Factor-structured anomaly detection: an interpretable AI framework for anomaly behavioral analysis

Network Intrusion Detection Systems (NIDS) are increasingly required not only to identify malicious traffic, but also to provide defensible evidence explaining why an alert was generated. This paper presents DLAD-SSL, a semi-supervised, factor-structured anomaly-detection framework that learns benign network-flow behavior using a factor-aligned Variational Autoencoder (VAE), self-supervised learning objectives, temporal context modeling, and calibrated anomaly scoring. The proposed framework organizes the latent representation into three operational traffic factors: protocol compliance, temporal behavior, and payload/volume behavior. This structure enables block-level attribution by associating each alert with the behavioral factor that deviates most strongly from the calibrated benign distribution. Under CICIDS2017 evaluation protocol, the DLAD-SSL Frozen Head achieved precision of 0.9953, recall of 0.9539, F1-score of 0.9741, false positive rate (FPR) of 0.48%, and area under the receiver operating characteristic curve (AUC-ROC) of 0.9966. Although fully supervised tree-based classifiers achieved higher closed-set classification scores when trained on the same labeled pool, DLAD-SSL substantially outperformed unsupervised anomaly-detection baselines, including a standard VAE, autoencoder, Isolation Forest, and One-Class Support Vector Machine (One-Class SVM). Moreover, the frozen latent representation alone achieved F1-score of 0.9553 and AUC-ROC of 0.9892, confirming that benign-only factor-aligned training produced discriminative latent features. A representative Distributed Denial-of-Service (DDoS) case study further showed that the payload/volume factor was the dominant contributor to the alert, demonstrating the operational value of the proposed attribution mechanism.