Dissect Black Box: Interpreting for Rule-Based Explanations in Unsupervised Anomaly Detection
Authors: Yu Zhang
Ruoyu Li
Nengwu Wu
Qing Li
Xinhan Lin
Yang Hu
Tao Li
Yong Jiang
Venue: NeurIPS 2024 poster (2024)
Keywords: Machine Learning
Anomaly Detection
Rule Extraction
Primary area: machine_learning_for_other_sciences_and_fields

Abstract: In high-stakes sectors such as network security, IoT security, accurately distinguishing between normal and anomalous data is critical due to the significant implications for operational success and safety in decision-making. The complexity is exacerbated by the presence of unlabeled data and the opaque nature of black-box anomaly detection models, which obscure the rationale behind their predictions. In this paper, we present a novel method to interpret the decision-making processes of these models, which are essential for detecting malicious activities without labeled attack data. We put forward the Segmentation Clustering Decision Tree (SCD-Tree), designed to dissect and understand the structure of normal data distributions. The SCD-Tree integrates predictions from the anomaly detection model into its splitting criteria, enhancing the clustering process with the model's insights into anomalies. To further refine these segments,  the Gaussian Boundary Delineation (GBD) algorithm is employed to define boundaries within each segmented distribution, effectively delineating normal from anomalous data points. At this point, this approach addresses the curse of dimensionality by segmenting high-dimensional data and ensures resilience to data drift and perturbations through flexible boundary fitting. We transform the intricate operations of anomaly detection into an interpretable rule's format, constructing a comprehensive set of rules for understanding.  Our method's evaluation on diverse datasets and models demonstrates superior explanation accuracy, fidelity, and robustness over existing method, proving its efficacy in environments where interpretability is paramount.

Dissect Black Box: Interpreting for Rule-Based Explanations in Unsupervised Anomaly Detection
Yu Zhang ::l Ruoyu Li Nengwu Wu, Qing Lift Xinhan Lin', Yang Hu Tao Li Yong Jiang Shanghai Artificial Intelligence Laboratory, China: *Peng Cheng Laboratory, China
College of Computer Science and Software Engineering, Shenzhen University, China
Tsinghua University, China; "Tsinghua Shenzhen International Graduate School, China; Hunan University of Science and Technology, China
yu tt--zaann23mmaass..mmmm tsinghua. edu. 1iruoyu0401@oute @outlook. com; wnw@mail. hnust edu. acc.cllac..o 1 liq@pcl.as ac. cn; iu_yang@tsinghua edu. cn; tlee@hnust. edu. cn; linxinhan@pjlasn lab org. cn; j jiangydsz. tsinghua, edu. cn;
Abstract
high-stakes sectors such as network security, 1oT security, accurately distin- guishing between normal and anomalous data is critical due to the significant implications for operational success and safety in decision-making. The complex- ity is exacerbated by the presence of unlabeled data and the opaque nature of black-box anomaly detection models, which obscure the rationale behind their pre- dictions. In this paper, we present novel method to interpret the decision decision-making processes of these models, which are essential for detecting malicious activities without labeled attack data. We put forward the Segmentation Clustering Decision Tree (CDD-Tree), designed to dissect and understand the structure of normal data distributions. The SCD-Tree integrates predictions from the anomaly detection model into its splitting criteria, enhancing the clustering process with the model's 's insights into anomalies. To further refine these segments, the Gaussian Boundary Delineation (GBD) algorithm is employed to define boundaries within each seg- mented distribution, effectively delineating normal from anomalous data points. At this point, this approach addresses the curse of dimensionality by segmenting sigh-dimensional data and ensures resilience to data variability and perturbations through flexible boundary fitting. We transform the intricate operations of anomaly detection into an interpretable rule's format, constructing a comprehensive rules for understanding. Our method's 's evaluation on diverse datasets and models demonstrates superior explanation accuracy, fidelity, and robustness over existing method, proving its efficacy in environments where interpretability is paramount.
of
Introduction
Anomaly detection, particularly in its unsupervised form, holds significant promise by leveraging advanced machine learning to identify outliers or unusual patterns without labeled datasets [I] in the ML and DL domains. However, this promise is often hindered by the "black-box" nature of many models, which, while adept at detecting anomalies, provide little insight into the "why" behind their judgments (2). This opacity poses substantial barrier to trust between Al systems and human experts, fostering uncertainty and potentially leading to delays or errors, thereby undermining the reliability and efficiency these systems are designed to enhance
'These authors contributed equally this work. 1 Corresponding author: Qing Li.
38th Conference on Neural Information Processing Systems (NcurIPS 2024).

---

To address the trust requirements in high-stakes sectors like cybersecurity 4 ST rule- sale- surrogate models [6] 7 have been proposed to provide interpretability for data by approximating their decision- making processes, such as decision trees g g
and linear models [10], which are effective in simpler scenarios. However, these surrogate models often struggle to imitate the complexity of black-box models, especially with high-dimensional data, leading to oversimplified explanations that may not faithfully represent the original model's behavior.
Curse of Dimensionality. The challenge of scalability in the context of high-dimensional data is a critical concern in anomaly detection [ [2], where the "curse of dimensionality" can significantly obscure meaningful patterns and exacerbate computational demands. In addition, data that appears to belong to a single category might actually embody several underlying distributions, which may cause model misunderstandings. Higher dimensional spaces are inherently sparse, and the volume of the space grows exponentially with dimension, leading to difficulties in clustering, and discretizing the space and processing it in a distribution space is by far the best solution.
Inresilliance to data variability. Resilience data variability and perturbations is crucial aspect of robust anomaly detection. While some methods [13 [4] often lack the flexibility to adapt data patterns to the flexible distribution of data, and they determine boundaries that are too "hard" adequately fit the expanded boundaries to predictions of unknown data, which is essential for maintaining the reliability and robustmess of anomaly detection systems in dynamic environments.
Our work revolves around extracting rules that can globally explain the model's decisions which is done through two main contributions: distribution decomposition rules via the Segmentation Clustering Decision Tree (SCD-Treee and the Gaussian Boundary Delineation (GBD) algorithm. The process begins with the creation of SCD-Tree, an unsupervised tree model that uses the block-box model's predictions as criteria for splitting the data into clusters, each representing a segment of the data distribution. This approach helps manage the curse of dimensionality by breaking down the high-dimensional space into more manageable segments. Within these segmented areas, GBD offers a significant advantage by focusing on the most relevant dimensions model the decision boundary. This allows the GBD algorithm to simulate boundaries effectively, ensuring resilience against data variability and perturbations, and achieving robust interpretation.
In the experimental phase, we meticulously tested the capabilities of our model, focusing on its ability to autonomously extract rules from black-box anomaly detection models and evaluate its accuracy in detecting anomalies. This work focuses on structured, tabular data, which is prevalent in many high-stakes domains such network and IoT security. To rigorously assess the effectiveness and reliability of our approach, we conducted extensive comparisons against five established baseline anomaly detection models across four diverse datasets from network security, IoT security, and application security, focusing on structured, tabular data prevalent in these high-stakes domains.. The results demonstrate that our method not only excels in extracting interpretable and precise rules from black-box models but also outperforms in terms of fidelity, robustness, and detection rates (true positive and true negative rates). This performance underscores the utility of our model in enhancing trust in automated systems and confirms its suitability for high-stakes environments where high accuracy in anomaly detection paramount for effective deployment.
2 Related Work
Unsupervised anomaly detection does not require labeled data, making it highly adaptable and efficient for detecting novel or unknown types of anomalies in environments, which includes methods
such as clustering- -based approaches [15] like K-means [16] 17 and DBSCAN [18] 19], which assume
normal data points cluster together while anomalies do not. Isolation Forest [20, 21). stands out by isolating anomalies instead of profiling normal data, providing scalability and efficiency. More recently, neural network-basse methods, especially autoencoders [22 23), have gained prominence due to their ability to learn complex, non-linear data representations. However, they are often criticized for their "black-box" nature, which impedes the interpretability of their decisions (24..
Model Interpretability. Enhancing the transparency of anomaly detection models involves tech- niques ranging from model-agnostic methods like LIME (25) and SHAP 26 to model-specific
adjustments that incorporate interpretability directly into the model architecture 2 28 29 and decision trees or simpler linear models, are trained to approximate the predictions of the original complex models. These explanatory models using local post-hoc techniques [30 31 attempt to gen-

---

eralize across different models by approximating the decision function of the black-box model with inherently interpretable structures. However, the ability of these explanatory models to generalize effectively across different types of black-box models can vary considerably. The complexity of the black-box model's 's structure and the data handles can limit the fidelity of such explanations, leading to oversimplification that fail to capture crucial nuances in decision-making.
In addition, these models often assume linear relationships between features 32
33 which is rarely
the case in complex datasets with non-linear interactions, leading them to potentially oversimplify
data complexities and result in incomplete or inaccurate interpretations 34] They are fundamentally
simplifications of the original models, and as such, they may not capture all the nuances of complex decision boundaries effectively, which may lead to a loss of fidelity, where the surrogate model's predictions do not consistently align with those of the black-box model [35].
Curse of dimensionality. The "curse of dimensionality" in high-dimensional data significantly complicates anomaly detection by obscuring meaningful patterns and relationships. Recent research has proposed various strategies mitigate its effects, including feature selection [36] 37 38] and extraction [39] techniques that identify the most informative features of the dataset. In addition, various learning techniques such as t-SNE and UMAP have been used to visualize and understand complex data structures. While these methods are invaluable for simplifying high-dimensional data into more manageable forms, they can sometimes strip away nuances of the original data structure. This oversinplification can result in the loss of information that is critical to accurately identifying anomalies, as certain anomalies may only be detectable in the original nigh-dimensional space.
Dynamic Updateability. Additionally, these surrogate models 13 40 [4]
often assume static data distributions and fail adapt to the dynamic nature of real-world data, where new anomaly patterns can emerge over time. This assumption limits their effectiveness in continuously evolving environments, where the ability to adapt and update explanations in response new data is crucial.
In summary, despite black-box models offer significant potential in unsupervised anomaly detection, their application is hindered by lack of interpretability. reliance on oversimplified surrogate models, and challenges in handling dynamic, ligh-immensional data. Addressing these limitations necessitates the development of advanced explanation methodologies that maintain robustness to original models' decisions while providing clear, comprehensive, and adaptable insights into their operational logic.
3 Overview
3.1 Problem Definition
Definition 1 (Unsupervised Anomaly Detection Framework): Let X C Cd assume unlabeled data sampled from a stationary distribution D, representing a d-dimensional feature space. A vector x E X represents a feature vector with components x = (#1...., Id). The detection model is tasked with estimating a density function p(x), which approximates the true underlying distribution p(x). Anomalies are detected based on the density threshold yo, defined as: p(x) > 4 = "Anomaly". which can identify data points that deviate significantly from established patterns of "normality'.
Threshold (>00) serves as the critical boundary between normal and abnormal data, deliberately set above zero to account for the inherent false positive rates often minimized but inevitable in anomaly detection models as discussed prevailing studies All 42 43). This setup acknowledges occasional data contamination and errors, ensuring the model's robustness to small proportion of noisy data without relying on ground truth labels for training.
Definition 2 RRule-Based Interpretative Model): To elucidate the decision decision-making process of the anomaly detection model, we construct rule-based interpretative model. This model partitions the data space into a series of interpretable regions using a set of logical rules.
A rule set R R2 R2. ... Rg is formed by a conjunction of linear inequalities where each rule At captures specific characteristics of the data distribution as understood by surrogate model f. Each rule R is a logical conjunction of conditions on the feature dimensions, defined as R = A ay (. spi), where 3) E S, > is relational operator, comparing the scaled feature value 8t 24 to the threshold sat. The rule is satisfied if all inequalities hold true for every dimension.
Rule Construction:
3

---

Surrogate Model Definition: To evaluate data point as anomalous if it does not satisfy any rule within R, the surrogate model (xx is constructed from the rule set R: hx(x)) = AnER (2 R). This formulation enables the surrogate model to identify anomalies by their failure to conform to any of the normal profiles described by R.
Our goal: To ensure that the rule set R extracted from the anomaly detection model accurately mirrors the behavior of the underlying model, with an emphasis on the true positive rate and true negative rate. We refine R to minimize the divergence between the predictions of the anomaly detection model and the classifications made by h (x). This is formalized as follows:
mrg L(R, = arg U i=1
Rarroeea)s)) (m;) Anomallyy)
(1)
R
where denotes the indicator function, and C measures the mismatch between model predictions and rule-based classifications over the entire data space.
3.2 Methodology Overview
In addressing the intrinsic complexities of unsupervised anomaly detection, especially in handling high-ddmensional, multimodal data distributions, our methodology embraces divide-and-conquee strategy, tailored to dissect and understand these distributions through robust, structured approach. Leveraging the capabilities of the Segmentation Clustering Decision Tree (Section 4 and Gaussian Boundary Delineation (Section our methodology evolves to refine boundaries.
3.2.1 Multimodal Data and Initial Segmentation
Recognizing the multimodal nature of typical datasets in applications such as network security and healthcare where data points are derived from various normal operations that inherently form distinct clusters in the feature space, which crDeTree achieves the strategic segmentation:
K
arg min (a LXED, (Ra, s. + B LXęD, (Re, J, ()), Where R3 = AND(R), R
(2)
1=1
R4
Here, LXEDE denotes hypercube enclosing the 5th modal cluster's data samples, facilitating initial data categorization and minimizing the loss fxxx JR, for in-distribution points.
3.2.2 Boundary Delineation
maximal normal data while excluding outliers. This step involves dynamically adjusting the decision boundaries within each identified segment using Gaussian Processes model the decision boundaries accurately. The Gaussian Processes provide probabilistic framework that not only defines the boundaries but also quantifies the uncertainty in these boundaries, thereby enhancing the model's interpretative power.
For each using GBD based on subspaces
Finally, we get a comprehensive rule set [R = U RefinedRules (H, D:)] by synthesizing the refined rules from each segment that globally approximates the behavior of the original anomaly detection model across the entire dataset. This synthesized rule set not only ensures high fidelity in anomaly detection but also facilitates deeper understanding of the model's decision-making process, crucial for trust and transparency in critical applications.
3.3 Anomaly detection pipline
As Figure F shows. The initial datasets transformed through normalization and scaling processes to ensure uniformity and mitigate the influence of outlier values.
Unsupervised Tree Segmentation: The SCD-Tree utilizes original detection model outputs to guide its data segmentation process. By integrating anomaly scores (e.g., MSE, Probability) directly into the tree's 's branching logic, the SCD-Tree adapts its segmentation boundaries dynamically, reflecting

---

4 GBD Algorithm
Data process
Anomaly detection model
SCD-Tree
16l TN
Wel
H(M)
2p(1
Gini based on scores
SCD-Tree Splitting
Normalisation
Learning models
Normal data
AE Forest SVM
Neura Networks....
Anomaly Detection System
po
Figure 1: Integrated Anomaly Detection and Interpretation Pipeline Using SCD-Tree and GBD
subtle shifts in data patterns and anomaly distributions. This integration allows the SCD- -rec to partition the dataset into clusters that are homogeneously normal, yet distinct from one another based on the learned anomaly characteristics.
Gaussian Boundary Delineation: Following the data segmentation by the SCD-Tree, the Gaussian Boundary Delineation is employed to define and refine the decision boundaries between identified clusters. This approach uses Gaussian Processes to achieve fine-grained mapping of decision boundaries, accommodating the non-linear and complex nature of the data structures encountered.
Rule Extraction and Interpretation: Once the boundaries are established, the GBD algorithm translates these complex mathematical models into set of clear, interpretable rules. Each rulc delineates conditions under which data points are considered normal, in the subsequent judgment, we only need to judge whether the data meets the RULE criteria for normal data based on the characteristies of the data, if it meets it judged be normal data, otherwise is considered be abnormal data. This offers actionable insights into the underlying decision maaning process of the anomaly detection model.
Proposition. Let X C Rd be a dataset sampled from a stationary distribution D, and let f X {0, 1) be an unsupervised anomaly detection model. There exists rule-based surrogate model hv (x) derived from such that loR maintains high fidelity to f. achieving high true negative rate (TNR) and true positive rate (TPR).
Segmentation Clustering Decision Tree
In the quest to unravel the complex decision-making mechanisms of unsupervised anomaly detection models, our methodology adopts a sophisticated, dual-faceted approach that systematically dissects and models the data distribution D. Recognizing the inherent multimodality and high dimensionality of typical datasets in domains like network security, IoT security, we commence with the Segmentation Clustering Decision Tree partition the feature space into distinct subspaces.
The foundational principle of the SCD-Tree is based on the hypothesis that data points with similar anomaly scores likely share the same operational conditions states. This hypothesis is formalized
5

---

in the tree's splitting criteria, which aim to minimize within- cluster variance of anomaly scores while maximizing between-cluster differences, thus ensuring each cluster is as homogeneous as possible.
Based on this, SCD-Tree extends the CART decision tree 44 by integrating Mlack-model-basee predictions into its decision-making process. Unlike traditional decision trees which rely labeled data for node splitting, the SCD-Tree harnesses the original model outputs and threshold to segment data into coherent subsets that reflect underlying distribution patterns.
Node Splitting. For each node within SCD-Tree, the splitting process is governed by the distribution of anomaly detection model outputs, f(z) across data samples. A node N splits based the criterion that maximizes the difference in model output distributions between subsets, formalized as:
|N [N
|N H(N,) [N]
arg max ((N)
H(N))
where & = (i, sbs) is the splitting condition, Φb being the threshold for feature i, and H represents a homogeneity score based the output of the anomaly detection model:H 2p(1 - p), with pa as the proportion of samples in node N that fall into the k-th output category of the anomaly model.
Termination Criteria. Splitting continues recursively until any of the following conditions is met: i) the node N contains only one sample, ii) the variance in anomaly detection scores within a node is less than or iii) the tree reaches a predetermined maximum depth т.
Distribution Decomposition Rule Extraction. Upon the completion of the SCD-Tree training, the resulting structure facilitates a granular understanding of the data through its segmented distributions, each represented by a leaf node. The transformation of these segments into a set of operational rules provides a systematic method for categorizing new data points based on the learned segments.
For each leaf node, the sequential decisions from the root compile into cohesive rule set, outlining the conditions for data points within the corresponding segment:
R n
{z 9h }
h=1
where Rg denotes the rule set corresponding to the k-th segment. Here, 7 is the depth of the leaf node, indicating the number of conditions (or splits) from the root to the leaf. The variable fn identifies the feature upon which the split is made at the h-th level of the tree, sPn is the threshold value for that split, and o,, represents the relational operator (either "s" for a left split or '>' for a right split).
The culmination of the SCD-Tree training results in multifaceted representation of the data's structure, captured by each leaf node's unique profile, and traversing from the root to specific leaf encapsulates precise rule pathway that partitions the feature space into distinct subspaces Rg.
5 Gaussian Process for Boundary Delineation
Following the creation of these distinct subspaces R3 through the SCD-Trea we employ Gaussian Process for Boundary Delineation within each subspace to meticulously define and refine the decision boundaries, capturing the subtle variations and dynamics of the data to enhance the precision of anomaly detection.
Boundary Estimation Process. Within the Gaussian Process (GP) framework, consider set of data points Xin classified as normal by the SCD-Tree, along with their corresponding scores s. The binary classification outputs are determined by comparing these scores to a predefined threshold Specifically, y defined as y = 1 s; S & (indicating normality) and ys if s; > o (indicating anomaly). This classification serves as input to the GP, which provides a predictive distribution for any new point x" based on these inputs:
p(f(x") ) y.x") = (i(x(x)), oxx))))
(5)
where μ(x) and (x(")) represent the mean and variance of the predictive distribution, respectively, and f(x) GP (m(x), k (x, x').. This probabilistic framework facilitates dynamic assessment of whether new data points conform to the patterns of normality or are indicative of anomalies.
The mean u(x") and variance xx(x)) of this distribution given by:

---

pxxx) =
=k" K o y
(6)
o² ,(x,, xx) k" k"IK の I k
where k is the vector of covariances between x* and each point in Xin. K is the covariance matrix for Xin. which is computed as k( x²) o² d'erp((- -| 2/2
and oz is the noise variance, capturing
inherent data uncertainties.
Defining the Decision Boundaries. The essential step in boundary delineation is to identify the set Ω where (xx) surpasses a predefined threshold 0 (indicating high confidence in normality) and (x) minimal (indicating low uncertainty). These criteria ensure robust and precise boundary definition:
(x E R p(x)
((x) <c}
Once j(x)) and (xx are obtained, we use the data points X2 within the subspace Då and the extended set of data points X sampled around it to capture boundary variations. The final boundary can be obtained from the following equation:
R2 = -
- o2(x))), -22 mar(j((())) + +x((x)
(8)
Rule Acquisition and Interpretation. For each dimension j of the feature space, rule is derived based on these boundaries: Rg : Brww.j I J. < Onigh.j. where Blow.j and Onigh.j are the lower and upper bounds of the decision boundary for feature j. computed from the GP outputs. Finally, the rules R2 are then synthesized into a comprehensive rule set R, defined as: R = No= - Ry. which globally approximates the behavior of the original anomaly detection model across the entire dataset. This rule set classifies data point the patterns of normality as modeled by the Gaussian Processes within their respective subspaces.
normal if it satisfies all individual feature rules, thus aligning with
Rule Refinement. To ensure that the rules are robust and reflect the subtle nuances of the data, they are continuously refined based on feedback from ongoing anomaly detection operations. This dynamic refinement process utilizes new data to adjust the thresholds Onww.j and Ohigh.j. thereby adapting the rule set R. to evolving data conditions and anomaly patterns.
Evaluation
6.1 Experimental Setup
Datasets. We employ four distinct datasets to evaluate our method across various security-related domains. These datasets include Malicious and Benign Webpages [45] for web security, KDDCup [46 for classic network intrusion scenarios
[47). CIC-IDS [48] for modern network attacks, and TON-IoT [4),, which integrates IoT and traditional network data.
These tabular format datasets are systematically partitioned into training. validation, and testing segments following an 8:1:1 ratio split. For the calibration of our anomaly detection models' hyperparameters, only normal instances from these datasets are utilized. The performance metries, specifically the accuracy for each model, are comprehensively documented in Table
Black Models. For model comparison, we utilize four established unsupervised models: Autoen- coders (AE (41) and Variational Autoencoders (VAE (50)) detect anomalies through reconstruction errors; One- Class SVM (OCSVM (5T) isolates normal data in feature space; and Isolation For- est (IForest (52)) efficiently identifies outliers. These models facilitate robust assessment of our method's effectiveness across diverse data scenarios. In addition to these classical methods, more advanced models such as Variational Recurrent Autoencoder (VRAE [53). Deep Autoencoding Gaussian Mixture Model (DAGMM [54] are evaluated. These advanced models facilitate a robust
Table 1: The accuracy for four anomaly detection models applied to datasets in security.
No.
Dataset
#Domain
Nfeatures
#Normal
#Attack
AE
VAE
OCSVM
ioorest
Webpuges TON-1oT
Web Security
10
98%.
25
0.9999
0.9975
0.998
0.9925
ToT Security
30
25.71%
74.29%
0.9839
0.9886
0.9957
0.9943
kddcaps9
Cybersccurity
41
19.86%
80.14%
0.9895
0.944
0.9415
0.9905
CTC CIC-Ibs
Cybersecurity
80
70.45%
29.55%
0.9438
0.9251
0.9706
0,9972
7

---

assessment of our method's 's effectiveness across diverse data scenarios, demonstrating its applicability not only to traditional but also tfate-ofthh-aa art techniques in anomaly detection.
Baseline Models. We assess the effectiveness of our approach against several established explanation methods serving as baselines. These include direct rule extraction from unsupervised anomaly detection models (UAD) [55], knowledge distillation techniques (KD) [56] that simplify complex models, and global explanation methods such as greedy decision trees (EGDT) g which approximate black-box model decision processes. We also compare with Local Interpretable Model-agnostic Explanations (LIME) [25], providing local insights aggregated into global interpretations, and Trustee 19], which synthesizes local explanations into cohesive global understanding.
Metrics. Our evaluation employs suite of metrics inspired by [57]: Fidelity, Robustness, both True Positive Rate and True Negative Rate. Their meanings and specific calculations are written in appendix B These metrics provide comprehensive framework for comparing the explanatory power and reliability of different approaches, ensuring that our findings are robust and applicable to real-world anomaly detection scenarios.
6.2 Model Interpreting Rationale
To demonstrate the interpretability and effectiveness of our proposed method, we examine rules extracted from a well-trained VAE model applied to different datasets, focusing on Denial of Service (DoS) attacks. As Table indicates, Tndie@indicssss, the rule "ps_fwd_roo www_aar__ > 101.68" with an attack value of 57.33 indicates that normal traffic has higher variance in forward packet sizes compared to DoS traffic, which uses consistent sizes to overwhelm targets. Similarly, "0.949 < ial_max < 7.278" with an attack value of 0.00063 shows very short intervals between packets, characteristic of DoS attacks. These rules encapsulate DoS behaviors, providing a clear rationale for the model's decisions. Such interpretable rules enhance model transparency, enabling security professionals to understand and respond to cyber threats effectively. This interpretability crucial in high-stakes environments, ensuring trust and facilitating timely, accurate threat detection.
Table 2: Examples of Explanation for Different Types of Cyber Attacks
Attack
Rules of Normality
Attack Value
Feature Meaning
Homan Understanding
ps If faod_vrr
var > 101.68
57,33
Variance forwarl packet size
Do5 wttucks use comvistent small packets high rates,
DoS
0.949 < iat_maz < 7.278
0.00663
Maximum inter arrival time
They also show minimal ineevval between packets and high packet counts overn helm the network.
fwd_counnt 124.371
0.00226
Forward packet count
MITM
pa 67248.055
count 92.529
82.0
12
IP packet count connection
Variance packet
MITM attneks often incresse packet count and show packer
high
nanipulation.
bal_be__oo 1.1130
Maximam inter-arrival time
Ransomwaue attacks exhibit inegular
Ramsomware
iat bud min
fund_mnn $ 0.0262
0.37
Minimum inter-amival time
trafiic potterns and niiid bursis communication.
Phishing Web
ull_suseer 1.1038
htlpa & 0.797
1.0
URL grouping
Uses HTTPS
Phishing websites often group similar and use HTTPS to appear secure and deceive users.
6.3 Precision in Interpretative Output
In our comprehensive assessment, illustrated in Table ??, we employed four established anomaly detection models-IFoo Tree, and rigorously tested them across four distinct datasets from different security domains. The results demonstrate that our model exhibits robust performance and high effectiveness in identifying anomalies across all domains, with nearly all robustness (RB) and fidelity (FD) metrics surpassing 90%. Characterized by strong discriminative power and fidelity, our findings underscore our model's adaptability and confirm its suitability for diverse anomaly detection tasks in various contexts.
OCSVM, AE, and VAE as pre-configured "black models" for our SCD-
In Tables we evaluate our model with five baselines, it consistently outperforms established baseline methods across a variety of metrics: it achieves True Positive Rates (TPR) ranging from 91.5% to 100%, and True Negative Rates (TNR) as high as 99.62%, showcasing its exceptional capability in accurately identifying both normal and anomalous instances. Moreover, the fidelity (FD) and robustness (RB) metrics impressively exceed 90% in most scenarios, with perfect scores (100%) observed in settings involving the KddCup99 and Web datasets, emphasizing the model's reliable interpretative output under varying operational conditions, proving its resilience to data variability and perturbations. This comprehensive performance underscores the SCD- Tree's 's efficacy and adaptability,
8

---

making it a prime candidate for deployment in high-stakes environments where accuracy, consistency, and interpretability are crucial. More results for metrics are in the appendix.
Table 3: Performance of rule extraction.
(1) Baselines use different Black Model on CIC-IDS Dataset
AE
VAE
OCSVM
iForest
Method
TPR
TNR
RB
TPR
TNR
RB
TNR
FD
TPR
TNR
FD
UAD
0.0008
0.9786
0.1322
0.4997
0.0213
0.9988
0.1444
0.4834
0.9972
0.9884
0.997
0.9997
0.0008
1.00
0.1264
0.7009
BGDT
0.9715
0,9715
0,4803
0.9995
0,0799
0.995 0.0799
1.00
1.00
0.00
1.00
1.00
0. 0.8982
0.9392
0,8982
0.9818
Trustee
0,3853
0.998
0,4873
0.6408
0,0621
0.9972 0.0621
0.9929
0.9993
1.00
0.5389
0.6109
0.9805
0.4485
0.4535
0.581
LIME
0.9065
0.9786
0.9203
1.00
0.9063
0.9786 0.941
0.9996
0.0021
0.9005
0.013
1.00
0.8243
0.9913
0.891
1.00
0.479
1.00
0,5778
0.9988
0.1024
0.9995
0.2001
0.9827
0.3096
1.00
0.3621
0.9998
0.0008
1.00
0.1264
0,7009
Ours
0,9937
0.9879
0,9899
0.8979
0.9667
0.9962
0.9704 0.9329
0.9917
0.9966
0.9956
Baselines VAE Black Model Actoss Multiple Security Datasets
CIC IDS
KrdCCup99
TON IuT
Webpuges
Method
TPR
TNR
FD
RB
TPR
TNR
FD
RB
TPR
TNR
FD
RB
TPR
TNR
FD
RB
UAD
0.0213
0.9988
0.1444
0.4834
0.0119
0.0025
0.0119
1.00
0.0004
0.9998
0.0485
0.4997
0.0769
0.00
0.0769
1.00
EGDT
0.0799
0.995
0.0799
1.00
0,9874
0.988
0.9874
1.00
0.8048
0.9767
0.8145
1.00
0.8378
1.00
0.8378
1.00
0,0621
0,9972
0.9929
0,2586
1.00
0.79
0.9998
1.00
0.8435
0.9995
0.9995
LIME
0,9063
0.9786
0.941
0.9996
0.9292
0.9808
0.9292
1.00
0.3994
0.9643
0.3994
1.00
0.2051
0.7909
0,2051
1.00
KD
0.1024
0.9995
0.2001
0.9827
0.0006
0.9973
0.0006
1.00
0.3627
0.9997
0.3627
1.00
0.0167
0.92
0.08
1.00
Ours
0.915
0.9899 0.9453
0.8979
0.9971
0.9604
0.9913
0.9983
1.00
0.9847
0.9936
0.9197
0.898
1.00
0.998
1.00
6.4
Ablation Experiment
The ablation experiments were designed to systematically evaluate the impact of the Gaussian Boundary Delineation (GBD) on the performance of unsupervised anomaly detection models. The experiment compared models both with and without the incorporation of GBD, when combined with GBD, exhibited a notable increase in true positive rate, rising from 0.9422 to 0.9979, marking an improvement of 0.0557. This significant enhancement indicates that GBD effectively refines decision boundaries, leading to more accurate anomaly detection. Similarly, the fidelity metric improved from 0.928 to 0.9978, underscoring the GBD's role in aligning the model's decision decision-making process with ground truth data, thereby enhancing the reliability of the model's interpretations.
Table 4: The impact of GBD component on performance.
Method
TP
FP
FD
VAE
0.9422
0,0035
0,928
VAE+GBD
0.9979(1 0.0557)
0.01
0.9978(1 0.0698)
AE
0.8122
0.0035
0.8428
AE+GBD
0.9356(1 0.1234)
0.0063
0.9431 0.1003)
0.10003)
Kmeans
0.9872
0.3456
6.5 Complexity Analysis
We systematically examined the impact of varying the number of features on training time. Our experimental results show clear increase in training time the number of features rises. This can be attributed to the growing complexity of the model, as each additional feature expands the data space, necessitating the model learn higher-dimensionall representation. Consequently, this dimensionality increase leads to more parameters that require optimization, thereby extending the training duration. These findings are consistent with existing literature on model complexity and feature dimensionality. Specific experimental results and explanations are written in appendix (...2
However, our model's prediction time remains very fast because it relies evaluating set of pre- defined rules derived from the tree's decision paths and boundary delineations, making the process computationally inexpensive and highly efficient for real-time applications.
The complexity of our algorithms hinges on two main components. The SCD-Tree involves sorting operations at each node, which possess a computational complexity of O(d N log N) per feature.

---

Additionally, GBD uses Gaussian Processes, which have a cubic complexity O(k - n²) due to matrix inversion, with n indicating the data points per segment. Although this complexity might seem high. it's manageable since GP only operates within defined subspaces(Dp)) post-SCID-Trre segmentation. Post-training, anomaly detection is conducted using rule set with fixed complexity of O([C) d), where [CI is the rule count and d is the feature size, optimizing both speed and resource in practice.
7 Conclusion and Future Work
In addressing the global interpretability challenges of unsupervised anomaly detection, this paper integrates a novel Gaussian Boundary Delineation with Segmentation Clustering Decision Tree to refine and explain the decision-making process of black-box models. This model provides probabilistic assessment of boundary points, enhancing the interpretative fidelity by quantifying the uncertainty in boundary delineation. The culmination of this process synthesizes comprehensive rule set, offering granular yet global perspective on the model's decision-making process, thereby enhancing transparency and trust in automated anomaly detection systems.
Building on the foundational work in model interpretability. future research should pivot towards developing adaptive algorithms capable of dynamically refining and correcting decision processes in real-time, which reduce error rates in black-box models by continuously learning from new data. Additionally, integrating interpretable anomaly detection methods into distributed edge systems, promises to decentralize and accelerate decision-maie making processes. This could be particularly transformative in sectors where timely, accurate decisions are crucial. Exploring the synergy between lightweight, interpretable models and existing infrastructure could also pave the way for more robust and scalable anomaly detection systems that are both efficient and easier to audit.
Acknowledgments and Disclosure of Funding
This work is supported by the National Key R&D Program of China under grant No. 20227D0162300, the Major Key Project of PCL under grant No. PCI.2033A06-4, the National Key Research and Development Program of China under grant No. 2022YFB3105000, and the Shenzhen Key Lab of Software Defined Networking under grant No. ZDSYS20
References
[1] Rui Jiang, Yijia Xue, and Dongmian Zou. Interpretabilit-awware industrial anomaly detection using autoencoders. IEEE Access, 2023.
[2] Ruoyu Li, Qing Li, Yu Zhang, Dan Zhao, Xi Xiao, and Yong Jiang. Genos: General in- network unsupervised intrusion detection by rule extraction. In JEEE INFOCOM 2024 -EEE Conference on Computer Communications, pages 561-570, 2024.
[3] Chun-Hao Chang. Jinsung Yoon, Sercan Ô. Arik, Madeleine Udell, and Tomas Pfister. Data- efficient and interpretable tabular anomaly detection. In Proceedings of the 29th ACM SIGKDD Conference on Knowledge Discovery and Data Mining, KDD 2023, Long Beach, CA, USA, August 60, 2023, pages 190-201. ACM, 2023.
[4] Jingyu Xiao, Zhiyao Xu, Qingsong Zou, Qing Li, Dan Zhao, Dong Fang. Ruoyu Li, Wenxin Tang, Kang Li, Xudong Zuo, Penghui Hu, Yong Jiang, Zixuan Weng, and Michael R. Lyu. Make your home safe: Time-aware unsupervised user behavior anomaly detection in smart homes via loss-guided mask. In Proceedings of the 30th ACM SIGKDD Conference on Knowledge Discovery and Data Mining, page 3551-3562, 2024.
[5] Qingsong Zou, Qing Li, Ruoyu Li, Yucheng Huang, Gareth Tyson, Jingyu Xiao, and Yong Jiang. lotbeholder: A privacy snooping attack user habitual behaviors from smart home wi-fi traffic. Proceedings of the ACM on Interactive, Mobile, Wearable and Ubiquitous Technologies, 7(1):1-26, 2023.
[6] Xiubin Zhu, Dan Wang, Witold Pedryez, and Zhiwu Li. Fuzzy rule-based local surrogate models for black-box model explanation. IEEE Trans. Fuzzy 3166: 2023.
10

---

[7] Martin Flusser and Petr Somol. Efficient anomaly detection through surrogate neural networks. Neural Comput. Appl., 34(23))00911200500 2022.
[8] Osbert Bastani, Carolyn Kim, and Hamsa Bastani. Interpreting blackbox models via model extraction. CoRR, Abs/1705.00804 2017.
[9] Arthur S. Jacobs, Roman Beltiukov, Walter Willinger, Ronaldo A. Ferreira, Arpit Gupta, and Lisandro Z. Granville. Ai/ml for network security: The emperor has no clothes. In ACM SIGSAC Conference on Computer and Communications Security (CCS), 2022.
[10] Jerome H. Friedman and Bogdan E. Popescu. Predictive learning via rule ensembles. The Annals of Applied Statistics, 2(3), 2008.
[11] Hongzuo Xu, Guansong Pang, Yijie Wang, and Yongjun Wang. Deep isolation forest for anomaly detection. IEEE Trans. Knowl. Data Eng., 35((2))12511-1264, 2023.
[12] Xin Zhang, Pingping Wei, and Qingling Wang. A hybrid anomaly detection method for high dimensional data. PeerJ Comput. Sei., 9:e1199, 2023.
[13] Ruoyu Li, Qing Li, Yu Zhang, Dan Zhao, Yong Jiang, and Yong Yang. Interpreting unsupervised anomaly detection in security via rule extraction. In Advances in Neural Information Processing Systems, 2023.
[14] Yicheng Zhou, Zhenzhou Lu, Jinghan Hu, and Yingshi Hu. Surrogate modeling of high- dimensional problems via data-driven polynomial chaos expansions and sparse partial least square. Computer Methods in Applied Mechanics and Engineering. 364:1 12906, 2020.
[15] Pavol Mulinka, Pedro Casas, Kensuke Fukuda, and Lukas Kencl. HUMAN hierarchical clus- tering for unsupervised anomaly detection & interpretation. In 1 11th International Conference on Network of the Future. IEEE, 2020.
[16] Muhammad Imran Faizi and Syed Muhammad Adnan. Improved segmentation model for melanoma lesion detection using normalized cross-correlation-bane k-means clustering. IEEE Access, 12:20753-200 -07766, 2024.
[17] Meenal Jain, Gagandeep Kaur, and Vikas Saxena. A k-means clustering and SVM based hybrid concept drift detection technique for network anomaly detection. Expert Syst. Appl., 193:116510, 2022.
[18] Martin Ester, Hans-Peter Kriegel, Jörg Sander, and Xiaowei Xu. A density- based algorithm for discovering clusters in large spatial databases with noise. In Proceedings of the Second International Conference on Knowledge Discovery and Data Mining (KDD-96). Portland, Oregon, USA, pages 226-2226222222222222 22111,,,1111 1996.
[19] Mohamed Limam El Hairach, Insaf Bellamine, and Amal Tmiri. Anomaly detection in PV modules: A comparative study of dbscan, k-means, isolation forest, and LOF. In 7th IEEE Congress on Information Science and Technology, CiSt 2023, Agadir Essaouira, Morocco. December 16-22, 2023, pages 135-139, 2023.
[20] Fei Tony Liu, Kai Ming Ting, and Zhi-Hua Zhou. Isolation forest. In IEEE International Conference on Data Mining (ICDM), 2008
[21] Hongzuo Xu, Guansong Pang, Yijie Wang, and Yongjun Wang. Deep isolation forest for anomaly detection. CoRR, abs/2206. 06602, 2022.
[22] Diederik P. Kingma and Max Welling, Auto-encoding variational bayes. In International Conference on Learning Representations (ICLR), 2014.
[23] Ali Nawaz, Shehroz S. Khan, and Amir Ahmad. Ensemble of autoencoders for anomaly detection in biomedical data: A narrative review. IEEE Access, 12:17273-17288 2024.
[24] Selim F. Yilmaz and S. Kozat. Unsupervised anomaly detection via deep metric learning with end-to-end optimization. ArXiv, abs/2005.05865, 2020.

---

[25] Marco Tulio Ribeiro, Sameer Singh, and Carlos Guestrin. "why should i trust you?": Explaining the predictions of any classifier. In ACM SIGKDD International Conference on Knowledge Discovery and Data Mining (KDD), 2016.
[26] Scott M. Lundberg and Su-In Lee. A unified upproach interpreting model predictions. In Annual Conference Neural Information Processing Systems (NeurIPS), 2017.
[27] Zhifeng Kong and Kamalika Chaudhuri. Understanding instance-based interpretability of variational auto-encoo encoders. In Annual Conference on Neural Information Processing Systems (NeurIPS), 2021.
[28] Jonathan Crabbé and Mihaela van der Schaar. Label-free free explainability for unsupervised models. In International Conference on Machine Learning (ICML., 2022.
[29] Oliver Eberle, Jochen Büttner, Florian Kräutli, Klaus-Robent Müller, Matteo Valleriani, and Grégoire Montavon. Building and interpreting deep similarity models. IEEE Trans. Pattern Anal. Mach. Intell., 44(3): 14(3):1149-1161 149-1161, 2022.
[30] Andrea Agiollo, Luciano Cavalcante Siebert, Pradeep Kumar Murukannaiah, and Andrea Omicini. The quarrel of local post-hoc explainers for moral values classification in natural language processing. In Explainable and Transparent Al and Multi-Agent Systems, volume 14127 of Lecture Notes in Computer Science, 2023.
[31] Vlad Miron, Flavius Frasinear, and Maria Mihaela Trusca. Explaining a deep learning model for aspect-based sentiment classification using post-hoe local classifiers. In Natural Language Processing and Information Systems, Lecture Notes in Computer Science, 2023.
[32] Sadeq Darrab, Harshitha Allipilli, Sana Ghani, Harikrishnan Changaramkulath, Sricharan Koneru, David Broneske, and Gunter Saake. Anomaly detection algorithms: Comparative analysis and explainability perspectives. In Diana Benavides-Praide Sarah M. Erfani, Philippe Fournier-Vipe Viger, Yee Ling Boo, and Yun Sing Koh, editors, Data Science and Machine Learning st Australasian Conference, AusDM 2023, Auckland, New Zealand, December 11-13, 2023, Proceedings, volume 1943 of Communications in Computer and Information Science, pages 90-104. Springer, 2023.
[33] Ryota Nozawa, Shun Sato, and Takayasu Matsuo. A novel interpretation of nesterov's accelera- tion via variable step-size linear multistep methods. CoRR, abs/2404. 10238, 2024.
[34] Alexander Vosseler. Unsupervised insurance fraud prediction based on anomaly detector ensembles. Risks, 2022.
[35] Mononito Goswami, Cristian Challu, Laurent Callot, Lenon Minorics, and Andrey Kan. Unsu- pervised model selection for time-series anomaly detection. ArXiv, 2022.
[36] Chunxu Cao and Qiang Zhang. A contrast based feature selection algorithm for high- dimensional data set in machine learning. CoRR, abs/2401.0744 2024.
[37] Haotian Chang, Jing Feng. Chaofan Duan, Chao Yan, Min Yin, and Li. A novel framework for anomaly detection via feature selection and dimensionality reduction. In Fuzzy Systems and Data Mining V Proceedings of FSDM 2019, Kitakyushu City, Japan, October 18-21, 2019, volume 320 of Frontiers in Artificial Intelligence and Applications, pages 51 511-522, 2019.
[38] Wei Guo, Zhe Wang, Hai Yang, and Wenli Du. Multi-view dimensionaliiy reduction learning with hierarchical sparse feature selection. Appl. Intell., 13110 2023.
[39] Lucas Costa Brito, Gian Antonio Susto, Jorge Nei Brito, and Mareus Antonio Viana Duarte. Fault detection of bearing: An unsupervised machine learning approach exploiting feature extraction and dimensionality reduction. Informatics, page 85, 2021.
[40] Yulin Guo, S. Mahadevan, Shunsaku Matsumoto, Shunsuke Taba, and Daigo Watanabe. Investi- gation of surrogate modeling options with high-dimensional input and output. AIAA Journal, 2023.
12

---

[41] Yisroel Mirsky, Tomer Doitshman, Yuval Elovici, and Asaf Shabtai. Kitsune: An ensemble of autoencoders for online network intrusion detection. In Annual Network and Distributed System Security Symposium (NDSS), 2018.
[42] Ruming Tang, Zheng Yang. Zeyan Li. Weibin Meng, Haixin Wang, Qi Li, Yonggian Sun, Dan Pei, Tao Wei, Yanfei Xu, and Yan Liu. Zerowall: Detecting zero-day web attacks through encoder-decoder recurrent neural networks. In IEEE Conference on Computer Communications (INFOCOM), 2020.
[43] Chuanpu Fu, Qi Li, Meng Shen, and Ke Xu. Realtime robust malicious traffic detection via frequency domain analysis. In ACM SIGSAC Conference on Computer and Communications Security (CCS), 2021.
[44] Leo Breiman, J. H. Friedman, R. A. Olshen, and C. J. Stone. Classification and Regression Trees. 1984.
[45] Christian Camilo Ureuqui López, Jose Osorio Quintero, Melisa Garefa Pea, and Andres Navarro. Malicious and benign websites. 2017.
[46] Salvatore J Stolfo, Wei Fan, Wenke Lee, Andreas Prodromidis, and Philip K Chan. Cost-based modeling and evaluation for data mining with application to fraud and intrusion detection: Results from the jam project. 1999.
[47] Jingyu Xiao, Qingsong Zou, Qing Li, Dan Zhao, Kang Li, Wenxin Tang, Runjie Zhou, and Yong Jiang. User device interaction prediction via relational gated graph attention network and intent-aware encoder. In Proceedings of the 2023 International Conference Autonomous Agents and Multiagent Systems (AAMAS), pages 1634-1642, 2023.
[48] Lisa Liu, Gints Engelen, Timothy M. Lynar, Daryl Essam, and Wouter Joosen. Error prevalence in NIDS datasets: case study on CIC-IDS-2017 and CSE-CIC-IDS-20N In JEEE Conference on Communications and Network Security (CNS), 2022.
[49] Tim M. Booij, Irina Chiscop, Erik Meeuwissen, Nour Moustafa, and Frank T. H. den Hartog. Ton jot: The role of heterogeneity and the need for standardization of features and attack types in iot network intrusion data sets. IEEE Internet of Things Journal, 9(1):485-496 2022.
[50] Xing Xu, Jie Li, Yang Yang, and Fumin Shen. Toward effective intrusion detection using log- cosh conditional variational autoencoder. IEEE Internet of Things Journal, pages 6187-6196, 2021.
[51] Adel Binbusayyis and Thavavel Vaiyapuri. Unsupervised deep learning approach for network intrusion detection combining convolutional autoencoder and one-class SVM. Appl. Intell., 51((0):7094-77) 7108, 2021.
[52] Yutao Dong, Qing Li, Kaidong Wu, Ruoyu Li, Dan Zhao, Gareth Tyson, Junkun Peng. Yong Jiang, Shutao Xia, and Mingwei Xu. Horuseye: Realtime iot malicious traffic detection framework with programmable switches. In USENIX Security Symposium, 2023.
[53] João Pereira and Margarida Silveira. Unsupervised anomaly detection in energy time series data using variational recurrent autoencoders with attention. In M. Arif Wani, Mehmed M. Kantardzic, Moamar Sayed Mouchaweh, João Gama, and Edwin Lughofer, editors, 17th IEEE International Conference Muchine Learning and Applications, ICMLA 2018, Orlando, FL. USA, December 17-20, 2018, pages 1275-1282. IEEE, 2018
[54] Bo Zong, Qi Song, Martin Renqiang Min, Wei Cheng, Cristian Lumezanu, Dae-ki Cho, and Haifeng Chen. Deep autoencoding gaussian mixture model for unsupervised anomaly detection. In 6th International Conference on Learning Representations, ICLR 2018, Vancouver, BC, Canada, April 30 May 3, 2018, Conference Track Proceedings. OpenReview.net, 2018.
[55] Alberto Barbado, Oscar Corcho, and Richard Benjamins. Rule extraction in unsupervised anomaly detection for model explainability: Application to oneclass svm, Expert Systems with Applications, 189: 16100,000000 2022.
13

---

[56] Yiming Li, Jiawang Bai, Jiawei Li, Xue Yang, Yong Jiang, and Shu-Tao Xia. Rectified decision trees: Exploring the landscape of interpretable and effective machine learning. CoRR. abs/2008.09413 2020.
[57] Giulia Vilone, Lucas Rizzo, and Luca Longo. A comparative analysis of rule-based, model- agnostic methods for explainable artificial intelligence. In Irish Conference on Artificial Intelligence and Cognitive Science, 2020.
[58]
Nidula Elgiriyewithana. Credit card fraud detection dataset 2023, 2023.
[59]
Euclides Carlos Pinto Neto, Sajjad Dadkhah, Raphael Ferreira, Alireza Zohourian, Rongxing Lu, and Ali A. Ghorbani. Ciciot2023; A real-time dataset and benchmark for large-scale attacks iot environment. Sensors, 23(13):5941, 2023.
[60] Bushra A. AlAhmadi, Louise Axon, and Ivan Martinovie. 99% false positives: qualitative study of SOC analysts' perspectives on security alarms. In USENIX Security Symposium, 2022.
14

---

A Appendix
A.1 Proof of Proposition
Let C Rd be dataset sampled from a stationary distribution D, and let f X + {0, 1] be unsupervised anomaly detection model that assigns an anomaly score to each data point x E X. There exists rule-based surrogate model (x) derived from such that the surrogate model maintains high fidelity to the original model. Specifically, the surrogate model achieves a high true negative rate (TNR) and true positive (TPR) compared the original model.
Proposition: The dele-based surrogate model (x) derived from f achieves high fidelity, specifi- cally:
C(us. 9n) c,
Our Goal: We aim to demonstrate that the rule-based surrogate model (x(()) derived from the original anomaly detection model f has high fidelity, meaning closely approximates the behavior of f in terms of TNR and TPR.
where C is loss function measuring the discrepancy between the predictions of f and hig and is small positive constant.
Proof:
Rule Extraction: The rules are extracted from the original model f by analyzing the decision boundaries defined by f. Each rule Rş E R is of the form:
d
R A (zy Og Piy),
(10)
where O, {S,>} is the relational operator, and Pij the threshold for the j-th feature in the i-th rule.
2. Surrogate Model Construction: The surrogate model h& (x) is constructed using the rule set R. A data point x classified as normal satisfies at least one rule R2 R:
hx(x)) = A (x E R).
(11)
RER
3. Fidelity Measurement: Fidelity is measured by the loss function L, which captures the discrepancy between the predictions of f and hR. A common choice for L is the misclassification rate:
C(05,0h) 0n) =
Σ XEX
Unl-
(12)
X
4. True Negative Rate (TNR) and True Positive Rate (TPR): Define TNR and TPR for and lg:
TNR, Exex,y- [([(x) =0)
TPR, ExEX, y= 1(f(x==1 1)
(13)
Exex,y=
ExEx,=1
Exex,y= I (x)x(x) =
TPR, ExEX y=1 [[bx(x)=1) =
TNR:
(14)
Exex,yo
Exex,
5. High Fidelity: To achieve high fidelity, we need TNR,, and TPR, be close TNR, and TPR,, respectively. Formally, we want:
TNR TNR, < 5 and TPRR TPR. S 5,
(15)
where 8 is small positive constant.
15

---

6. Bounding the Loss: Since in is derived from R, which closely follows the decision boundaries of the discrepancy between y and ÿn should be minimal. Thus, the loss function L can be bounded:
C(ús- Un) S
Σ
1TNR, - TNRA +
E xEX.
TPR
TPRA
(16)
X
xxEX,=0
7. Small Error Term:
Given the small values of 6, the overall loss can be bounded by:
L(Us Un) E.
(17)
Exex X
ExEXy=11 X
= 8
(18)
8. Finally:
The rule-based surrogate model foR (x) derived from the original anomaly detection model f achieves high fidelity, with the discrepancy between the two models being bounded by a small constant
A.2 Algorithmic implementation
In Algorithm T we combines SCD-Tree and GPR to establish decision boundaries for anomaly detection in high-dimensional data. Initially, the anomaly detector gets sample anomaly score and threshold to classify instances in the dataset X as normal and abnormal. The SCD-Tree then recursively segments the dataset into distributions based on these scores, using information gain to determine optimal features and thresholds for splitting.
Within each distribution X Gaussian Process with RBF kernel models the data in each dimension. After preprocessing and normalizing the data, the GP predicts on an extended range to determine where normality changes. updating decision boundaries based on the longest interval meeting the normality criteria. These boundaries are then formulated into rules Rg each a conjunction of dimensional conditions, enhancing interpretability and the utility of anomaly detection models.
Algorithm 1 Implementation of SCD-Tree and Gaussian Process for Boundary Delineation
Input: X as the full dataset, anomaly detector
Boundary inference rule R₂ on this leaf node, which encapsulates normality (score s, threshold .p) f(X)
Output:
1* Build Segmentation Clustering Decision Tree*/
3 foreach node N SCD-Tree from root to leaves do
A < Select feature and threshold for split based anomaly scores; Select best attribute based on information gain
Split N into child nodes Nicn and Nrigtt using A; Recursive splitting until all leaf nodes are obtained
Divide data into two subsets
end foreach
* Train Gaussian Process Regression model*/
7 for each cluster Xx of leaf node Ng do Initialize boundaries for X k; for each dimension i in X do
D Set initial decision boundaries for normal data within node
10
X X_input + pewprocess(S (i_intier);: gP + GPRegression samples t extend sst_sscccpe___eeee imput); scopp(X_innut);
Prepare data for GP by normalizing or scaling (yk + (s,,)), RBFkernel);
11
12
Generate expanded sample range for prediction
13
Uprea, t (ppppredic(ssmmples))
> Predict with GP to estimate boundary regions
14
interval find longest interval(ypedd o); Identify longest interval meeting criteria for
normality
15
r; f- upudate gonadte_boundariee(inteeeee if interval exists
end for
17
R₂ + (r1 Arr A... Ara);
b Combine all dimensional criteria to form distribution rule
18 end for
return Rx;
Output boundary rules for all clusters
16

---

1.00
1.005
1.010
Training Time (ms)
0.3
42.5
Pred Prediction Time (us)
Metifc LU
Metric Values
0.99
0.995
0.990
0.2
40.0
0.985
TP
37.5
0.98
RII
0.980
Fidelty
0.1
35.0
Robustn 855
Training Time
0.970
10 15
20
25
30
Number of Samples
Number Features
Number Features
(a) Performance by Samples
(b) Performance by Features
(c) Times for Features
Figure 2: More Experiment Details
A.3 Implementation of experiment
Software and Computational Framework. Our implementation utilizes PyTorch (version 2.1.0) to facilitate the development and training of deep learning models, specifically Autoencoders (AF) and Variational Autoencoders (VAE), which are crucial for anomaly detection tasks. Complementing this, scikit-learn (version 1.1.3) is employed for essential preprocessing. feature engineering, and the evaluation of models. The entire system orchestrated using Python (version 3.8. chosen for its extensive libraries that streamline data manipulation and experimental workflows.
Hardware Specifications. The computational infrastructure is centered around high-capacity server featuring an Intel(R) Xeon(R) Gold 5318Y CPU 20GGH with 527GB of RAM, supporting the intensive computational demands of experiments. Additionally, an NVIDIA GeForce RTX 3090 Super with 24GB VRAM is utilized specifically for the computationally intensive tasks of training deep learning models. Notably, the extraction of rules, CPU-intensive process, highlights the efficiency and adaptability of our implementation in resource allocation.
Experiment Details. The deployment of our models and the execution of experiments adhere to structured approach, ensuring reproducibility and systematic analysis. Details on model hyperparam- eters, dataset splits, and the random seeds used to ensure reproducibility will be available through an anonymous repository, providing full access to the scripts and setup used in our research.
A.4 More Experiments
A.4.1 Hyperparameter
We detail the hyperparameter tuning process for the SCD-Tree and GBD algorithms,, focusing on the influence of feature count and sample size on performance metrics.
To understand the influence of the number of features on the performance of our proposed method, we conducted experiments varying the feature count from 5 to 30. The results in Figure 2b show that the true positive and true negative rates are consistently high for different numbers of features, and can remain highly accurate even when interpreting very few features This indicates that the model maintains a high detection accuracy regardless of the number of features. Fidelity displayed an increasing trend with the number of features, suggesting that the surrogate model's ability to approximate the black-box model improves with more features. Robustness was generally high, with minor variations, reflecting the model's stability under different feature configurations.
Impact of Feature Count on Performance Metrics:
Impact of Sample Size on Performance Metries: We also evaluated the performance of our method across varying numbers of expanded sample in the GP algorithm, ranging from 1 to 12. The results indicated that TP and TN rates remained relatively stable across different expanded sample sizes, indicates that while even small number of expanded samples achieve good accuracy. In addition, Fidelity remained high across all expanded sample sizes, showing the surrogate model's consistent approximation of the black-box model in handling varying levels of data expansion. Notably, Robustness saw a significant increase as the number expanded samples increased.
'The "expanded samples" is "samples cittend_scopelle "cope(X_inpput" inpputy" in Algorithm |
17

---

A.4.2 Complexity testing
We delve into the computational cost and complexity associated with training our model on the CIC-IDS2017 dataset using a VAE as black-box model, investigating the impact of varying the number of features on the training time. The training time increases almost linearly with the number of features as Figure 2c shows. This trend aligns with theoretical expectations, as the addition of each feature introduces more parameters that the VAE must learn. Specifically, the training time grows from 0.03353 ms for 5 features to 0.3504 ms for 30 features. The increase in training time with more features is due to the additional complexity in splitting and boundary delineation within the SCD-Tree and GBD algorithms.
As the number of features increases, the model reaches a point where additional features contribute less to the overall complexity. This phenomenon is due to the fact that not all features add unique information. Some features might be redundant or highly correlated with others, providing little additional value for the model to learn. The SCD-Tree's s ability to segment the data may reach an optimal level of complexity. After a certain number of features, further splits may not be necessary or as impactful, resulting in fewer additional splits and less computational overhead. The tree may also prune less informative features, focusing on the most relevant ones, thereby maintaining efficiency.
Despite the observed increase in training time, our model maintains highly efficient prediction times. This efficiency is achieved by leveraging set of pre-defined rules derived from the SCD-Tree's ' decision paths and the GBD's boundary delineations. These rules are computationally inexpensive to evaluate, ensuring that our model remains suitable for real-time applications. The prediction process is streamlined and does not require the iterative optimization steps needed during training, thus significantly reducing computational overhead.
B Model Performance
In this section, we present a detailed analysis of the performance of our proposed method for rule- based interpretation in unsupervised anomaly detection models. The evaluation is based series of experiments conducted on the CIC-IDS2017 dataset and three additional datasets (KddCup, TON-IoT, and Web) using four different anomaly detection models: Autoencoder (AE), Variational Autoencoder (VAE), One-Class SVM (OCSVM), and Isolation Forest (iForestt.
B.1 Performance on CIC-IDS2017 Dataset
We first evaluated the performance of our method on the CIC-IDS2017 dataset. Table 55 summariizes the results for six different methods: UAD, EGDT, Trustee, LIME, KD, and our proposed method. The metrics used for evaluation include Classification Rate (CR), Precision (PR), Recall (RC), and Fl score (F1). Our method demonstrates superior performance across all metrics compared to the baseline methods. Specifically, with the VAE as the modek- our method achieves a CR of 0 0.9975, PR of 0.9992, RC of 0.9979, and F1 score of 0.9994, almost all metrics are the optimal value for all baselines. Similar trends are observed for the VAE, OCSVM, and iForest models, indicating the robustness and effectiveness of our approach extracting interpretable rules that closely approximate the original model's behavior.
Table 5: Performance of rule extraction CIC-IDS2017 dataset.
AE
VAE
OUSVM
iForest
Method
CR
PR
RC
F1
CR
PR
RC
F1
CR
PR
RC
F1
CR
PR
RC
Fi
UAD
0.0135
0.9997
0.0118
0.0231
0.6096
0.0866
0.1124
0.1903
0.9972
0.9997
0.996
0.9977
0.9988
0.0677
0.9299
0.9623
BGDT
0,5731
0,4726
0.4734
0.8932
0,5617
0.8724
0.6859
0.5455
0.9898
0.925
0.8544
0.9185
0.9949
0.9393
0.9938
0.9938
Trustee
0,8652
0.4248
0.6479
0.4248
0,8123
0.8319
0.7663
0.8278
0.8551
0.5509
0.666
0.7502
0.9549
0.4847 0,8673 0.8947
LIME
0.9065
1
0.9162
0.9493
0.9063
0.9996
0.916
0.9492
0.9883
0.7413
0.9263
0.9574
0. 868664
0.8305 0.8296 0,8759
KD
0.5147
0.5143
0.6863
0,5832
0.623
0,9823
0,4799
0.64488
0.9154
0,3565
0.3744
0,5314
0.7853
0.0666
0.84663 0.8466
Ours
0.9438
0.999
0.936
0.9665
0.9975
0.9992
0.9979
0.9986
0.9707
0.9995
0.9666
0.9828
0.9717
0.9994
0.9678
0.9834
18

---

B.2 Performance on Different Datasets
To further assess the generalizability of our method, we conducted experiments on three additional datasets: KddCup, TON-IoT, and Web, as summarized Table 6 Our method consistently outper- formed baseline approaches across all datasets and metrics. On the KddCup dataset. for instance, we achieved Fl scores 0.9781, 0.9848, 0.9342, and 0.9901 for the AE, VAE, OCSVM, and iForest models, respectively. This highlights the method's adaptability and accuracy across different models and complex anomaly detection scenarios.
In addition, Table compares the performance of our rule extraction method using VAE as black- box model across different domain datasets, including Credit Card Fraud Detection, CIC-IoT, and Breast Cancer Wisconsin. Across these datasets, our method consistently demonstrated superior True Positive Rates (TPR) and True Negative Rates (TNR), indicating its effectiveness in both detecting anomalies and correctly identifying normal instances. For example, on the Credit Card Fraud dataset, we achieved a TPR of 0.9 127 and a TNR 0.9854, demonstrating the method's 's reliability in handling imbalanced data. The high fidelity and robustness across diverse datasets confirm the effectiveness of our approach, even in high-stakes domains like healthcare and IoT security. Overall, the results from both tables underscore the versatility, accuracy, and robustness of our method, validating its applicability across different anomaly detection scenarios and datasets.
Table 6: Performance of rule extraction different datasets.
AE
VAE
OCSVM
iFurest
Datasets
CR
PR
RC
F1
CR
PR
RC
F1
CR
PR
RC
F1
CR
PR
RC
Fl
CIC-IDS
0,9438
0.909
0.936
0.9665
0,9975
0.9992
0,9979
0.9986
0,9707
0.9995
0.9666
0.9828
0,9717
0.9994
0.9678
0.9834
KddCup
0.9635
0.9576
0,9994
0.9781
0.976
0.9968
0,9731
0.9848
0.894
0.9284
0,94
0.9342
0.9905
0.9835
0.9969
0.9901
TON.JoT JoT
0.9856
0.9759
0,9679
0.9719
0.9917
0.9689
1
0.9842
0.9955
0.9829
1
0.9914
0,9991
0.9963
I
0.9982
Web
0.997
0.88
0.9362
0.996
0,8462
0.9167
0.998
0.9184
0.9574
0,9955
0.8235
0.9032
Table 7: Performance of Rule Extraction Across Selected Security Datasets
Credit Card Fraud Detection
58
CIC-1oT
[5
Breast Cancer Wisconsin
Method
TPR
TNR
FD
RB
TPR
TNR
FD
RB
TPR
TNR
FD
RB
UAD
0.6256
0.8331
0.7861
0,5021
0.8913
0.9988 0.3644
0.4834
0.2632
0.0132
0.114
0.9912
LJME
0.8951 0.9742 0.9156
0.9985
0.9063
0,9786 0,9410 0.9996
0.6579 0,9474
0.8333
Trustee
0.5325
0.9923
0.6985
0.9910
0.4165
0,9972 0.8126 0.9929
0.1316
0,9868
0.6842 0.9825
Ours
0.9127
0.9854
0.9335
0.8964
0.9150
0.9899 0.9453
0.8979
0.8684
0.75
0.8421
B.3 Model validity Experiment
Table 8: The number and average length of rules generated by the model
Number of Rules
Average Rule Length
Dataset
AE
VAE
IFOREST
AE
VAE
IFOREST
CIC-IDS
22
15
17
4.83
3.03
4.97
ton-iot
21
23
13
5
5.0
kddcup
17
19
21
5
4.7
5
In our study, we have emphasized the significance of interpretability anomaly detection models, especially in high-stakes domains such as cybersecurity, where comprehensibility of model decisions crucial for timely and accurate responses. We use the model to test the rules that can be generated on different datasets. For the CIC-IDS dataset, the Autoencoder generated 22 rules with an average rule length of 4.83, indicating a relatively detailed set of explanations that captures the complexity of network intrusion patterns. The VAE model produced more concise rule set, with 15 rules and an average length of 3.03, suggesting that the VAE may encapsulate the data distribution with fewer, simpler rules while maintaining interpretability.
19

---

B.4 Analysis of Results
The experimental results clearly indicate the superiority of our proposed method in terms of inter- pretability and fidelity to the original anomaly detection models. The high values of CR. PR, RC, and Fl scores across different datasets and models confirm that our method can effectively extract rules that closely mimic the behavior of complex black-hox models. This not only enhances the transparency of the anomaly detection process but also facilitates better understanding and trust in automated systems, particularly in high-stakes environments where decision accuracy is crucial.
In summary, our method provides a robust and interpretable framework for unsupervised anomaly detection, offering significant improvements over existing baseline methods. The ability to transform complex model operations into clear, rule-based explanations makes it a valuable tool for practitioners and researchers in the field.
B.4.1 Metrics
In evaluation, we utilize a set of metries which include: (1) Fidelity, which measures the congruence between the predictions of the original model and its explanations to assess the reliability of those explanations: (2) Robustness, evaluating the consistency of explanations in the face of slight variations in input data; and (3) both True Positive Rate and True Negative Rate, which are critical for determining the practical effectiveness in security contexts where minimizing false alarms is pivotal to averting "alert fatigue" [60]. These metrics form a comprehensive framework for assessing the explanatory capacity and dependability of various approaches, ensuring that our results are solid and directly applicable to real-world anomaly detection scenarios. Their meaning and calculations are:
TNR and TPR represent the probability of being correctly identified as positive (abnormal) and being correctly identified as negative (normal), respectively. The formulas are TP tn These metrics form the basis for more complex evaluation metrics. ip TN in+ 5p+/nn
In the context of our model, these values are derived from the confusion matrix, which summarizes the performance the classification.
Fidelity (FD) measures the extent to which the rule-based explanations generated by our method agree with the predictions made by the underlying black- model. High fidelity indicates that the surrogate model (SCD-Tree + GBD) closely approximates the decision- making process of the black-box model, defined FD Number of consistent predictions
Total number predictions Let (x) be the surrogate model based on the extracted rules R. Define fidelity as the agree- ment between the surrogate model and the original model ʃ:: FD 1 Σ ltv (v:) [(x:)] The rules are derived directly from the KITree's splits and the GP's s boundary delin- eation, ensuring that lx closely follows f-
Robustness (RB) evaluates the stability of the model's explanations under slight perturba- tions in the input data. It assesses whether the explanations remain consistent when the input data is subject to small changes, which is crucial for ensuring the reliability of the model in dynamic environments, assessed by RB = Number consistent predictions under perturbation Consider
Total number of predictions
small perturbations d in the input æ: æ = x + 8 Robustness is defined as the invariance of predictions under these perturbations: RB decision boundaries are derived from GPs, which provide smooth and continuous estimates, inherently leading to robust predictions.
E [1te((;;) he 5). The
B.5 Limitations
While our method introduces significant advancements in the interpretability of unsupervised anomaly detection models, several limitations warrant further exploration. Primarily, the efficacy of our SCD- Tree and GBD algorithms hinges predominantly on structured, tabular data, where each feature T; within the vector x E Id conveys explicit semantic information. This specificity restricts direct applicability complex, unstructured data forms such as raw images or sequential text, where high- level feature extraction typically necessitates convolutional neural networks (CNNs) or transformers to preprocess data into an analyzable format for our model. For instance, if X represents an image, direct application of our rule extraction process becomes nonviable without preceding transformation T Xnw - Xamettreds where Ynw and Xaructured denote the spaces of raw and structured data, respectively.
20

---

Furthermore, the extracted rules are inherently axis- axis-aligned, constraining their ability to encapsulate complex, non-linear decision boundaries prevalent in various applications. If (xx) represents the original model's boundary function in high-dimensional space, the limitation in capturing its curvature through axis-aligned splits can be expressed as:
min R
Σ XED
[(() - R(x)]
(19)
where R signifies the set of rules derived from our method, and DD denotes the data distribution. While the introduction of compositional distribution segmentation within our SCD-Tree mitigates this issue partially, perfect congruence with irregular boundaries remains elusive, illustrating common challenge across global explanation methodologies.
Lastly, the validation of our method's interpretability and trustworthiness,, especially in domains heavily reliant on expert judgment, lacks empirical rigor. Future studies should emphasize structured user tests involving domain-specific practitioners to assess whether the interpretations generated align with expert reasoning and decision-making processes. Such evaluations could significantly augment our understanding and optimization the interaction between human experts and automated systems, ideally leading more intuitive and effective anomaly detection tools.
By addressing these areas, future research can expand the method's applicability, enhance its adapt- ability to complex data forms, and refine its utility in practical, expert-driven environments, ensuring broader adoption and deeper trust in automated anomaly detection.
21

---

NeurIPS Paper Checklist
1. Claims
Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification: The abstract and introduction Teplicitly outline the development and appli- cation of the Segmentation Clustering Decision Tree (SCD-Tree) and Gaussian Boundary Delineation (GBD) methodologies enhance the interpretability of black-box models in unsupervised anomaly detection, which are the central contributions of this paper.
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made in the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made the paper and important assumptions and limitations. A No or NA answer to this question will not be perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.
is fine to include aspirational goals as motivation as long as is clear that these goals not attained by the paper.
2. Limitations
Question: Does the paper discuss the limitations of the work performed by the authors?
Answer: [Yes]
Justification: The limitations are comprehensively addressed the "Limitations" subsection of the appendix (see [.5), where issues such as the application to unstructured data and the axis-aligned nature the extracted rules are discussed. Furthermore, the computational
complexity and scalability of the proposed methods are also evaluated.
Guidelines:
The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors are encouraged to create separate "Limitations" section in their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model vell-specifiiattin,, asymptotic approximations only holding locally). The authors should reflect on how these assumptions might be violated in practice and what the implications would be.
The authors should reflect on the scope of the claims made, e.g., if the approach was only tested few datasets with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect on the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution is low or images are taken in low lighting. Or speech-to-text system might not be used reliably to provide closed captions for online lectures because it fails handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and faimess.
While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, worse outcome might be that reviewers discover limitations that aren't acknowledged the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an impor- tant role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.
22

---

3. Theory Assumptions and Proofs
Question: For each theoretical result, does the paper provide the full set of assumptions and complete (and correct) proof?
Answer: [Yes]
Justification: The paper includes detailed assumptions and provides complete proof's for the primary theoretical results, particularly in the appendix (see (see Each theorem and proposition is clearly stated with all necessary assumptions, and proofs are provided to ensure the validity of the claims.
Guidelines:
The answer NA means that the paper does not include theoretical results. All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated referenced in the statement of any theorems.
The proofs can either appear in the main paper or the supplemental material, but if they appear in the supplemental material, the authors are encouraged to provide a short proof sketch provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material.
Theorems and Lemmas that the proof relies upon should properly referenced.
4. Experimental Result Reproducibility
Question: Does the paper fully disclose all the information needed to reproduce the main ex- perimental results of the paper to the extent that affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)?
Answer: [Yes]
The paper meticulously describes the datasets, experimental setup, hyperparam- eters, and computational infrastructure in the "Implementation of Experiment" subsection the logic of the algorithm is also presented in pseudo-code I ensuring that other researchers can reproduce the experiments and verify the main claims.
Justification:
(see (see A.3).
Guidelines:
The answer NA means that the paper does not include experiments.
If the paper includes experiments, a No answer this question will not perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
the contribution is dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is a novel architecture, descríbing the architecture fully might suffice, or if the contribution is specific model and empirical evaluation, it may be necessary to either make possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way to accomplish this, but reproducibility can also be provided instructions for how to replicate the results, access to a hosted model (e.g.. in the case of a large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed.
detailed
While NeurlPS does not require releasing code, the conference does require all submis- sions to provide some reasonable avenue for reproducibility, which may depend on nature of the contribution. For example
(a) If the contribution is primarily a new algorithm, the paper should make it clear how reproduce that algorithm.
(b) If the contribution is primarily
model architecture, the paper should describe the architecture clearly and fully.
(c) the contribution a new model (e.g., a large language model), then there should either be way to access this model for reproducing the results or way to reproduce the model (e.g., with an open-source dataset instructions for how to construct the dataset).
23

---

(d)
We recognize that reproducibility may be tricky in some cases, in which case authors are welcome describe the particular way they provide for reproducibility. In the case of closed-source models, it may be that access to the model is limited in some way (e.g., to registered users), but it should be possible for other researchers to have some path to reproducing or verifying the results.
5. Open access to data and code
Question: Does the paper provide open access to the data and code, with sufficient instruc- tions faithfully reproduce the main experimental results, as described in supplemental material?
Answer: [Yes]
Instructions for accessing the data and code will be made available through anonymous repository, detailed in the "Implementation of Experiment" subsection (see 6.1). At the same time, we also submitted our data and code in the Supplementary Material zip package, some of the datasets are quite large, only intercepted some important data, and in the dataset folder Tianjia "readme.tx" file, the public links to the dataset and the of the method provide detailed description. We have included "readme. file in the dataset folder, which provides detailed instructions on how to link to and use the dataset. This ensures that the research community can access and verify the results.
Justification:
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurIPS code and data submission guidelines (https://nips.ca cc/
Btallc/guiids//odeeSuuiinn iooliiissynnooyyy for more details.
While encourage the release of code and data, we understand that this might not be possible, so "No" is an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for new open-source benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurlPS code and data submission guidelines (https)
/ //nips. //nips.cc/pulll wwtpppbiccgguueeeeeeeeeeeeeeeeee / wwt.sSubmissiooPoo
for more details.
The authors should provide instructions data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. only subset of experiments are reproducible, they should state which ones are omitted from the script and why.
At submission time, preserve anonymity, the authors should release anonymized versions (if applicable).
Providing as much information as possible in supplemental material (appended to the paper) recommended, but including URLs to data and code permitted.
6. Experimental Setting/Details
Question: Does the paper specify all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?
Answer: [Yes]
Justification: Detailed descriptions of the experimental settings, including data splits, hyper- parameters, optimizers, and other computational details, are provided in the "Implementation of Experiment" subsection (see and A.3). This transparency ensures that the results understandable and reproducible.
Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented in the core of the paper to a level of detail that is necessary appreciate the results and make sense of them.
The full details can provided either with the code, appendix, or as supplemental material.
24

---

7. Experiment Statistical Significance
Question: Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Answer: [Yes]
Justification: The paper includes detailed statistical analysis, reporting metrics such as True Positive Rate, True Negative Rate, Fidelity, and Robustness with appropriate error bars and confidence intervals (see [.4.1 The methodology for calculating these statistics is thoroughly explained.
Guidelines:
The answer NA means that the paper does include experiments.
The authors should answer "Yes" if the results are accompanied by error bars, confi- dence intervals, statistical significance tests, least for the experiments that support the main claims of the paper.
The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall run with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)
The assumptions made should be given (e.g.. Normally distributed errors).
should be clear whether the error bar is the standard deviation the standard error of the mean.
It is OK to report 1-sigma error bars, but should state it. The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of errors is not verified.
For asymmetric distributions, the authors should be careful not to show in tables or figures symmetric error bars that would yield results that out of range (e.g. negative error rates).
If error bars are reported in tables or plots. The authors should explain in the text how they were calculated and reference the corresponding figures or tables in the text.
8. Experiments Compute Resources
For each experiment, does the paper provide sufficient information on the com- puter resources (type of compute workers, memory, time of execution) needed to reproduce the experiments?
Question:
Answer: [Yes]
The paper specifies the computational resources used, including details on CPU, GPU, memory, and execution time in the "Implementation of Experiment" subsection (see A.3). This includes the type of hardware and software environment, which is critical
Justification:
for reproducibility.
Guidelines:
The answer NA means that the paper does include experiments.
The paper should indicate the type of compute workers CPU or GPU, internal cluster, cloud provider, including relevant memory and storage.
The paper should provide the amount of compute required for each of the individual experimental runs as well estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that didn't make into the paper).
9. Code Of Ethics
Question: Does the research conducted in the paper conform, in every respect, with the NeurlPS Code of Ethics https: /tte:://nrrrpiee httppppccccppllccttthccccceeeeea
Answer: [Yes]
25

---

The research strictly adheres to the NeurIPS Code of Ethics. It aims to improve the interpretability and reliability of anomaly detection models, which can significantly enhance security, healthcare, and other critical applications.
Justification:
Guidelines:
The answer NA means that the authors have not reviewed the NeurlPS Code of Ethics.
If the authors answer No, they should explain the special circumstances that require a deviation from the Code of Ethics.
The authors should make sure to preserve anonymity (e.g.. there special consid- eration due to laws or regulations in their jurisdiction).
10. Broader Impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer: [Yes]
The paper discusses the potential positive impacts, such as improved decision- making and transparency in high-stakes environments, and acknowledges potential negative impacts related to misuse anomaly detection technology in B.5 Mitigation strategies are also suggested.
Justification:
Guidelines:
The answer NA means that there is no societal impact of the work performed.
If the authors answer NA or No, they should explain why their work has no societal impact or why the paper does not address societal impact.
Examples of negative societal impacts include potential malicious or unintended uses (e.g.. disinformation, generating fake profiles, surveillance), faireess considerations (e.g., deploymenn of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
The conference expects that many papers will be foundational research and tied to particular applications, let alone deployments. However, if there is direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional unintentional) misuse of the technology.
If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms to monitor how system learns from feedback over time, improving the efficiency and accessibility of ML).
11. Safeguards
Does the paper describe safeguards that have been put in place for responsible release of data models that have high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?
Question:
Answer: [NA]
The paper does not release datasets models that have high risk for misuse. It focuses on methodologies applied to existing data.
Justification:
Guidelines:
The answer NA means that the paper poses no such risks.
Released models that have high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere to usage guidelines or restrictions to access the model or implementing safety filters.
26

---

Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
recognize that providing effective safeguards challenging, and many papers do not require this, but encourage authors to take this into account and make best faith effort.
12. Licenses existing assets
Are the creators or original owners of assets (e.g.. code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?
Question:
Answer: [Yes]
Justification: The paper appropriately credits all datasets and tools used, such the CIC- IDS2017 dataset and the PyTorch framework, and adheres to their respective licenses and terms of use.
Guidelines:
The answer NA means that the paper does not use existing assets.
The authors should cite the original paper that produced the code package dataset.
The authors should state which version of the asset used and, possible, include URL.
The name of the license (e.g., CC-BY 4.0) should be included for each asset.
For scraped data from a particular source (e.g., website). the copyright and terms of service of that source should be provided.
If assets are released, the license, copyright information, and terms of use in the package should be provided. For popular datasets, paperswi thcode. com datasets has curated licenses for some datasets. Their licensing guide can help determine the license of dataset.
For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided.
If this information is not available online, the authors are encouraged to reach out to the asset's 's creators.
13. New Assets
Question: Are new assets introduced in the paper well documented and the documentation provided alongside the assets?
Answer: [NA]
Justification: The paper does not introduce new assets. It builds on existing datasets and tools, focusing the novel application of methodologies.
Guidelines:
The answer NA means that the paper does not release new assets.
Researchers should communicate the details of the dataset/code/mmodl part of their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent was obtained from people whose asset is used.
At submission time, remember anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.
14. Crowdsourcing and Research with Human Subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well details about compensation (if any)?
Answer: [NA]
Justification: The paper does not involve crowdsourcing research with human subjects.
Guidelines:
27

---

The answer NA means that the paper does not involve crowdsoureing nor research with human subjects.
Including this information the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then much detail as possible should be included the main paper.
According to the NeurIPS Code of Ethics, workers involved in data collection, curation,
or other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional Review Board (IRB) Approvals or Equivalent for Research with Human Subjects
Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or equivalent approval/review based on the requirements of your country or institution) were obtained?
Answer: [NA]
Justification: The paper does not involve research with human subjects, hence IRB approval is not applicable.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Depending the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors to adhere to the NeurlPS Code of Ethics and the guidelines for their institution.
For initial submissions, not include any information that would break anonymity (if applicable), such as the institution conducting the review.
28


Reviews:
[{"review_id": "01HzYDCVIX", "reviewer": "Reviewer_ZxG9", "summary": "In high-stakes sectors like network security and IoT security, accurately distinguishing between normal and anomalous data is critical. This paper introduces a novel method to interpret decision-making processes of anomaly detection models without labeled attack data. It presents the Segmentation Clustering Decision Tree (SCD-Tree) and the Gaussian Boundary Delineation (GBD) algorithm. The SCD-Tree enhances clustering by integrating model predictions, while the GBD algorithm defines boundaries within segmented distributions, delineating normal from anomalous data. This approach addresses the challenges of dimensionality and data drift, ensuring robustness and flexibility in dynamic environments. The method transforms complex anomaly detection into interpretable rules, demonstrating superior explanation accuracy, fidelity, and robustness compared to existing methods, proving effective in high-stakes scenarios where interpretability is essential.", "questions": "What are the limitations of the SCD-Tree and GBD algorithms when dealing with extremely large datasets or real-time data streams?", "limitations": "The limitations have been discussed in the paper", "rating": 7, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. By addressing the curse of dimensionality, the approach effectively segments high-dimensional data into more manageable parts, allowing for better clustering and anomaly detection.\n\n2. The method ensures robustness against data drift and perturbations by using flexible boundary fitting, which adapts to changes in data distribution over time.\n\n3. The method is well formulated, which is easy to understand", "weaknesses": "1. While the method shows robustness across several datasets, it might not perform equally well in all types of data or anomaly detection scenarios, especially those vastly different from the ones tested.\n\n2. The effectiveness of the interpretative rules depends heavily on the quality of the initial black-box model.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We sincerely thank you for your insightful feedback. \n\n> Question 1: While the method shows robustness across several datasets, it might not perform equally well in all types of data or anomaly detection scenarios.\n\n**Response:**\nWe acknowledge the concern regarding the generalizability of our method to vastly different types of data and anomaly detection scenarios. To address this, we have conducted additional experiments on datasets from domains not covered in our initial evaluation. The results, as shown in the attachment of global response Table 2, indicate that our method maintains high levels of robustness and interpretability across datasets in various fields. \n\nHowever, we also recognize the inherent limitations in any single method's universal applicability. Therefore, we propose the following solutions to further enhance the generalizability of our approach and will implement in the future:\n\n- Adaptive Thresholding. Implementing adaptive thresholding mechanisms that dynamically adjust based on the characteristics of the input data can improve performance across diverse scenarios.\n- Domain-Specific Fine-Tuning. Developing domain-specific fine-tuning protocols to adjust the SCD-Tree and GBD algorithms based on the unique properties of different datasets.\n\n> Question 2: The effectiveness of the interpretative rules depends heavily on the quality of the initial black-box model.\n\n**Response:**\nYou hit the nail on the head, and that's what we're trying to focus on as we do our work! We appreciate your insight regarding the dependency of our interpretative rules on the initial black-box model's quality. Indeed, the primary motivation behind our research is to enhance the interpretability of black-box models in anomaly detection. Our goal is to interpret the black-box model into understandable rules by using a rule-based approach, which is essential for high-risk domains. The aim is not only to explain the decision-making processes of these models but also to improve their transparency and trustworthiness. \n\nHowever, we would like to highlight several key aspects of our methodology that ensure its effectiveness, even when the black-box model is relatively small or less complex:\n\n- We have unified the output standards of the black-box models by using metrics such as Mean Squared Error (MSE) and threshold values to represent data normality. These standardized metrics serve as inputs for the SCD-Tree, ensuring consistent and reliable decision-making regardless of the black-box model’s complexity.\n- The SCD-Tree effectively segments the data into smaller, more manageable clusters. This segmentation reduces the dependency on the black-box model's complexity by isolating simpler patterns within each cluster.\n- We conducted extensive experiments using various black-box models (e.g., AE, VAE, Isolated Forests, One-Class SVM) of different sizes and complexities. The results in section 6.3 demonstrate that our method maintains high interpretability and accuracy  on the currently dominant neural network models in anomaly detection field, even with smaller models. For instance, our experiments with a simple autoencoder model yielded interpretative rules with high fidelity and robustness, as evidenced by the performance metrics provided in Table 3 and Table 4(1) .\n\n> Question 3: What are the limitations of the SCD-Tree and GBD algorithms when dealing with extremely large datasets or real-time data streams?\n\n**Response:**\nThe SCD-Tree and GBD algorithms, while effective, have certain limitations when handling extremely large datasets or real-time data streams. Here are the key challenges :\n\n1. The time complexity of Gaussian Processes (GP) is relatively high ( $N^3$ ), which can lead to longer processing times when dealing with high-dimensional data. **However**, we have used the Segmentation Clustering Decision Tree (SCD-Tree) for spatial partitioning, so this issue only arises when there is a large amount of data within a particular subspace. By partitioning the data, we localize the high complexity to smaller regions, thus making the overall process more manageable.\n2. Our hierarchical model involves several steps: running the black-box model, applying the SCD-Tree, performing Gaussian Process delineation, and boundary acquisition, which make the process lengthy. However, once the data has been partitioned by SCD-Tree , each subspace can be processed in parallel, which reduces the training time.\n\nHowever, the aforementioned challenges primarily occur during the training phase. In real-world scenarios, once the model has been trained and the rules have been inferred, anomaly detection only requires simply examines whether the sample meets these rules. The rules-based interpretation remains efficient and scalable for real-time applications  and is well compatible with high-performance applications (like P4 [1],  reaching up to 100Gbps throughput by integrating rule-based models [2]), which allows for the implementation of data plane processing with high efficiency and low latency.\n\nAnd our model is designed to handle new data continuously and achieve incremental rule updates. Therefore, even when encountering new types of data, there is no need to re-train the entire model. Instead, we can incrementally update the rules to adapt to new data, ensuring the model remains accurate and up-to-date without extensive re-training. This is certainly efficient in real life use.\n\nThank you for your constructive feedback, which has been invaluable in guiding these enhancements.\n\nReferences: \n[1] P. Bosshart, D. Daly, G. Gibb, M. Izzard, N. McKeown, J. Rexford, C. Schlesinger, D. Talayco, A. Vahdat, G. Varghese, and D. Walker, “P4: programming protocol-independent packet processors,” ACM SIGCOMM Computer Communication Review, 44(3):87–95, 2014\n\n[2] R. Li, Q. Li, Y. Zhang, D. Zhao, X. Xiao, and Y. Jiang, “Genos: General in-network unsupervised intrusion detection by rule extraction,”", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "K2meftC4N7", "reviewer": "Reviewer_kdm5", "summary": "The paper proposes a general method to extract interpretable rules from any anomaly detection model. A decision tree is learned from a black-box anomaly detector output/scores and the decision boundaries in the learned tree are further refined using Gaussian Processe framework.", "questions": "A justification for using Gaussian Processes is not presented. Why not use some other model such as KDE?", "limitations": "NA", "rating": 6, "confidence": 4, "soundness": 2, "presentation": 3, "contribution": 3, "strengths": "The paper tries to address an important issue with anomaly detection: explainability. It presents results against relevant baseline methods for explainability.", "weaknesses": "Not all claims are rigorously supported with evidence.\n\nMain comments:\n\n- Lines 106-110: \"In summary ... their operational logic.\" -- The only concrete evidence provided in the paper is for robustness. The paper has not systematically addressed attributes such as interpretability, non-reliance of oversimplified surrogate models.\n\n- Section 4: Rule extraction using scores from other models has been researched in earlier literature (e.g., [1, 2, 3, 4]). The current paper should discuss the differences with prior literature and whether any of those earlier techniques can be utilized here.\n\n- Section 5: A justification for using Gaussian Processes is not presented. Why not use some other model such as KDE?\n\n- Section 5: There should be an ablation experiment to show the benefits with boundary estimation vs without.\n\n- Lines 267-268: \"For the calibration of our anomaly detection models' hyperparameters, only normal instances from these datasets are utilized.\" -- This contradicts the claim that the algorithm is unsupervised as this statement implies that labeled normal instances are available.\n\n- Line 282 -- Fidelity and Robustness are predictive measures, not interpretability. The more relevant *interpretability* measures in [49] are 'Number of rules' and 'Average rule length'. These must be shown here with respect to interpretability.\n\n- Line 312: \"...proving its resilience to data drift and...\" -- 'data drift' is a different concept -- it means that over time the inherent data characteristics change permanently. What probably is being implied here is sample variance. The paper has not presented any evidence of being able to handle data drift.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for your thorough review and insightful feedback on our paper.\n> Comment 1: Lines 106-110: \"In summary ... their operational logic.\"  The paper has not systematically addressed attributes such as interpretability, non-reliance on oversimplified surrogate models.\n\n> Comment 6:Line 282 -The more relevant interpretability measures in [49] are 'Number of rules' and 'Average rule length'. \n\n**Response:**\nThank you for pointing out this oversight. We had intended to use robustness to show that our model explains the black-model well. We agree that we should provide concrete evidence for interpretability and non-reliance on oversimplified surrogate models.\n\nIn revised paper, we incorporate these metrics ('Number of rules' and 'Average rule length' ) into our evaluation. Additionally, We add ablation experiments to demonstrate the interpretability. The results of the experiment are attached to the Table 4 and Table 1 of global response.\n\n||NumberofRules|||AverageRuleLength|||\n|----------|--------------------|--------|--------|---------------------|--------|--------|\n||AE|VAE|IFOREST|AE|VAE|IFOREST|\n|CIC-IDS|22|15|17|4.83|3.03|4.97|\n|ton-iot|21|23|13|5.00|5.00|5.00|\n|kddcup|17|19|21|5.00|4.70|5.00|\n\n> Comment 2:Section 4: The current paper should discuss the differences with prior literature and whether any of those earlier techniques can be utilized here.\n\n**Response:**\nWe appreciate the references to earlier work. Our approach differs from prior literature primarily in the integration of Segmentation Clustering Decision Tree with Gaussian Boundary Delineation.\n\nTo clarify these distinctions, we include a more comprehensive related work section that discusses the differences between our method and previous techniques [33, 34, 35, 36], specifically highlighting the novelty and advantages of combining SCD-Tree with GBD for rule extraction. Additionally, we explore the potential applicability of earlier techniques to our methodology and discuss their comparative performance.\n\n> Comment 3 & Questions: Section 5: A justification for using Gaussian Processes is not presented. Why not use some other model such as KDE?\n\n**Response:**\nWe use Gaussian Processes (GPs) for their probabilistic framework, which quantifies uncertainty at each prediction point through variance. This capability is crucial for ensuring robustness in boundary delineation by allowing us to assess confidence levels in decision boundaries. \nKDE is a non-parametric way to estimate the probability density function of a random variable. While KDE is effective in density estimation, it does not inherently provide a measure of uncertainty. This lack of uncertainty quantification limit the robustness of boundary delineation, especially in high-stakes anomaly detection tasks.\n\nThe probabilistic nature of GPs allows us to define decision boundaries that take into account both the mean and variance of the predictions. By setting thresholds on the mean and variance, we can delineate boundaries that are not only accurate but also resilient to variations and perturbations in the data. KDE can estimate density contours, but without an inherent measure of uncertainty, it may not delineate boundaries as effectively in terms of robustness. \n\n> Comment 4:Section 5: There should be an ablation experiment to show the benefits with boundary estimation vs without.\n\n**Response:**\nWe agree that ablation study is necessary to demonstrate the benefits of boundary estimation. We conduct ablation experiment that compares our method with and without the GBD step. The results of are presented in global rebuttal and Appendix A.4.5 of the final version which show that rules-based approach GBD improves the accuracy by up to 0.12.\n\n> Comment 5:Lines 267-268: \"only normal instances from these datasets are utilized.\" -This contradicts the claim that the algorithm is unsupervised as this statement implies that labeled normal instances are available.\n\n**Response:**\nWe apologize for the confusion. Our approach is indeed unsupervised; however, for the calibration of hyperparameters, we utilized a small portion of one-class data presumed to be normal based on domain knowledge, not labeled instances. Instead, domain knowledge is leveraged to identify normal data for hyperparameter calibration. This ensures that the unsupervised nature of our anomaly detection approach is maintained.\n\nWhile using purely normal data is the ideal state, in real-world scenarios, some attack data may inevitably be present. We conducted experiments using CIC-IDS and TON-IoT datasets to assess the efficacy of our method under varying percentages of “noisy” data. Our results demonstrate that the  model maintain high levels of fidelity and robustness even as noise levels increase. \n|Dataset|NoiseLevel(%)|TPR|FD|\n|---------|-----------------|------|------|\n|CIC-IDS|1|0.91|0.943|\n||6|0.897|0.935|\n||8|0.89|0.928|\n||10|0.856|0.92|\n|TON-IoT|1|0.995|0.991|\n||6|0.975|0.987|\n||8|0.971|0.979|\n||10|0.966|0.969|\n\n> Comment 7:Line 312:  'data drift' is a different concept -- it means that over time the inherent data characteristics change permanently. What probably is being implied here is sample variance. \n\n**Response:**\nThank you for bringing this blunder to our attention. We acknowledge the misuse of the term 'data drift'. What we intended to convey is the model's ability to handle sample variance and minor perturbations. We will correct this terminology to 'Data  Variability' in the final version and provide a more accurate description of our method's resilience to sample variance.\n\nOur model's ability to handle sample variance is achieved through the dynamic nature of the Gaussian Processes used in the boundary delineation step. GPs provide a probabilistic framework that can adapt to changes in the data distribution by continuously updating the mean and variance estimates based on new data points. Ablation experiments demonstrated the effectiveness of the method in dealing with sample variance.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "xhsfllrX1A", "reviewer": "Reviewer_7Q5n", "summary": "This paper introduces the Segmentation Clustering Decision Tree (SCD-Tree) and Gaussian Boundary Delineation (GBD) algorithm to interpret black-box anomaly detection models in high-stakes domains. The method segments high-dimensional data, incorporates model predictions into decision criteria, and defines flexible boundaries to distinguish normal from anomalous data points. Evaluations across diverse datasets demonstrate superior explanation accuracy, fidelity, and robustness compared to existing methods.", "questions": "Are there any theoretical advancements or unique aspects of these methods distinguishing them from similar techniques?", "limitations": "The authors have adequately addressed the limitations of their work in section B.4 of the paper. They discuss several key limitations.", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. The proposed approach of using rule-based interpretations for anomaly detection results is intriguing, addressing a critical gap in the field and offering a fresh perspective on model explainability.\n2. The clarity of the empirical study is commendable, effectively showcasing the proposed method's robustness and versatility.", "weaknesses": "1.\tThe proposed method primarily builds upon some existing techniques. While the integration and adaptation of these techniques are innovative to some extent, the foundation lacks substantial originality. The approach leverages well-known concepts without introducing new theoretical insights or methodologies.\n2.\tThe clarity of the paper is compromised by the disorganized structure of the related work section. The related work section is somewhat disordered, making it challenging for readers to follow the logical flow of the discussion. To improve clarity, the sub-sections should be organized more coherently.\n3.\tWhile the current evaluation demonstrates the potential of the proposed method, using more advanced anomaly detection models and realistic datasets would provide a more comprehensive and convincing validation. (i) The experiments use AE, VAE, OC-SVM, and iForest as black-box models. To better illustrate the applicability and robustness of the proposed interpretation model, it would be beneficial to include the latest state-of-the-art deep anomaly detection models. (ii) The curse of dimensionality is highlighted as a challenge in the paper. However, the highest dimensionality of the datasets used in the experiments is only 80. The proposed method should be tested on datasets with much higher dimensions.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you! Your feedback has been invaluable in enhancing the clarity and impact of our work.\n> Comment 1:The proposed method primarily builds upon some existing techniques. ... While the integration and adaptation of these techniques are innovative to some extent, the foundation lacks substantial originality.\n\n**Response:**\nWhile it is true that our method integrates existing techniques like decision trees and Gaussian Processes, the novelty lies in how these techniques are combined and applied to the problem of interpreting black-box anomaly detection models in high-risk fields like cybersecurity. \n\nWe observed that traditional methods struggle with rule fitting for high-dimensional data due to their reliance on direct Euclidean distance calculations in feature space. To address this, we developed the SCD-Tree, which integrates anomaly detection model outputs directly into its splitting criteria. Unlike traditional decision trees, our approach leverages the decision-making results of black-box models to capture complex data distributions effectively and this unsupervised calculation method subverts traditional entropy-based approaches.\n\nIn addition, we recognized that outliers often exist within normal data in anomaly detection scenarios. Traditional methods typically have rigid decision boundaries, leading to reduced robustness and the potential for false alarms and is a significant concern in security field [1]. To mitigate this, we introduced the GBD algorithm, providing flexible boundaries that better accommodate data variability. By integrating GBD with the SCD-Tree, our method offers an interpretable, and robust framework for anomaly detection that maintains high fidelity to the original black-box models while reducing the incidence of false alarms.\n\n> Comment 2: The clarity of the paper is compromised by the disorganized structure of the related work section. ...To improve clarity, the sub-sections should be organized more coherently.\n\n**Response:**\nWe appreciate the advice on the related work. We have reorganized the related work section into clearer sub-sections, each focusing on a specific aspect of related research: Unsupervised Anomaly Detection Techniques, Interpretability in Anomaly Detection, Issues inside Existing interpretation Approaches in Anomaly Detection Models. Due to word limitations, we will provide you with the revised full related work section in the final version during the discussion phase.\n\nThank you very much for your advice. This reorganization helps to show the logical flow more clearly.\n\n> Comment 3(i): The experiments use AE, VAE, OC-SVM as black-box models. ... it would be beneficial to include the latest state-of-the-art deep anomaly detection models.\n\n**Response:**\nWe would have liked to demonstrate the fitness of our model with as classical a model as possible, and the experimental results bear this out. We acknowledge the importance of using state-of-the-art deep anomaly detection models. To address this, we have extended our experimental evaluation to include recent advanced models such as VRAE and DAGMM. The results are shown in Table 3 of the global response. These models represent the latest advancements in deep anomaly detection and provide a more comprehensive validation of our method's applicability.\n\n> Comment 3(ii): The curse of dimensionality is highlighted as a challenge in the paper. However, the highest dimensionality of the datasets used in the experiments is only 80. \n\n**Response:**\nWe appreciate your concern regarding the dimensionality of our datasets. In anomaly detection, the curse of dimensionality is particularly challenging due to the inherent sparsity and complexity of high-dimensional data. Although 80 features might appear moderate in other fields, they are considered high-dimensional within anomaly detection. We have carried out an exhaustive study of datasets in the field of anomaly detection and have added a summary table to the attachment of global response. Our chosen datasets, such as CIC-IDS2017, and TON-IoT, are standard benchmarks in this domain, typically ranging from 10 to 80 features. These dimensions capture the real-world complexity, each feature signifys a specific aspect of network traffic.\n\nIn practice, datasets with 80 features are sufficient for effective anomaly detection, as demonstrated by our method's high fidelity and robustness across these benchmarks. We have also added to the global response the results of our model's experiments on data of different dimensions, demonstrating its ability to handle high-dimensional data. Research has shown that more features do help in security tasks, so building datasets with a higher number of features is really the trend nowadays.\nWe are also in the process of collecting higher dimensional datasets about network packets, and in future work, we will also try to use our method to apply it to unstructured data to test its effectiveness in higher dimensional data.\n\n> Comment 4:Are there any theoretical advancements or unique aspects of these methods distinguishing them from similar techniques?\n\n**Response:**\nYes, our method introduces several theoretical advancements and unique aspects that distinguish it from similar techniques:\n\n- The SCD-Tree uses the outputs of anomaly detection models directly in its splitting criteria, which is a novel unsupervised approach to enhance the tree's ability to capture complex data distributions.\n- The GBD algorithm refines the decision boundaries within each segment using Gaussian Processes, providing a probabilistic framework that quantifies the uncertainty in boundary definitions, enhancing robustness against data drift.\n\nWe have also restated the necessity and innovation in global response, and thank you for your professional comments and suggestions.\n\nReference:\n\n[1] Hassan, Wajih Ul, et al. \"Nodoze: Combatting threat alert fatigue with automated provenance triage.\" network and distributed systems security symposium. 2019.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "LKosHWitih", "reviewer": "Reviewer_dX38", "summary": "The paper addresses the challenge of distinguishing between normal and anomalous structured data. A new method designed to interpret and understand the structure of normal data distributions. It integrates anomaly detection model predictions into its splitting criteria to enhance the clustering process. In addition, a complementary algorithm that defines boundaries within each segmented distribution is proposed.", "questions": "1. How to implement the SCD tree for unstructured data?\n\n2. What is the typical running efficiency?\n\n3. Considering the data drifts and perturbations, does the naive Gaussian-based assumption work for more heterogeneous drifting data?", "limitations": "The authors have broadly discussed the limitations of the work.\n\nMost of the concerns are discussed and clarified through the rebuttal stage. I would like to update thee overall score.", "rating": 6, "confidence": 2, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. The designed Gaussian boundary delineation algorithm helps in managing high-dimensional data and ensures robustness against data drift and perturbations.\n\n2. Extensive evaluations are conducted for comparisons against five established baseline anomaly detection models across four diverse datasets", "weaknesses": "1. The writing should be enhanced as some technical concepts are unclear. For example, a running example could be provided to explain the SCD tree and GBD algorithms.\n\n2. The work targets the structured, tabular data which should be clear at the beginning of the paper. How to build such an SCD tree for instructed data is not explored.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for your valuable feedback. We appreciate your insights and suggestions, which have helped us to improve our paper. \n\n> Comment 1: “The writing should be enhanced as some technical concepts are unclear. For example, a running example could be provided to explain the SCD tree and GBD algorithms.”\n\n**Response:**\nWe agree that a running example would greatly clarify the technical concepts of the SCD tree and GBD algorithms. We have added a detailed running example in Section 4.2, “Methodology Overview,” and pseudocode in Appendix A.2 where we walk through the entire process of constructing an SCD tree and applying the GBD algorithm using a sample dataset. This example includes:\n1. **Initial Data Segmentation (SCD-Tree)**\n    - The SCD-Tree uses the outputs of the anomaly detection model to segment the data.\n    - The tree structure is built by recursively splitting the data based on the model's outputs.\n\n2. **Boundary Delineation (GBD)**\n    - Within each segment, the GBD algorithm uses Gaussian Processes to define decision boundaries.\n    - For instance, in a segment with features A and B, the algorithm determines the boundary where the likelihood of being normal is highest.\n    - These boundaries are then refined to capture the nuances of the data distribution.\n\n3. **Rule Extraction**\n    - The refined boundaries are translated into interpretable rules.\n    - For the example dataset, a rule might be: \"If A > 5 and B < 10, then the data point is normal.\"\n\n> Comment 2.1: “The work targets the structured, tabular data which should be clear at the beginning of the paper.”\n\n**Response:**\nWe apologize for the lack of clarity regarding the data type our method targets. We have revised the introduction to explicitly state that our approach is designed for structured, tabular data. \nAdditionally, while our method is designed for structured, tabular data, we acknowledge the importance of extending interpretability methods to unstructured data (e.g., text, images). Potential strategies for applying the SCD-Tree to unstructured data include:\n- **Feature Engineering**: Transforming unstructured data into structured formats using techniques such as text vectorization or image feature extraction.\n- **Hierarchical Clustering**: Using hierarchical clustering to segment unstructured data before applying the SCD-Tree.\n\nWe will discuss these potential extensions further in the future work. Thank you for your carefully detailed suggestions, which helped us improve the comprehensibility of the article! \n\n> Comment 2.2: “ How to build such an SCD tree for unstructured data is not explored.”\n\n**Response:**\nIn future work we envisage Building SCD Tree for Unstructured Data.\nTo extend the SCD tree for unstructured data, such as images, we propose the following steps:\n\n1. **Image Data Feature Engineering**.\n    Use convolutional neural networks (CNNs) or other feature extraction techniques to convert images into feature vectors. Pretrained models (e.g., VGG16, ResNet) can be utilized to extract high-level features from images.\n\n2. **Data Segmentation (SCD-Tree)**. Once the unstructured data is transformed into a structured format, the SCD-Tree can be applied in the same manner as for structured data. The tree uses the extracted features(chhannel or patch granularity) to segment the data based on the anomaly detection model's outputs. Subsequent GBDs and Rule Extractions will work in the same way as the original.\n\n> Comment 3: “What is the typical running efficiency?”\n\n**Response:**\nWe appreciate the reviewer's interest in the running efficiency of our model. We have conducted a thorough evaluation of both the training and inference times of our method. Detailed results are presented in Appendix A.4.1, where we provide comprehensive performance metrics for various datasets.\n\nSpecifically, Figure 2c in the main manuscript illustrates the typical running efficiency. This figure shows the training and inference times for our proposed method across different data dimensions, highlighting its scalability and efficiency. The results indicate that while the training time scales with the number of features and data points, the inference time remains consistently low due to the rule-based nature of our method.\nThese findings demonstrate that our method is both efficient and scalable, making it suitable for deployment in high-stakes environments where timely decision-making is crucial.\n\n> Comment 4: “Considering the data drifts and perturbations, does the naive Gaussian-based assumption work for more heterogeneous drifting data?”\n\n**Response:**\nThe naive Gaussian-based assumptions can be effectively applied to more heterogeneous drift data. \n- The probabilistic nature of Gaussian Processes provides a measure of uncertainty in the predictions. This is particularly useful for heterogeneous drift data, as it allows the model to quantify the confidence in its predictions. \n- Gaussian Processes are inherently flexible and capable of modeling complex, non-linear relationships in data,  allowing GPs to adapt to local patterns and variations within the data. And GPs can dynamically adjust their parameters to capture the nuances of different segments, ensuring accurate representation of the underlying distributions.\n- In our methodology, the SCD-Tree initially segments the data into more homogeneous regions. Within each segment, the GBD algorithm applies the Gaussian-based assumptions which  ensures that GP are applied within localized regions where they are more likely to hold true, even if the overall data distribution is heterogeneous.\n\nThe experiments results in Table 3 of Section 6.3 show that our method maintains high fidelity and robustness, indicating that the Gaussian assumptions are sufficiently flexible to handle diverse and drifting data patterns.\n\nThank you for your constructive review. We hope these changes meet your expectations and look forward to any further comments you may have.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:
We are very glad that our efforts can clarify some of your concerns, and we really learn a lot from your valuable replies! Your suggestions are very meaningful and help us improve our work a lot!

We appreciate the reviewers' recognition of our paper's contribution to advancing anomaly detection in high-stakes environments ("The method is well formulated" by ZxG9, "address an important issue with anomaly detection" by kdm5,  " addressing a critical gap in the field and offering a fresh perspective on model explainability" by 7Q5n,  "addresses the challenge of distinguishing between normal and anomalous structured data" by dX38). 

We are very happy that the reviewers were interested in the innovativeness of our method and the reasons for using it! By providing explanations that are both accurate and comprehensible, our method increases the trustworthiness and reliability of anomaly detection systems in environments where precision and transparency are crucial.

**Novelty.** Our method uniquely combines the Segmentation Clustering Decision Tree (SCD-Tree) with Gaussian Boundary Delineation (GBD), offering a novel approach to enhancing interpretability and robustness in unsupervised anomaly detection. 
- We observed that traditional methods struggle with rule fitting in high-dimensional data due to the complexity and sparsity of such datasets. To tackle this, we developed the SCD-Tree, which differs from conventional decision trees that rely on Euclidean distances for splits. Instead, our approach integrates predictions from black-box models directly into the tree's splitting criteria, enhancing its ability to identify distinct data patterns and extract meaningful rules. This innovative unsupervised method overcomes the limitations of entropy-based calculations, enabling better utilization and comprehension of black-box model insights.
The SCD-Tree partitions data into meaningful segments, ensuring each segment represents a distinct data pattern, facilitating the extraction of interpretable rules. Data segmentation is also an important way in which our model is able to handle high-dimensional data.

- In anomaly detection scenarios, normal data often contain outliers, and existing rule extraction methods with rigid boundaries fail to accommodate these variations, leading to issues like "false alarm/alert fatigue," a significant concern in cybersecurity. To address this, we incorporated the Gaussian Boundary Delineation to provide a probabilistic framework that defines boundaries and quantifies associated uncertainty, enhancing model robustness by adapting to data variability. This integration ensures that boundaries are flexible and resilient, accommodating shifts in data patterns and improving overall interpretability. 
- It consistently achieves high fidelity, shows that the rule-based explanations closely align with original model predictions. The system's robustness is evident in its stable performance across diverse datasets and evolving environments. High TPR and TNR metrics further confirm the effectiveness of our algorithms, indicating accurate identification of normal and anomalous instances. These results underscore the accuracy and reliability of our method, validating its deployment suitability in high-stakes environments where precision is paramount.

**Additional Experiments.** To address reviewers' questions and reinforce our claims, we conducted additional experiments using different domain datasets (CIC-IoT from IoT, Credit Card Fraud Detection  from financial, and dataset Breast Cancer Wisconsin from the healthcare domain) and state-of-the-art anomaly detection models (LSTM, OC-NN, VRAE, DAGMM) . Our model achieves nearly the highest TPR and fidelity on different domain datasets and consistently showed high accuracy , with VRAE achieving a TPR of 0.9643 and DAGMM a TPR of 0.9931 on the CIC-IDS dataset, illustrating its robustness across cutting-edge models. And ablation experiments showing that our method can achieve a 0.12-point lift demonstrate its applicability in interpretation. At the same time, we provide information to show the model's interpretability capabilities in the field of anomaly detection. The results of these additional experiments are presented in a detailed table in the attached PDF.

**Related Work.** Based on the reviewers' suggestions and requests, we have refactored the related work section and added the comparative advantages of the model with the latest work. The modified "Related Work" section is structured to provide a comprehensive overview of existing research in anomaly detection and model interpretability, specifically addressing: Overview of Anomaly Detection Models, Interpretability in Anomaly Detection and  Issues inside Existing interpretation Approaches. In the final version, we will also add some experimental results in Appendix that we promised to the reviewers to improve the quality of our work.

Again, thank you for your comments. We have made efforts to address the concerns raised, and we hope our revisions meet your expectations. Should there be any further questions or if additional clarifications are needed, we are more than willing to engage in further discussions or conduct additional experiments as necessary during the review phase.

Meta-review: The paper receives four reviews, all of which are inclined to accept the paper. Prior to rebuttal, Reviewers ZxG9 and kdm5 have some major concerns over the robustness of the proposed method, its reliance on the initial black-box model, and the justification of the main claims in the paper. These concerns are addressed properly by the authors' rebuttal, resulting in an increase of their rating to weak accept. In addition, Reviewer dX38 has concerns over the ability of handling non-tabular data, computational efficiency, and the Gaussian-based assumption issue. After multi-round interaction, Reviewer dX38 agrees that these concerns are also mostly addressed and raises the overall score to weak accept. Reviewer ZxG9 has been positive toward the paper from the initial review and keeps the rating after the rebuttal.

On the other hand, there are some weaknesses that might have not been sufficiently addressed, such as the lack of more recent deep anomaly detection methods, small dimensionality size across all datasets used, and limiting to tabular data. 

Overall, the work presents an interesting method that leverages Segmentation Clustering Decision Tree (SCD-Tree) and Gaussian Boundary Delineation (GBD) to provide interpretation for anomalies detected by existing methods. All reviewers give positive recommendation to the work. Thus, I recommend accepting the paper. The authors should incorporate the new discussions and empirical results into the camera ready to avoid confusions/concerns raised in the reviews. Adding discussions on the above weaknesses would enhance the paper further.
Decision: Accept (poster)