SlowGuess/NeurIPS_2023_OCR huggingface dataset:
[1] Y. Mirsky, T. Doitshman, Y. Elovici, and A. Shabtai, "Kitsune: An ensemble of autoencoders for online network intrusion detection," in Annual Network and Distributed System Security Symposium (NDSS), 2018.
[2] R. Tang, Z. Yang, Z. Li, W. Meng, H. Wang, Q. Li, Y. Sun, D. Pei, T. Wei, Y. Xu, and Y. Liu, "Zerowall: Detecting zero-day web attacks through encoder-decoder recurrent neural networks," in IEEE Conference on Computer Communications (INFOCOM), 2020.
[3] C. Fu, Q. Li, M. Shen, and K. Xu, "Realtime robust malicious traffic detection via frequency domain analysis," in ACM SIGSAC Conference on Computer and Communications Security (CCS), 2021.
[4] R. Perdisci, W. Lee, and N. Flamster, "Behavioral clustering of http-based malware and signature generation using malicious network traces," in USEnIX Symposium on Networked Systems Design and Implementation (NSDI), 2010.
[5] E. C. R. Shin, D. Song, and R. Moazzezi, “Recognizing functions in binaries with neural networks,” in USENIX Security Symposium, 2015.
[6] M. T. Ribeiro, S. Singh, and C. Guestrin, "why should i trust you?": Explaining the predictions of any classifier," in ACM SIGKDD International Conference on Knowledge Discovery and Data Mining (KDD), 2016.
[7] S. M. Lundberg and S. Lee, “A unified approach to interpreting model predictions,” in Annual Conference on Neural Information Processing Systems (NeurIPS), 2017.
[8] M. T. Ribeiro, S. Singh, and C. Guestrin, “Anchors: High-precision model-agnostic explanations,” in AAAI Conference on Artificial Intelligence (AAAI), 2018.
[9] W. Guo, D. Mu, J. Xu, P. Su, G. Wang, and X. Xing, “Lemna: Explaining deep learning based security applications,” in ACM SIGSAC Conference on Computer and Communications Security (CCS), 2018.
[10] D. Han, Z. Wang, W. Chen, Y. Zhong, S. Wang, H. Zhang, J. Yang, X. Shi, and X. Yin, “Deepaid: Interpreting and improving deep learning-based anomaly detection in security applications,” in ACM SIGSAC Conference on Computer and Communications Security (CCS), 2021.
[11] netfilter project, "iptables," https://www.netfilter.org/projects/iptables/index.html, 2023.
[12] snort, "Snort ids," https://www-snort.org/, 2023.
[13] G. Xie, Q. Li, Y. Dong, G. Duan, Y. Jiang, and J. Duan, "Mousika: Enable general in-network intelligence in programmable switches by knowledge distillation," in IEEE Conference on Computer Communications (INFOCOM), 2022.
[14] M. W. Craven and J. W. Shavlik, "Using sampling and queries to extract rules from trained neural networks," in International Conference on Machine Learning (ICML), 1994.
[15] O. Bastani, C. Kim, and H. Bastani, "Interpreting blackbox models via model extraction," CoRR, vol. abs/1705.08504, 2017.
[16] A. S. Jacobs, R. Bertiukov, W. Willinger, R. A. Ferreira, A. Gupta, and L. Z. Granville, “Ai/ml for network security: The emperor has no clothes,” in ACM SIGSAC Conference on Computer and Communications Security (CCS), 2022.
Our Goal. We expect the extracted rules to have a high fidelity to the original model, that is, a similar coverage of normal data (i.e., true negative rate), and a similar detection rate of anomalies (i.e., true positive rate). To this end, we formulate our objective as follows:
$$
\underset {\mathcal {C}} {\arg \min } \mathcal {L} _ {\mathcal {X} \sim \mathcal {D}} (\mathcal {C}, f, \varphi) + \mathcal {L} _ {\mathcal {X} \sim \mathcal {D}} (\mathcal {C}, f, \varphi). \tag {9}
$$
$$
\bigcup_ {k = 1} ^ {K} \underset {C _ {k}} {\arg \min } \mathcal {L} _ {\mathcal {X} \sim \mathcal {D} _ {k}} \left(C _ {k}, f, \varphi\right) + \mathcal {L} _ {\mathcal {X} \succ \mathcal {D} _ {k}} \left(C _ {k}, f, \varphi\right), \text {w h e r e} C _ {k} = C _ {k} ^ {I} \wedge C _ {k} ^ {E}. \tag {10}
$$
We give the following lemma equivalent to Proposition 1 and prove it:
Lemma 1.1. If the distribution decomposition rules and the inference boundary rules that minimize the loss on each of the compositional distributions are found, the sum of the minimum losses on each of the compositional distributions can estimate the minimum loss on the overall distribution with a significantly small error  $\psi$ , i.e.,
$$
\begin{array}{l} \min  \mathcal {L} _ {\mathcal {X} \sim \mathcal {D}} (\mathcal {C}, f, \varphi) + \mathcal {L} _ {\mathcal {X} \infty \mathcal {D}} (\mathcal {C}, f, \varphi) \\ = \sum_ {k = 1} ^ {K} \min  \left(\mathcal {L} _ {\mathcal {X} \sim \mathcal {D} _ {k}} \left(C _ {k}, f, \varphi\right) + \mathcal {L} _ {\mathcal {X} \sim \mathcal {D} _ {k}} \left(C _ {k}, f, \varphi\right)\right) + \psi , \tag {11} \\ w h e r e C _ {k} = C _ {k} ^ {I} \wedge C _ {k} ^ {E}, \psi \geq 0. \\ \end{array}
$$
Proof. The sum of the minimum losses on each of the compositional distributions is calculated by an iteratively cumulative process. Let  $L_{j}$  be the sum of the minimum losses on each of the compositional distributions at the  $j$ -th iteration, i.e.,
$$
L _ {j} = \sum_ {k = 1} ^ {j} \min  \left(\mathcal {L} _ {\mathcal {X} \sim \mathcal {D} _ {k}} \left(C _ {k}, f, \varphi\right) + \mathcal {L} _ {\mathcal {X} \sim \mathcal {D} _ {k}} \left(C _ {k}, f, \varphi\right)\right).
$$
Let  $\mathcal{X} \sim \bigcup_{k=1}^{j} \mathcal{D}_k$  represent a variable belonging to any of the compositional distributions  $\mathcal{D}_1, \dots, \mathcal{D}_j$ . We prove the Loop Invariant of  $L_j$  during the iteration, which always satisfies:
$$
L _ {j} = \min  \left(\mathcal {L} _ {\mathcal {X} \sim \bigcup_ {k = 1} ^ {j} \mathcal {D} _ {k}} \left(\bigcup_ {k = 1} ^ {j} C _ {k}, f, \varphi\right) + \mathcal {L} _ {\mathcal {X} \sim \bigcup_ {k = 1} ^ {j} \mathcal {D} _ {k}} \left(\bigcup_ {k = 1} ^ {j} C _ {k}, f, \varphi\right)\right) + \psi . \tag {12}
$$
1) For the first iteration, the equation  $L_{1} = \min \mathcal{L}_{\mathcal{X}\sim \mathcal{D}_{1}}(C_{1},f,\varphi) + \mathcal{L}_{\mathcal{X}\asymp \mathcal{D}_{1}}(C_{1},f,\varphi) + \psi$  obviously holds where  $\psi = 0$ .
2) Suppose the Equation (12) holds at the  $j$ -th iteration. For the  $(j + 1)$ -th iteration, we have the following derivations:
$$
\begin{array}{l} L _ {j + 1} = \sum_ {k = 1} ^ {j + 1} \min  \left(\mathcal {L} _ {\mathcal {X} \sim \mathcal {D} _ {k}} \left(C _ {k}, f, \varphi\right) + \mathcal {L} _ {\mathcal {X} \approx \mathcal {D} _ {k}} \left(C _ {k}, f, \varphi\right)\right) \\ = \min  (\mathcal {L} _ {\mathcal {X} \sim \bigcup_ {k = 1} ^ {j}} \mathcal {D} _ {k}) (\bigcup_ {k = 1} ^ {j} C _ {k}, f, \varphi) + \mathcal {L} _ {\mathcal {X} \sim \bigcup_ {k = 1} ^ {j}} \mathcal {D} _ {k} (\bigcup_ {k = 1} ^ {j} C _ {k}, f, \varphi)) + \psi \\ + \min  \left(\mathcal {L} _ {\mathcal {X} \sim \mathcal {D} _ {j + 1}} \left(C _ {j + 1}, f, \varphi\right) + \mathcal {L} _ {\mathcal {X} \infty \mathcal {D} _ {j + 1}} \left(C _ {j + 1}, f, \varphi\right)\right) \\ = \min  (\mathcal {L} _ {\mathcal {X} \sim \bigcup_ {k = 1} ^ {j + 1} \mathcal {D} _ {k}} (\bigcup_ {k = 1} ^ {j + 1} C _ {k}, f, \varphi) + \mathcal {L} _ {\mathcal {X} \prec \bigcup_ {k = 1} ^ {j + 1} \mathcal {D} _ {k}} (\bigcup_ {k = 1} ^ {j + 1} C _ {k}, f, \varphi)) + \psi \\ + \mathcal {L} _ {\mathcal {X} \sim \bigcup_ {k = 1} ^ {j} \mathcal {D} _ {k} \cap \mathcal {D} _ {j + 1}} (\bigcup_ {k = 1} ^ {j + 1} C _ {k}, f, \varphi) + \mathcal {L} _ {\mathcal {X} \approx \bigcup_ {k = 1} ^ {j} \mathcal {D} _ {k} \cap \mathcal {D} _ {j + 1}} (\bigcup_ {k = 1} ^ {j + 1} C _ {k}, f, \varphi), \\ \end{array}
$$
where  $\bigcup_{k=1}^{j+1} \mathcal{D}_k \cap \mathcal{D}_{j+1}$  represents the overlap area between the conjunction of the compositional distributions  $\bigcup_{k=1}^{j+1} \mathcal{D}_k$  and the  $(j+1)$ -th compositional distribution  $\mathcal{D}_{j+1}$ . Recall the definition of the compositional distributions that a data sample belonging to one compositional distribution has a significantly small probability of belonging to other compositional distributions, meaning that the overlap area between the compositional distributions is significantly small. Therefore, the loss with respect to the overlap area is also significantly small, given the data samples belonging to the area are significantly rare. Let
$$
\psi = \psi + \mathcal {L} _ {\mathcal {X} \sim \bigcup_ {k = 1} ^ {j} \mathcal {D} _ {k} \cap \mathcal {D} _ {j + 1}} (\bigcup_ {k = 1} ^ {j + 1} C _ {k}, f, \varphi) + \mathcal {L} _ {\mathcal {X} \sim \bigcup_ {k = 1} ^ {j} \mathcal {D} _ {k} \cap \mathcal {D} _ {j + 1}} (\bigcup_ {k = 1} ^ {j + 1} C _ {k}, f, \varphi),
$$
and we can get the final result of  $L_{j + 1}$
$$
L _ {j + 1} = \min  (\mathcal {L} _ {\mathcal {X} \sim \bigcup_ {k = 1} ^ {j + 1} \mathcal {D} _ {k}} (\bigcup_ {k = 1} ^ {j + 1} C _ {k}, f, \varphi) + \mathcal {L} _ {\mathcal {X} \nsim \bigcup_ {k = 1} ^ {j + 1} \mathcal {D} _ {k}} (\bigcup_ {k = 1} ^ {j + 1} C _ {k}, f, \varphi)) + \psi ,
$$
which proves the loop invariant in Equation (12). At the last iteration when  $j = K$ , as the overall distribution is equal to the conjunction of the compositional distributions, i.e.,  $\mathcal{D} = \bigcup_{k=1}^{K} \mathcal{D}_k$ , we prove Equation (11) holds and Lemma 1.1 is correct.
A.2 Implementation of Our Method
Our implementation is primarily based on PyTorch (version 1.12.1) for the deep learning models, such as AE and VAE. Additionally, for data preprocessing, feature engineering, and model evaluation, we employ the versatile machine learning library scikit-learn (version 1.1.3). Python (version 3.9.15) serves as the programming language for our implementation, providing a rich ecosystem of libraries and tools for data manipulation and experiment orchestration.
Our experiments were conducted on a server equipped with the Intel(R) Xeon(R) Gold 5218 CPU @ 2.30GHz (128GB RAM) and the GeForce RTX 2080 Super (8GB VRAM). Note that GPU is only used for the training of some DL-based anomaly detectors (e.g., AE, VAE), and our rule extraction method only requires the use of CPU.
A.3 Implementation of Baselines
In this section, we delve into the details of the baseline methods used for evaluation in our experiments, focusing on their implementation in the context of globally explaining unsupervised anomaly detection. The five baseline methods include Rule extraction from UAD, Estimated Greedy Decision Tree (EGDT), Trustee, Local Interpretable Model-agnostic Explanations (LIME), and a Knowledge Distillation (KD) method.
A.3.1 Rule Extraction from UAD
The Rule Extraction from UAD method was initially designed for one-class support vector machines (OCSVM) but is applicable to various types of unsupervised anomaly detection models. It uses feature scaling, anomaly detection, and clustering to produce rules from the input parameters  $X$ ,  $\ln$ ,  $lc$ ,  $d$ ,  $m$ ,  $t$ , where  $X$  refers to the input data frame with the features,  $\ln$  is a list with the numerical columns,  $lc$  is a list with the categorical columns,  $d$  is a dictionary with the hyperparameters for OCSVM (kernel type, upper bound on the fraction of training errors and a lower bound of the fraction of support vectors,  $\nu$ , and the kernel coefficient,  $\gamma$ ).  $m$  is a variable that defines the type of cluster algorithm, and  $t$  is a variable that specifies the type of approximation for obtaining the hypercubes.
The approach for obtaining rules depends on the type of cluster algorithm used and can involve iterative clustering and splitting of data points. The choice of kernel type in the OCSVM model can influence the rules obtained, with RBF kernel tending to enclose inliers and leave outliers outside, eventually forming hypercubes to represent the rules.
A.3.2 Estimated Greedy Decision Tree (EGDT)
The EGDT method constructs a decision tree that approximates the black-box model. The algorithm generates new training data by actively sampling new inputs and labeling them with a black-box
model. Based on these training data, EGDT constructs the decision tree  $T^{*}$  of size  $k$  similar to CART, in a greedy manner and is pruned to improve interoperability. The algorithm takes into account the distribution of points that are routed to each leaf node in the decision tree to ensure that the label assigned to each leaf node is accurate.
A.3.3 Trustee
The model-agnostic DT extraction method Trustee, specifically focuses on interpreting security applications. The core idea is to construct an interpretable decision tree by minimizing the difference between the black-box model and the surrogate model. The algorithm creates several high-fidelity decision trees by executing an outer loop  $S$  times and an inner loop  $N$  times. In an unsupervised setting, we treat the predictions of the black-box model as pseudo-labels and employ the same process as for the supervised case.
A.3.4 Local Interpretable Model-agnostic Explanations (LIME)
By learning an interpretable model locally around the prediction, LIME explains the predictions of any classifier in an interpretable and faithful manner. LIME uses locally weighted square loss and an exponential kernel to approximate the black-box model. LIME trains a sparse linear model on the local dataset to explain the prediction. The feature importance scores assist in identifying the most important features that contribute to the prediction, which can be used to gain insights into the model and improve LIME's trustworthiness.
In addition, this paper proposes "SP-LIME" that selects a set of representative instances with explanations to address the "trusting the model" problem, via submodular optimization. The submodular pickup method is used to select a subset of instances that are representative of the entire dataset while reducing redundancy. This method allows for a global perspective to ascertain trust in the model, in addition to explaining individual predictions. LIME can therefore be transformed from a local method to a global method using the submodular pickup method, which makes it more useful in real scenarios.
The implementation of LIME in unsupervised settings is fairly straightforward. For a given input instance, we create a set of perturbations, predict their labels using the black-box model, and then fit an interpretable model (usually a linear model) on this newly created dataset to approximate the local decision boundary.
A.3.5 Knowledge Distillation (KD) Method
In order to achieve interpretability and effectiveness simultaneously, the KD method proposes a knowledge distillation-based decision tree extension, called rectified decision trees (ReDT), and tries to transfer the knowledge from a complex model (the teacher) to a simpler one (the student). ReDT extends the splitting criteria and the ending condition of the standard decision trees to allow training with soft labels distilled from a well-trained teacher model while preserving the deterministic splitting paths. They recommend a jackknife-based distillation to obtain soft labels, which does not require backpropagation for the student model, and analyze the effectiveness of adopting soft labels instead of hard ones empirically and theoretically. In an unsupervised scenario, we employ the anomaly scores produced by the teacher model as pseudo-labels. The student model is then trained to imitate these scores. This method's limitation lies in its strong reliance on the correctness of the teacher model's scores.
We need to note that these unsupervised adaptations of the baselines essentially introduce a supervised flavor to the learning process, with the black-box model's predictions serving as the pseudo-labels. It is an important observation that these methods do not inherently work in an unsupervised manner and their application in such settings might be unreliable depending on the accuracy of the black-box model's predictions. On the other hand, our proposed method is fundamentally designed for unsupervised settings, making it a more trustworthy choice for real-world applications.
It is also worth mentioning that, except for  $\mathbf{LIME}^3$  and Trestee<sup>4</sup> which use open-source code, all other baseline methods were implemented in Python using the scikit-learn library, with default
<sup>3</sup>https://github.com/marcotcr/lime
<sup>4</sup>https://github.com/TrusteeML/trustee
parameters unless specified otherwise. Hyperparameters were set based on the initial grid search and then manually fine-tuned.
A.4 More Details in Experiments
A.4.1 More Metrics
We also examine other metrics in addition to the metrics given in the main article.
- Precision (PR) measures the proportion of correctly predicted positive instances out of the total instances anticipated as positive. It indicates the model's ability to avoid false positives. A lower rate of false positives is indicated by precision values that are higher.
- Correctness (CR) evaluates the precision of the explanations provided by the IC-Tree method with respect to the underlying model. This can be quantified using the Jaccard similarity index, defined as  $Cr = \frac{r}{N}$ , where  $r$  is the number of correct outputs by the model.
- Recall (RC) also known as sensitivity or true positive rate, quantifies the proportion of correctly predicted positive instances out of all actual positive instances. It indicates the model's ability to identify all positive instances without missing any. Higher recall values indicate a lower rate of false negatives. It can be quantitatively assessed by the ratio  $RC = \frac{TP}{TP + FN}$ .
- F1 score (F1) is the harmonic mean of precision and recall combined into a single statistic, which provides a balanced measure of both precision and recall, capturing the overall performance of the model.
Besides the aforementioned metrics, in fact, we believe that the most appropriate way to assess "human's trust in anomaly detection models" should be employing a trial in which human security experts are invited to inspect the rules of interpretation, measuring the consistency of understanding. Yet this is not an easy task to conduct: to eliminate the subjective influence of each expert, enough people must be invited to participate in the trial, which can be somewhat difficult to carry out. Despite the intrinsic limitations of lacking such a metric, it is indeed a common practice to employ only those commonly used metrics (e.g., fidelity, F1 score) even in research works accepted to top venues, which may reveal an obvious gap between "research" and "practice".
The specifics of the performance metrics of our proposed method in comparison to other baseline methods, including UAD, EGDT, Trustee, LIME, and KD, are demonstrated in Table 7 and Table 8. In addition, we analyze the effects of several hyperparameters on our methodology, as shown in Table 9. The performance metrics are categorized based on different anomaly detection algorithms: Autoencoder (AE), Variational Autoencoder (VAE), One-Class SVM (OCSVM), and Isolation Forest (iForest) are shown in Table 8. Precision (PR), Correctness (CR), Recall (RC), and F1 score (F1) are evaluated in this paper. Notably, our proposed method achieves the highest performance in almost all categories, with a few significant instances where it ties with the best performer. This indicates the comprehensive superiority of our approach, as it consistently delivers exceptional performance across a wide range of models and metrics.
Table 7: Performance of rule extraction on CIC-IDS2017 dataset.
Method	AE	VAE	OCSVM	iForest
PR	CR	RC	F1	PR	CR	RC	F1	PR	CR	RC	F1	PR	CR	RC	F1
UAD	0.5896	0.0659	0.1027	0.175	0.6104	0.0874	0.1126	0.1901	0.9912	0.067	0.999	0.9951	0.9993	0.067	0.9292	0.963
EGDT	0.5729	0.4729	0.4729	0.8924	0.5613	0.873	0.6864	0.5462	0.9904	0.9244	0.8553	0.9179	0.9942	0.9402	0.9938	0.994
Trustee	0.8651	0.4255	0.6482	0.4255	0.812	0.831	0.7655	0.828	0.856	0.5509	0.6664	0.7494	0.954	0.4842	0.8676	0.8952
LIME	0.9998	0.7614	0.7569	0.8616	0.7091	0.7331	0.8641	0.9003	0.9892	0.741	0.9263	0.9567	0.8641	0.8305	0.8305	0.8751
KD	0.5141	0.5141	0.6871	0.5835	0.5612	0.1618	0.4516	0.5623	0.9157	0.3564	0.3748	0.5319	0.7863	0.067	0.8465	0.8461
Ours	0.9994	0.9488	0.9457	0.9718	0.9633	0.9633	0.9633	0.9645	0.9351	0.933	1	0.9653	0.933	0.9933	0.9354	0.9841
This extensive evaluation underlines the robustness and effectiveness of our method compared to established baselines. The superior performance, across varying metrics and under different detection models, signifies its potential as a versatile solution for rule extraction in the TON-IoT dataset. This
Table 8: Performance of rule extraction on TON-IoT dataset.
Method	AE	VAE	OCSVM	iForest
PR	CR	RC	F1	PR	CR	RC	F1	PR	CR	RC	F1	PR	CR	RC	F1
UAD	0.0058	0.085	0.1257	0.182	0.6153	0.216	0.3546	0.6845	0.9847	0.0501	0.0526	0.0998	0.9949	0.0501	0.1776	0.3014
EGDT	0.9749	0.9749	0.9854	0.9749	0.7659	0.7659	0.7856	0.8621	0.9979	0.8136	0.651	0.788	0.9964	0.6408	0.7977	0.886
Trustee	0.8475	0.4776	0.5465	0.4776	0.3809	0.3809	0.8416	0.3809	0.8482	0.7932	0.4147	0.557	0.9548	0.2338	0.6576	0.7525
LIME	0.7651	0.7664	0.6845	0.7561	0.9035	0.9053	0.8486	0.9053	0.7896	0.0749	0.7815	0.7512	0.7987	0.8354	0.8861	0.8354
KD	0.5765	0.0824	0.6548	0.3554	0.5648	0.0594	0.5486	0.5461	0.8966	0.0505	0.1004	0.1805	0.5154	0.0501	0.8456	0.8465
Ours	0.9992	0.9992	0.9345	0.9801	0.9992	0.9992	0.9861	0.9814	0.9345	0.9499	1	0.9743	0.9933	0.9933	0.9456	0.9968
demonstrates the practical utility of our proposed method, especially in a diverse and dynamic domain such as IoT, which could significantly benefit from such adaptable and high-performing solutions.
As for the baseline methods, while some of them can achieve acceptable fidelity for certain models, they fail to maintain such results on other models, indicating that they cannot achieve qualified model-agnostic global explanations for unsupervised models. Further, most of their recall scores cannot meet the requirement of using their rules for online defense. It is mainly because these methods either require labeled data to determine the boundary between normal and abnormal (e.g., EGDT and LIME), or need sufficient outliers in the training data (e.g., UAD and KD), which can be unavailable in many security applications. In contrast, our method eliminates these requirements by the IC-Tree and CBE algorithm that explores the decision boundary in an unsupervised manner, and meanwhile realizes a high detection rate of anomalies.
Lastly, it is worth noting that while our method exhibits superior performance, we do not imply the obsolesteness of other methods. Every method has its strengths and use cases, thus the selection of the method should always be context-dependent. Future work could involve fine-tuning our method to improve its performance further or be applied to other domains.
A.4.2 More Clarification of Human Understanding
We present a step-by-step description of obtaining the content in Table 4 in an ideal experiment, which takes data points as input and then shows the steps that come up with the explanations:
1. For a reported anomaly  $\pmb{x}$ , we use the IC-Tree to pinpoint the rule of normality that judges  $\pmb{x}$  as anomalous. It is realized by inputting  $\pmb{x}$  into the tree and recursively finding the leaf node. The rule is denoted by  $C_{\pmb{x}}$ .
2. For each constraint of features in  $C_x$ , we compare the corresponding feature value of  $x$  with the range of the constraint.
3. For the feature values outside the range of the constraints, the Rules of Normality, Feature Values, and Feature Meaning (i.e., the three columns in Table 4) along with the raw data sample will be sent as the explanation to the security expert for further analysis.
4. The security expert will analyze the data sample to determine the type of attack (i.e., the Attack column in Table 4) and give her/his understanding of the important attributes that make her/him identify the attack (i.e., the Human Understanding column in Table 4).
5. If there is a huge gap between the provided explanation and expert understanding, it indicates that the anomaly detector is not trustworthy. The security expert may conduct further actions to improve the detector, such as retraining, fine-tuning, or reconsidering feature selection.