{"id":"https://openalex.org/W7131308074","doi":"https://doi.org/10.1109/tdsc.2026.3667688","title":"Ano2Rule: Rule-Based Global Interpretation for Unsupervised Anomaly Detection in Security","display_name":"Ano2Rule: Rule-Based Global Interpretation for Unsupervised Anomaly Detection in Security","publication_year":2026,"publication_date":"2026-02-24","ids":{"openalex":"https://openalex.org/W7131308074","doi":"https://doi.org/10.1109/tdsc.2026.3667688"},"language":"en","primary_location":{"id":"doi:10.1109/tdsc.2026.3667688","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tdsc.2026.3667688","pdf_url":null,"source":{"id":"https://openalex.org/S133795288","display_name":"IEEE Transactions on Dependable and Secure Computing","issn_l":"1545-5971","issn":["1545-5971","1941-0018","2160-9209"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320439","host_organization_name":"IEEE Computer Society","host_organization_lineage":["https://openalex.org/P4310320439","https://openalex.org/P4310319808"],"host_organization_lineage_names":["IEEE Computer Society","Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Dependable and Secure Computing","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5126738706","display_name":"Ruoyu Li","orcid":null},"institutions":[{"id":"https://openalex.org/I180726961","display_name":"Shenzhen University","ror":"https://ror.org/01vy4gh70","country_code":"CN","type":"education","lineage":["https://openalex.org/I180726961"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Ruoyu Li","raw_affiliation_strings":["College of Computer Science and Software Engineering, Shenzhen University, Shenzhen, China"],"raw_orcid":"https://orcid.org/0000-0003-0754-2817","affiliations":[{"raw_affiliation_string":"College of Computer Science and Software Engineering, Shenzhen University, Shenzhen, China","institution_ids":["https://openalex.org/I180726961"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5082701959","display_name":"Yuchen Zhang","orcid":"https://orcid.org/0000-0001-5615-0946"},"institutions":[{"id":"https://openalex.org/I99065089","display_name":"Tsinghua University","ror":"https://ror.org/03cve4549","country_code":"CN","type":"education","lineage":["https://openalex.org/I99065089"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yu Zhang","raw_affiliation_strings":["Tsinghua University, Beijing, China"],"raw_orcid":"https://orcid.org/0000-0001-8968-6683","affiliations":[{"raw_affiliation_string":"Tsinghua University, Beijing, China","institution_ids":["https://openalex.org/I99065089"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5126710246","display_name":"Qing Li","orcid":null},"institutions":[{"id":"https://openalex.org/I4210136793","display_name":"Peng Cheng Laboratory","ror":"https://ror.org/03qdqbt06","country_code":"CN","type":"facility","lineage":["https://openalex.org/I4210136793"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Qing Li","raw_affiliation_strings":["Department of Strategic and Advanced Interdisciplinary Research, Peng Cheng Laboratory, Shenzhen, China"],"raw_orcid":"https://orcid.org/0000-0002-6071-473X","affiliations":[{"raw_affiliation_string":"Department of Strategic and Advanced Interdisciplinary Research, Peng Cheng Laboratory, Shenzhen, China","institution_ids":["https://openalex.org/I4210136793"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5045411027","display_name":"Ning Wu","orcid":"https://orcid.org/0000-0002-1899-2648"},"institutions":[{"id":"https://openalex.org/I150229711","display_name":"University of Electronic Science and Technology of China","ror":"https://ror.org/04qr3zq92","country_code":"CN","type":"education","lineage":["https://openalex.org/I150229711"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Nengwu Wu","raw_affiliation_strings":["School of Computer Science and Engineering, University of Electronic Science and Technology of China, Chengdu, China"],"raw_orcid":"https://orcid.org/0009-0002-5200-6781","affiliations":[{"raw_affiliation_string":"School of Computer Science and Engineering, University of Electronic Science and Technology of China, Chengdu, China","institution_ids":["https://openalex.org/I150229711"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5101510343","display_name":"Yi\u2010Fan Jiang","orcid":null},"institutions":[{"id":"https://openalex.org/I3131625388","display_name":"University Town of Shenzhen","ror":"https://ror.org/05f5j6225","country_code":"CN","type":"education","lineage":["https://openalex.org/I3131625388"]},{"id":"https://openalex.org/I99065089","display_name":"Tsinghua University","ror":"https://ror.org/03cve4549","country_code":"CN","type":"education","lineage":["https://openalex.org/I99065089"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yong Jiang","raw_affiliation_strings":["Shenzhen International Graduate School, Tsinghua University, Shenzhen, China"],"raw_orcid":"https://orcid.org/0000-0002-4260-1395","affiliations":[{"raw_affiliation_string":"Shenzhen International Graduate School, Tsinghua University, Shenzhen, China","institution_ids":["https://openalex.org/I3131625388","https://openalex.org/I99065089"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5122872472","display_name":"Weizhi Meng","orcid":null},"institutions":[{"id":"https://openalex.org/I67415387","display_name":"Lancaster University","ror":"https://ror.org/04f2nsd36","country_code":"GB","type":"education","lineage":["https://openalex.org/I67415387"]}],"countries":["GB"],"is_corresponding":false,"raw_author_name":"Weizhi Meng","raw_affiliation_strings":["School of Computing and Communications, Lancaster University, Lancaster, U.K"],"raw_orcid":"https://orcid.org/0000-0003-4384-5786","affiliations":[{"raw_affiliation_string":"School of Computing and Communications, Lancaster University, Lancaster, U.K","institution_ids":["https://openalex.org/I67415387"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5121317103","display_name":"Laizhong Cui","orcid":null},"institutions":[{"id":"https://openalex.org/I180726961","display_name":"Shenzhen University","ror":"https://ror.org/01vy4gh70","country_code":"CN","type":"education","lineage":["https://openalex.org/I180726961"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Laizhong Cui","raw_affiliation_strings":["College of Computer Science and Software Engineering, Shenzhen University, Shenzhen, China"],"raw_orcid":"https://orcid.org/0000-0003-1991-290X","affiliations":[{"raw_affiliation_string":"College of Computer Science and Software Engineering, Shenzhen University, Shenzhen, China","institution_ids":["https://openalex.org/I180726961"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":6,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.16592431,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":"23","issue":"3","first_page":"6685","last_page":"6702"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.2492000013589859,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.2492000013589859,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11512","display_name":"Anomaly Detection Techniques and Applications","score":0.13699999451637268,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12026","display_name":"Explainable Artificial Intelligence (XAI)","score":0.11729999631643295,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/interpretability","display_name":"Interpretability","score":0.8032000064849854},{"id":"https://openalex.org/keywords/anomaly-detection","display_name":"Anomaly detection","score":0.620199978351593},{"id":"https://openalex.org/keywords/robustness","display_name":"Robustness (evolution)","score":0.6134999990463257},{"id":"https://openalex.org/keywords/cluster-analysis","display_name":"Cluster analysis","score":0.5720999836921692},{"id":"https://openalex.org/keywords/inference","display_name":"Inference","score":0.5533999800682068},{"id":"https://openalex.org/keywords/intrusion-detection-system","display_name":"Intrusion detection system","score":0.536300003528595},{"id":"https://openalex.org/keywords/unsupervised-learning","display_name":"Unsupervised learning","score":0.45249998569488525},{"id":"https://openalex.org/keywords/fidelity","display_name":"Fidelity","score":0.4278999865055084}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8144999742507935},{"id":"https://openalex.org/C2781067378","wikidata":"https://www.wikidata.org/wiki/Q17027399","display_name":"Interpretability","level":2,"score":0.8032000064849854},{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.620199978351593},{"id":"https://openalex.org/C63479239","wikidata":"https://www.wikidata.org/wiki/Q7353546","display_name":"Robustness (evolution)","level":3,"score":0.6134999990463257},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.583299994468689},{"id":"https://openalex.org/C73555534","wikidata":"https://www.wikidata.org/wiki/Q622825","display_name":"Cluster analysis","level":2,"score":0.5720999836921692},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.5641999840736389},{"id":"https://openalex.org/C2776214188","wikidata":"https://www.wikidata.org/wiki/Q408386","display_name":"Inference","level":2,"score":0.5533999800682068},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.536300003528595},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.47909998893737793},{"id":"https://openalex.org/C8038995","wikidata":"https://www.wikidata.org/wiki/Q1152135","display_name":"Unsupervised learning","level":2,"score":0.45249998569488525},{"id":"https://openalex.org/C2776459999","wikidata":"https://www.wikidata.org/wiki/Q2119376","display_name":"Fidelity","level":2,"score":0.4278999865055084},{"id":"https://openalex.org/C67186912","wikidata":"https://www.wikidata.org/wiki/Q367664","display_name":"Data modeling","level":2,"score":0.39820000529289246},{"id":"https://openalex.org/C42023084","wikidata":"https://www.wikidata.org/wiki/Q5249231","display_name":"Decision boundary","level":3,"score":0.3700000047683716},{"id":"https://openalex.org/C153180895","wikidata":"https://www.wikidata.org/wiki/Q7148389","display_name":"Pattern recognition (psychology)","level":2,"score":0.30640000104904175},{"id":"https://openalex.org/C98045186","wikidata":"https://www.wikidata.org/wiki/Q205663","display_name":"Process (computing)","level":2,"score":0.2842000126838684},{"id":"https://openalex.org/C39235581","wikidata":"https://www.wikidata.org/wiki/Q5158434","display_name":"Conceptual clustering","level":5,"score":0.2720000147819519},{"id":"https://openalex.org/C62354387","wikidata":"https://www.wikidata.org/wiki/Q875399","display_name":"Boundary (topology)","level":2,"score":0.26429998874664307},{"id":"https://openalex.org/C84525736","wikidata":"https://www.wikidata.org/wiki/Q831366","display_name":"Decision tree","level":2,"score":0.26100000739097595},{"id":"https://openalex.org/C114289077","wikidata":"https://www.wikidata.org/wiki/Q3284399","display_name":"Statistical model","level":2,"score":0.2556999921798706},{"id":"https://openalex.org/C89198739","wikidata":"https://www.wikidata.org/wiki/Q3079880","display_name":"Data stream mining","level":2,"score":0.2547999918460846},{"id":"https://openalex.org/C45493050","wikidata":"https://www.wikidata.org/wiki/Q7884934","display_name":"Unified Model","level":2,"score":0.25049999356269836}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.1109/tdsc.2026.3667688","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tdsc.2026.3667688","pdf_url":null,"source":{"id":"https://openalex.org/S133795288","display_name":"IEEE Transactions on Dependable and Secure Computing","issn_l":"1545-5971","issn":["1545-5971","1941-0018","2160-9209"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320439","host_organization_name":"IEEE Computer Society","host_organization_lineage":["https://openalex.org/P4310320439","https://openalex.org/P4310319808"],"host_organization_lineage_names":["IEEE Computer Society","Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Dependable and Secure Computing","raw_type":"journal-article"},{"id":"pmh:oai:eprints.lancs.ac.uk:236142","is_oa":false,"landing_page_url":null,"pdf_url":null,"source":{"id":"https://openalex.org/S4306401916","display_name":"Lancaster EPrints (Lancaster University)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I67415387","host_organization_name":"Lancaster University","host_organization_lineage":["https://openalex.org/I67415387"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"acceptedVersion","is_accepted":true,"is_published":false,"raw_source_name":null,"raw_type":"Journal Article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G2508000532","display_name":null,"funder_award_id":"2026A1515011368","funder_id":"https://openalex.org/F4320337111","funder_display_name":"Basic and Applied Basic Research Foundation of Guangdong Province"},{"id":"https://openalex.org/G2562170337","display_name":null,"funder_award_id":"62502324","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G4890515615","display_name":null,"funder_award_id":"U23B2026","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G7977396242","display_name":null,"funder_award_id":"62372305","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G8962480360","display_name":null,"funder_award_id":"2024B1515040012","funder_id":"https://openalex.org/F4320337111","funder_display_name":"Basic and Applied Basic Research Foundation of Guangdong Province"}],"funders":[{"id":"https://openalex.org/F4320321001","display_name":"National Natural Science Foundation of China","ror":"https://ror.org/01h0zpd94"},{"id":"https://openalex.org/F4320337111","display_name":"Basic and Applied Basic Research Foundation of Guangdong Province","ror":null}],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"In":[0],"the":[1,24,60,69,79,102,106,112,120,128,132,153,157,175,213],"realm":[2],"of":[3,27,62,71,82,131,144,156],"cybersecurity,":[4],"unsupervised":[5,63,96,158],"anomaly":[6,64],"detection":[7,191],"models":[8,30],"have":[9],"emerged":[10],"as":[11],"pivotal":[12],"tools":[13],"for":[14,46,171],"identifying":[15],"novel":[16],"threats":[17],"in":[18,38,161],"dynamic":[19],"and":[20,48,165,192,198],"evolving":[21],"environments.":[22],"However,":[23],"opaque":[25],"nature":[26],"these":[28,141],"black-box":[29,159],"presents":[31,52],"a":[32,53,147,162,167],"significant":[33],"barrier":[34],"to":[35,118,201],"their":[36],"adoption":[37],"high-stakes":[39],"applications,":[40],"where":[41],"model":[42,103,134,160,170],"interpretability":[43,61],"is":[44],"essential":[45],"trust":[47],"deployment.":[49],"This":[50],"paper":[51],"rule-based":[54,169],"approach":[55],"called":[56],"Ano2Rule":[57,180,208],"that":[58,77,100,126,207],"enhances":[59],"detection.":[65],"First,":[66],"we":[67,93,110,150],"propose":[68,111],"concept":[70],"<italic":[72,121],"xmlns:mml=\"http://www.w3.org/1998/Math/MathML\"":[73,122],"xmlns:xlink=\"http://www.w3.org/1999/xlink\">distribution":[74],"decomposition":[75],"rules</i>":[76,125],"decompose":[78],"complex":[80],"distribution":[81],"normal":[83],"data":[84],"into":[85,105,146],"multiple":[86],"compositional":[87,137],"distributions.":[88],"To":[89],"find":[90],"such":[91],"rules,":[92],"design":[94],"an":[95],"Interior":[97],"Clustering":[98],"Tree":[99],"incorporates":[101],"prediction":[104],"splitting":[107],"criteria.":[108],"Then,":[109],"Compositional":[113],"Boundary":[114],"Exploration":[115],"(CBE)":[116],"algorithm":[117],"obtain":[119],"xmlns:xlink=\"http://www.w3.org/1999/xlink\">boundary":[123],"inference":[124],"estimate":[127],"decision":[129],"boundary":[130],"original":[133,214],"on":[135,184],"each":[136],"distribution.":[138],"By":[139],"merging":[140],"two":[142],"types":[143],"rules":[145],"rule":[148],"set,":[149],"can":[151],"present":[152],"inferential":[154],"process":[155],"human-understandable":[163,219],"way,":[164],"build":[166],"surrogate":[168],"online":[172],"deployment":[173],"at":[174],"same":[176],"time.":[177],"We":[178],"validate":[179],"through":[181],"extensive":[182],"experiments":[183],"diverse":[185],"real-world":[186],"datasets,":[187],"including":[188],"network":[189],"intrusion":[190],"IoT":[193],"security,":[194],"demonstrating":[195],"superior":[196],"fidelity":[197,211],"robustness":[199],"compared":[200],"baseline":[202],"methods.":[203],"The":[204],"results":[205],"show":[206],"achieves":[209],"high":[210],"with":[212],"model's":[215],"predictions":[216],"while":[217],"providing":[218],"insights.":[220]},"counts_by_year":[],"updated_date":"2026-05-15T06:05:50.897203","created_date":"2026-02-25T00:00:00"}