristo,et al\.\(2019\)Likelihood ratios for out\-of\-distribution detection\.InAdvances in Neural Information Processing Systems \(NeurIPS\),Vol\.32\.External Links:[Link](https://papers.neurips.cc/paper/9611-likelihood-ratios-for-out-of-distribution-detection.pdf)Cited by:[§1](https://arxiv.org/html/2607.18479#S1.p4.1)\.
- \[39\]M\. Rudolph, B\. Wandt, and B\. Rosenhahn\(2021\-01\)Same same but differnet: semi\-supervised defect detection with normalizing flows\.InProceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision \(WACV\),pp\. 1907–1916\.Cited by:[§1](https://arxiv.org/html/2607.18479#S1.p3.1)\.
- \[40\]S\. A\. Sayyad\(2024\)Variational autoencoder \(vae\) for anomaly detection in network traffic\.Master’s Thesis,National College of Ireland,Dublin\.External Links:[Link](https://norma.ncirl.ie/8624/)Cited by:[§2](https://arxiv.org/html/2607.18479#S2.p4.1)\.
- \[41\]J\. Serrà, D\. Álvarez, V\. Gómez, O\. Slizovskaia, J\. F\. Núñez, and J\. Luque\(2020\)Input complexity and out\-of\-distribution detection with likelihood\-based generative models\.InInternational Conference on Learning Representations \(ICLR\),External Links:[Link](https://openreview.net/forum?id=SyxIWpVYvr)Cited by:[§1](https://arxiv.org/html/2607.18479#S1.p3.1),[§1](https://arxiv.org/html/2607.18479#S1.p4.1)\.
- \[42\]M\. S\. Shaikh\(2025\)Generative adversarial networks \(gan\) insights for cyber security applications\.Springer Nature Switzerland,Cham\.External Links:ISBN 978\-3\-031\-81481\-5,[Document](https://dx.doi.org/10.1007/978-3-031-81481-5%5F11),[Link](https://doi.org/10.1007/978-3-031-81481-5_11)Cited by:[§2](https://arxiv.org/html/2607.18479#S2.p4.1)\.
- \[43\]V\. P\. Stepashkina and M\. I\. Hushchyn\(2024\)Prediction of industrial cyber attacks using normalizing flows\.Doklady Mathematics110\(Suppl\. 1\),pp\. S95–S102\.Note:Translated from Doklady Rossiiskoi Akademii Nauk\. Matematika, Informatika, Protsessy Upravleniya, Vol\. 520, No\. 2, pp\. 107–115External Links:ISSN 1064\-5624Cited by:[§2](https://arxiv.org/html/2607.18479#S2.p4.1),[§2](https://arxiv.org/html/2607.18479#S2.p5.1)\.
- \[44\]T\. Taylor, A\. Eleyan, and M\. Al\-Khalidi\(2025\)Using variational autoencoders with machine learning algorithms in cyber security applications\.Artificial Intelligence and Applications3\(4\),pp\. 428–442\.External Links:[Link](https://ojs.bonviewpress.com/index.php/AIA/article/view/4151),[Document](https://dx.doi.org/10.47852/bonviewAIA52024151)Cited by:[§2](https://arxiv.org/html/2607.18479#S2.p4.1)\.
- \[45\]M\. J\. M\. Turcotte, A\. D\. Kent, and C\. L\. Hash\(2017\)Unified host and network data set\.ArXivabs/1708\.07518\.External Links:[Link](https://api.semanticscholar.org/CorpusID:1407948)Cited by:[§1](https://arxiv.org/html/2607.18479#S1.p4.1),[§4\.1](https://arxiv.org/html/2607.18479#S4.SS1.p1.1)\.
- \[46\]M\. J\. Turcotte, J\. Moore, N\. Heard, and A\. McPhall\(2016\)Poisson factorization for peer\-based anomaly detection\.In2016 IEEE Conference on Intelligence and Security Informatics \(ISI\),pp\. 208–210\.External Links:[Document](https://dx.doi.org/10.1109/ISI.2016.7745472)Cited by:[§1](https://arxiv.org/html/2607.18479#S1.p2.1),[§2](https://arxiv.org/html/2607.18479#S2.p1.1)\.
- \[47\]K\. Wang, Z\. Guo, Y\. Mo, Y\. Wang, and X\. Yuan\(2024\)Maximizing anomaly detection performance using latent variable models in industrial systems\.IEEE Transactions on Automation Science and Engineering21\(3\),pp\. 4808–4816\.External Links:[Document](https://dx.doi.org/10.1109/TASE.2023.3302794)Cited by:[§2](https://arxiv.org/html/2607.18479#S2.p1.1)\.
- \[48\]K\. Wang, Q\. Ma, C\. Shen, and J\. Lu\(2025\)Application of uncertainty to out\-of\-distribution detection for autonomous driving perception safety\.IEEE Transactions on Intelligent Transportation Systems26,pp\. 11276–11293\.Cited by:[§1](https://arxiv.org/html/2607.18479#S1.p3.1)\.
- \[49\]J\. Yang, K\. Zhou, Y\. Li, and Z\. Liu\(2024\)Generalized out\-of\-distribution detection: a survey\.International Journal of Computer Vision132,pp\. 5635–5662\.External Links:[Document](https://dx.doi.org/10.1007/s11263-024-02117-4)Cited by:[§1](https://arxiv.org/html/2607.18479#S1.p3.1)\.
- \[50\]L\. Zhang, M\. Goldstein, and R\. Ranganath\(2021\)Understanding failures in out\-of\-distribution detection with deep generative models\.InProceedings of the 38th International Conference on Machine Learning \(ICML\),Proceedings of Machine Learning Research, Vol\.139,pp\. 12427–12436\.External Links:[Link](https://proceedings.mlr.press/v139/zhang21m.html)Cited by:[§1](https://arxiv.org/html/2607.18479#S1.p3.1)\.
- \[51\]Y\. Zhao, Q\. Ding, and X\. Zhang\(2026\)Improving out\-of\-distribution detection in normalizing flows with synthetic outliers\.Neurocomputing677,pp\. 133081\.External Links:ISSN 0925\-2312,[Document](https://dx.doi.org/https%3A//doi.org/10.1016/j.neucom.2026.133081),[Link](https://www.sciencedirect.com/science/article/pii/S0925231226004789)Cited by:[§1](https://arxiv.org/html/2607.18479#S1.p3.1),[§1](https://arxiv.org/html/2607.18479#S1.p4.1)\.
- \[52\]F\. Zhou, G\. Wang, K\. Zhang, S\. Liu, and T\. Zhong\(2023\)Semi\-supervised anomaly detection via neural process\.IEEE Transactions on Knowledge and Data Engineering35\(10\),pp\. 10423–10435\.External Links:[Document](https://dx.doi.org/10.1109/TKDE.2023.3266755)Cited by:[§4\.2](https://arxiv.org/html/2607.18479#S4.SS2.p3.1)\.
- \[53\]Y\. Zhou, X\. Xu, J\. Song, F\. Shen, and H\. T\. Shen\(2025\)MSFlow: multiscale flow\-based framework for unsupervised anomaly detection\.IEEE Transactions on Neural Networks and Learning Systems36\(2\),pp\. 2437–2450\.External Links:[Document](https://dx.doi.org/10.1109/TNNLS.2023.3344118)Cited by:[§1](https://arxiv.org/html/2607.18479#S1.p3.1)\.