{"id":"https://openalex.org/W4405182489","doi":"https://doi.org/10.1145/3658644.3670375","title":"Rules Refine the Riddle: Global Explanation for Deep Learning-Based Anomaly Detection in Security Applications","display_name":"Rules Refine the Riddle: Global Explanation for Deep Learning-Based Anomaly Detection in Security Applications","publication_year":2024,"publication_date":"2024-12-02","ids":{"openalex":"https://openalex.org/W4405182489","doi":"https://doi.org/10.1145/3658644.3670375"},"language":"en","primary_location":{"id":"doi:10.1145/3658644.3670375","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3658644.3670375","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3658644.3670375","source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://dl.acm.org/doi/pdf/10.1145/3658644.3670375","any_repository_has_fulltext":null},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5016545058","display_name":"Dongqi Han","orcid":"https://orcid.org/0000-0002-0807-5934"},"institutions":[{"id":"https://openalex.org/I99065089","display_name":"Tsinghua University","ror":"https://ror.org/03cve4549","country_code":"CN","type":"education","lineage":["https://openalex.org/I99065089"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Dongqi Han","raw_affiliation_strings":["Tsinghua University & Zhongguancun Laboratory, Beijing, China"],"raw_orcid":"https://orcid.org/0000-0002-0807-5934","affiliations":[{"raw_affiliation_string":"Tsinghua University & Zhongguancun Laboratory, Beijing, China","institution_ids":["https://openalex.org/I99065089"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100343127","display_name":"Zhiliang Wang","orcid":"https://orcid.org/0000-0001-6587-820X"},"institutions":[{"id":"https://openalex.org/I99065089","display_name":"Tsinghua University","ror":"https://ror.org/03cve4549","country_code":"CN","type":"education","lineage":["https://openalex.org/I99065089"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Zhiliang Wang","raw_affiliation_strings":["Tsinghua University & Zhongguancun Laboratory, Beijing, China"],"raw_orcid":"https://orcid.org/0000-0001-6587-820X","affiliations":[{"raw_affiliation_string":"Tsinghua University & Zhongguancun Laboratory, Beijing, China","institution_ids":["https://openalex.org/I99065089"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5032257261","display_name":"Ruitao Feng","orcid":"https://orcid.org/0000-0001-9080-6865"},"institutions":[{"id":"https://openalex.org/I79891267","display_name":"Singapore Management University","ror":"https://ror.org/050qmg959","country_code":"SG","type":"education","lineage":["https://openalex.org/I79891267"]}],"countries":["SG"],"is_corresponding":false,"raw_author_name":"Ruitao Feng","raw_affiliation_strings":["Singapore Management University, Singapore, Singapore"],"raw_orcid":"https://orcid.org/0000-0001-9080-6865","affiliations":[{"raw_affiliation_string":"Singapore Management University, Singapore, Singapore","institution_ids":["https://openalex.org/I79891267"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5087749148","display_name":"Minghui Jin","orcid":"https://orcid.org/0000-0001-7198-2687"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Minghui Jin","raw_affiliation_strings":["State Grid Shanghai Municipal Electric Power Company, Shanghai, China"],"raw_orcid":"https://orcid.org/0000-0001-7198-2687","affiliations":[{"raw_affiliation_string":"State Grid Shanghai Municipal Electric Power Company, Shanghai, China","institution_ids":[]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5101921959","display_name":"Wenqi Chen","orcid":"https://orcid.org/0000-0003-2326-8766"},"institutions":[{"id":"https://openalex.org/I99065089","display_name":"Tsinghua University","ror":"https://ror.org/03cve4549","country_code":"CN","type":"education","lineage":["https://openalex.org/I99065089"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Wenqi Chen","raw_affiliation_strings":["Tsinghua University & Zhongguancun Laboratory, Beijing, China"],"raw_orcid":"https://orcid.org/0000-0003-2326-8766","affiliations":[{"raw_affiliation_string":"Tsinghua University & Zhongguancun Laboratory, Beijing, China","institution_ids":["https://openalex.org/I99065089"]}]},{"author_position":"middle","author":{"id":null,"display_name":"Kai Wang","orcid":"https://orcid.org/0009-0005-7516-9534"},"institutions":[{"id":"https://openalex.org/I99065089","display_name":"Tsinghua University","ror":"https://ror.org/03cve4549","country_code":"CN","type":"education","lineage":["https://openalex.org/I99065089"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Kai Wang","raw_affiliation_strings":["Tsinghua University & Zhongguancun Laboratory, Beijing, China"],"raw_orcid":"https://orcid.org/0009-0005-7516-9534","affiliations":[{"raw_affiliation_string":"Tsinghua University & Zhongguancun Laboratory, Beijing, China","institution_ids":["https://openalex.org/I99065089"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100463046","display_name":"Su Wang","orcid":"https://orcid.org/0000-0001-7094-8890"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Su Wang","raw_affiliation_strings":["Zhongguancun Laboratory, Beijing, China"],"raw_orcid":"https://orcid.org/0000-0001-7094-8890","affiliations":[{"raw_affiliation_string":"Zhongguancun Laboratory, Beijing, China","institution_ids":[]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5023416195","display_name":"Jiahai Yang","orcid":"https://orcid.org/0000-0001-6109-6737"},"institutions":[{"id":"https://openalex.org/I99065089","display_name":"Tsinghua University","ror":"https://ror.org/03cve4549","country_code":"CN","type":"education","lineage":["https://openalex.org/I99065089"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Jiahai Yang","raw_affiliation_strings":["Tsinghua University & Zhongguancun Laboratory, Beijing, China"],"raw_orcid":"https://orcid.org/0000-0001-6109-6737","affiliations":[{"raw_affiliation_string":"Tsinghua University & Zhongguancun Laboratory, Beijing, China","institution_ids":["https://openalex.org/I99065089"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5047888843","display_name":"Xingang Shi","orcid":"https://orcid.org/0000-0001-6487-9526"},"institutions":[{"id":"https://openalex.org/I99065089","display_name":"Tsinghua University","ror":"https://ror.org/03cve4549","country_code":"CN","type":"education","lineage":["https://openalex.org/I99065089"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Xingang Shi","raw_affiliation_strings":["Tsinghua University & Zhongguancun Laboratory, Beijing, China"],"raw_orcid":"https://orcid.org/0000-0001-6487-9526","affiliations":[{"raw_affiliation_string":"Tsinghua University & Zhongguancun Laboratory, Beijing, China","institution_ids":["https://openalex.org/I99065089"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5101679340","display_name":"Xia Yin","orcid":"https://orcid.org/0000-0003-3374-544X"},"institutions":[{"id":"https://openalex.org/I99065089","display_name":"Tsinghua University","ror":"https://ror.org/03cve4549","country_code":"CN","type":"education","lineage":["https://openalex.org/I99065089"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Xia Yin","raw_affiliation_strings":["Tsinghua University & Zhongguancun Laboratory, Beijing, China"],"raw_orcid":"https://orcid.org/0000-0003-3374-544X","affiliations":[{"raw_affiliation_string":"Tsinghua University & Zhongguancun Laboratory, Beijing, China","institution_ids":["https://openalex.org/I99065089"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5100355692","display_name":"Yang Liu","orcid":"https://orcid.org/0000-0001-7300-9215"},"institutions":[{"id":"https://openalex.org/I172675005","display_name":"Nanyang Technological University","ror":"https://ror.org/02e7b5302","country_code":"SG","type":"education","lineage":["https://openalex.org/I172675005"]}],"countries":["SG"],"is_corresponding":false,"raw_author_name":"Yang Liu","raw_affiliation_strings":["Nanyang Technological University, Singapore, Singapore"],"raw_orcid":"https://orcid.org/0000-0001-7300-9215","affiliations":[{"raw_affiliation_string":"Nanyang Technological University, Singapore, Singapore","institution_ids":["https://openalex.org/I172675005"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":3,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":true,"cited_by_count":3,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"4509","last_page":"4523"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11512","display_name":"Anomaly Detection Techniques and Applications","score":0.9997000098228455,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11512","display_name":"Anomaly Detection Techniques and Applications","score":0.9997000098228455,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12127","display_name":"Software System Performance and Reliability","score":0.998199999332428,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9980000257492065,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/interpretability","display_name":"Interpretability","score":0.9534516334533691},{"id":"https://openalex.org/keywords/anomaly-detection","display_name":"Anomaly detection","score":0.759610652923584},{"id":"https://openalex.org/keywords/deep-learning","display_name":"Deep learning","score":0.718317985534668},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.6754086017608643},{"id":"https://openalex.org/keywords/software-deployment","display_name":"Software deployment","score":0.6236562728881836},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.6174328923225403},{"id":"https://openalex.org/keywords/focus","display_name":"Focus (optics)","score":0.5159667134284973},{"id":"https://openalex.org/keywords/anomaly","display_name":"Anomaly (physics)","score":0.513498842716217},{"id":"https://openalex.org/keywords/field","display_name":"Field (mathematics)","score":0.4945215880870819},{"id":"https://openalex.org/keywords/machine-learning","display_name":"Machine learning","score":0.47325780987739563},{"id":"https://openalex.org/keywords/data-science","display_name":"Data science","score":0.33647987246513367},{"id":"https://openalex.org/keywords/mathematics","display_name":"Mathematics","score":0.0546799898147583}],"concepts":[{"id":"https://openalex.org/C2781067378","wikidata":"https://www.wikidata.org/wiki/Q17027399","display_name":"Interpretability","level":2,"score":0.9534516334533691},{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.759610652923584},{"id":"https://openalex.org/C108583219","wikidata":"https://www.wikidata.org/wiki/Q197536","display_name":"Deep learning","level":2,"score":0.718317985534668},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6754086017608643},{"id":"https://openalex.org/C105339364","wikidata":"https://www.wikidata.org/wiki/Q2297740","display_name":"Software deployment","level":2,"score":0.6236562728881836},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.6174328923225403},{"id":"https://openalex.org/C192209626","wikidata":"https://www.wikidata.org/wiki/Q190909","display_name":"Focus (optics)","level":2,"score":0.5159667134284973},{"id":"https://openalex.org/C12997251","wikidata":"https://www.wikidata.org/wiki/Q567560","display_name":"Anomaly (physics)","level":2,"score":0.513498842716217},{"id":"https://openalex.org/C9652623","wikidata":"https://www.wikidata.org/wiki/Q190109","display_name":"Field (mathematics)","level":2,"score":0.4945215880870819},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.47325780987739563},{"id":"https://openalex.org/C2522767166","wikidata":"https://www.wikidata.org/wiki/Q2374463","display_name":"Data science","level":1,"score":0.33647987246513367},{"id":"https://openalex.org/C33923547","wikidata":"https://www.wikidata.org/wiki/Q395","display_name":"Mathematics","level":0,"score":0.0546799898147583},{"id":"https://openalex.org/C26873012","wikidata":"https://www.wikidata.org/wiki/Q214781","display_name":"Condensed matter physics","level":1,"score":0.0},{"id":"https://openalex.org/C121332964","wikidata":"https://www.wikidata.org/wiki/Q413","display_name":"Physics","level":0,"score":0.0},{"id":"https://openalex.org/C202444582","wikidata":"https://www.wikidata.org/wiki/Q837863","display_name":"Pure mathematics","level":1,"score":0.0},{"id":"https://openalex.org/C120665830","wikidata":"https://www.wikidata.org/wiki/Q14620","display_name":"Optics","level":1,"score":0.0},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1145/3658644.3670375","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3658644.3670375","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3658644.3670375","source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security","raw_type":"proceedings-article"}],"best_oa_location":{"id":"doi:10.1145/3658644.3670375","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3658644.3670375","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3658644.3670375","source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security","raw_type":"proceedings-article"},"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G2845024004","display_name":null,"funder_award_id":"62172251","funder_id":"https://openalex.org/F4320323817","funder_display_name":"Universitas Brawijaya"},{"id":"https://openalex.org/G6036235291","display_name":null,"funder_award_id":"NCRP25-P04-TAICeN","funder_id":"https://openalex.org/F4320320709","funder_display_name":"National Research Foundation Singapore"},{"id":"https://openalex.org/G6419233385","display_name":null,"funder_award_id":"62172251","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"}],"funders":[{"id":"https://openalex.org/F4320320671","display_name":"National Research Foundation","ror":"https://ror.org/05s0g1g46"},{"id":"https://openalex.org/F4320320709","display_name":"National Research Foundation Singapore","ror":"https://ror.org/03cpyc314"},{"id":"https://openalex.org/F4320321001","display_name":"National Natural Science Foundation of China","ror":"https://ror.org/01h0zpd94"},{"id":"https://openalex.org/F4320323817","display_name":"Universitas Brawijaya","ror":"https://ror.org/01wk3d929"}],"has_content":{"grobid_xml":true,"pdf":true},"content_urls":{"pdf":"https://content.openalex.org/works/W4405182489.pdf","grobid_xml":"https://content.openalex.org/works/W4405182489.grobid-xml"},"referenced_works_count":59,"referenced_works":["https://openalex.org/W398859631","https://openalex.org/W1996796871","https://openalex.org/W2008224380","https://openalex.org/W2039157918","https://openalex.org/W2058308089","https://openalex.org/W2066832805","https://openalex.org/W2087056765","https://openalex.org/W2099384706","https://openalex.org/W2111890927","https://openalex.org/W2122646361","https://openalex.org/W2195388612","https://openalex.org/W2278186031","https://openalex.org/W2282821441","https://openalex.org/W2435778079","https://openalex.org/W2528491735","https://openalex.org/W2606462007","https://openalex.org/W2743138268","https://openalex.org/W2767094836","https://openalex.org/W2769506033","https://openalex.org/W2785362611","https://openalex.org/W2789828921","https://openalex.org/W2804236575","https://openalex.org/W2890991187","https://openalex.org/W2902758299","https://openalex.org/W2911946952","https://openalex.org/W2962819609","https://openalex.org/W2963197901","https://openalex.org/W2963399068","https://openalex.org/W2964043980","https://openalex.org/W2965838158","https://openalex.org/W2988337058","https://openalex.org/W2989964158","https://openalex.org/W2998830881","https://openalex.org/W2999242702","https://openalex.org/W3035311645","https://openalex.org/W3035517615","https://openalex.org/W3038898937","https://openalex.org/W3047608117","https://openalex.org/W3083155189","https://openalex.org/W3096425977","https://openalex.org/W3098136764","https://openalex.org/W3098957257","https://openalex.org/W3101609372","https://openalex.org/W3168527239","https://openalex.org/W3180062783","https://openalex.org/W3190409295","https://openalex.org/W3200583622","https://openalex.org/W3204683301","https://openalex.org/W3208097639","https://openalex.org/W3208480178","https://openalex.org/W3212868562","https://openalex.org/W3214757078","https://openalex.org/W3217755000","https://openalex.org/W4225697716","https://openalex.org/W4288057803","https://openalex.org/W4288091250","https://openalex.org/W4308632271","https://openalex.org/W4309346044","https://openalex.org/W4324007053"],"related_works":["https://openalex.org/W2806741695","https://openalex.org/W4290647774","https://openalex.org/W3189286258","https://openalex.org/W3207797160","https://openalex.org/W3210364259","https://openalex.org/W4300558037","https://openalex.org/W2667207928","https://openalex.org/W2912112202","https://openalex.org/W4377864969","https://openalex.org/W3120251014"],"abstract_inverted_index":{"Deep":[0],"learning":[1,87],"(DL)":[2],"based":[3],"anomaly":[4,81],"detection":[5,82],"has":[6,32],"shown":[7],"great":[8],"promise":[9],"in":[10,20,29,37,45],"the":[11,24,42,51,64,68],"field":[12],"of":[13,26,53,67],"security":[14,39],"due":[15,83],"to":[16,78,80,84],"its":[17],"remarkable":[18],"performance":[19],"various":[21],"tasks.":[22],"However,":[23],"issue":[25],"poor":[27],"interpretability":[28],"DL":[30,49],"models":[31,76],"significantly":[33],"impeded":[34],"their":[35,85],"deployment":[36],"practical":[38],"applications.":[40],"Despite":[41],"progress":[43],"made":[44],"existing":[46],"studies":[47],"on":[48,56],"explanations,":[50],"majority":[52],"them":[54],"focus":[55],"providing":[57],"local":[58],"explanations":[59,73],"for":[60,74],"individual":[61],"samples,":[62],"neglecting":[63],"global":[65],"understanding":[66],"model":[69],"knowledge.":[70],"Furthermore,":[71],"most":[72],"supervised":[75],"fail":[77],"apply":[79],"different":[86],"mechanisms.":[88]},"counts_by_year":[{"year":2026,"cited_by_count":1},{"year":2025,"cited_by_count":1},{"year":2024,"cited_by_count":1}],"updated_date":"2026-07-14T23:27:15.235271","created_date":"2025-10-10T00:00:00"}