  With the rapid development of the Internet, various types of anomaly traffic
are threatening network security. We consider the problem of anomaly network
traffic detection and propose a three-stage anomaly detection framework using
only normal traffic. Our framework can generate pseudo anomaly samples without
prior knowledge of anomalies to achieve the detection of anomaly data. Firstly,
we employ a reconstruction method to learn the deep representation of normal
samples. Secondly, these representations are normalized to a standard normal
distribution using a bidirectional flow module. To simulate anomaly samples, we
add noises to the normalized representations which are then passed through the
generation direction of the bidirectional flow module. Finally, a simple
classifier is trained to differentiate the normal samples and pseudo anomaly
samples in the latent space. During inference, our framework requires only two
modules to detect anomalous samples, leading to a considerable reduction in
model size. According to the experiments, our method achieves the state
of-the-art results on the common benchmarking datasets of anomaly network
traffic detection. The code is given in the
https://github.com/ZxuanDang/ATD-via-Flows.git
