Research map / Label-efficient and robust learning / OOD and anomaly detection
Dissect Black Box: Interpreting for Rule-Based Explanations in Unsupervised Anomaly Detection
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes SCD-Tree (a decision tree split on black-box anomaly scores) plus Gaussian Boundary Delineation to extract global rule-based explanations of unsupervised anomaly detectors on tabular security data.
Problem
Black-box unsupervised anomaly detection models lack interpretability; existing rule-based surrogates lose fidelity on high-dimensional, multimodal tabular security data and handle data variability poorly.
Approach
A decision tree (SCD-Tree) whose splits use the black-box anomaly model's outputs to segment normal data into clusters, followed by Gaussian Process based boundary delineation within each segment to produce interpretable per-feature rule sets.
Key results
- With VAE as black box on CIC-IDS2017, the method reports CR 0.9975, precision 0.9992, recall 0.9979, F1 0.9986 (Table 5/6).
- Ablation: adding GBD raises VAE fidelity from 0.928 to 0.9978 and TP rate from 0.9422 to 0.9979 (Table 4).
- Across black models on CIC-IDS, the method reports TPR 0.915-0.997 and TNR up to 0.9962, outperforming UAD, EGDT, Trustee, LIME and KD in its own tables.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use SCD-Tree+GBD instead of LIME | VAE rule extraction · CIC-IDS | TPR: 0.9063 -> 0.915 | Helped |
| Use SCD-Tree+GBD instead of LIME | VAE rule extraction · CIC-IDS | FD: 0.941 -> 0.9453 | Helped |
| Use SCD-Tree+GBD instead of LIME | VAE rule extraction · KddCup99 | TPR: 0.9292 -> 0.9971 | Helped |
| Use SCD-Tree+GBD instead of EGDT | VAE rule extraction · KddCup99 | FD: 0.9874 -> 0.9913 | Helped |
| Use SCD-Tree+GBD instead of Trustee | VAE rule extraction · TON-IoT | TPR: 0.9998 -> 1.00 | Helped |
| Use SCD-Tree+GBD instead of EGDT | VAE rule extraction · TON-IoT | FD: 0.8145 -> 0.9936 | Helped |
| Use SCD-Tree+GBD instead of EGDT | VAE rule extraction · Webpages | TPR: 0.8378 -> 0.898 | Helped |
| Use SCD-Tree+GBD instead of EGDT | VAE rule extraction · Webpages | FD: 0.8378 -> 0.998 | Helped |
| Add GBD (ablation) | VAE · CIC-IDS | TP: 0.9422 -> 0.9979 (↑0.0557) | Helped |
| Add GBD (ablation) | VAE · CIC-IDS | FD: 0.928 -> 0.9978 (↑0.0698) | Helped |
| Add GBD (ablation) | VAE · CIC-IDS | FP: 0.0035 -> 0.01 | Hurt |
| Add GBD (ablation) | AE · CIC-IDS | TP: 0.8122 -> 0.9356 (↑0.1234) | Helped |
Limitations
- Applicable mainly to structured tabular data; unstructured data needs a feature-extraction step first.
- Extracted rules are axis-aligned, limiting capture of non-linear decision boundaries.
- Interpretability has not been validated with structured user or expert studies.
Experimental setup
Datasets: Malicious and Benign Webpages KDDCup99 CIC-IDS TON-IoT Credit Card Fraud Detection CIC-IoT Breast Cancer Wisconsin
Benchmarks: Malicious and Benign Webpages KDDCup99 CIC-IDS TON-IoT CIC-IDS2017
Metrics: TPR TNR fidelity robustness CR precision recall F1
Baselines: UAD rule extraction EGDT Trustee LIME KD
Builds on: CART Trustee Gaussian processes
Closest papers by meaning
- Towards a Unified Framework of Clustering-based Anomaly Detection (ICML 2025 · similarity 0.87)
- Graph Anomaly Detection as Dynamical Transport: Training-Free Scoring via Empirical Bayes (NeurIPS 2026 · similarity 0.84)
- Unifying Unsupervised Graph-Level Anomaly Detection and Out-of-Distribution Detection: A Benchmark (ICLR 2025 · similarity 0.83)
- ScatterAD: Temporal-Topological Scattering Mechanism for Time Series Anomaly Detection (NeurIPS 2025 · similarity 0.83)
- SEAD: Unsupervised Ensemble of Streaming Anomaly Detectors (ICML 2025 · similarity 0.83)
- ARC: A Generalist Graph Anomaly Detector with In-Context Learning (NeurIPS 2024 · similarity 0.83)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.