MERGE: Multi-Scenario Embedding for Robust Generalization in Network Anomaly Detection

Modern computer networks are increasingly complex, heterogeneous, and exposed to a growing spectrum of cyber threats, making robust network anomaly detection (NAD) a critical challenge. While machine learning (ML) has significantly improved detection accuracy, most existing NAD systems remain tightly coupled to the datasets on which they are trained, leading to poor generalization across diverse infrastructures and evolving traffic patterns. To fill this gap, we present MERGE, a NAD solution that shifts from dataset-specific optimization toward architectural unification. We address dataset heterogeneity by training a single unified autoencoder and a shared classifier that operate across multiple data sources, establishing a universal latent space and decision boundary for anomaly detection. Unlike standard approaches that rely on environment-specific calibration, MERGE leverages eXplainable AI (XAI) as an architectural optimization tool to identify a universal feature set. This enables distilling multiple specialized pipelines into a single, compact model instance. Experimental results over three benchmarks (enterprise, IoT, and hybrid traffic) demonstrate that MERGE achieves near-parity with dataset-specific baselines, exhibiting only a 1-2% difference in F1-Score. Crucially, this unification reduces model management overhead and parameter footprint by a factor of M (where M is the number of datasets), providing a scalable and interpretable solution for large-scale network environments.