Bridging the Closed-World Gap: Interpretable Anomaly Detection via a Hybrid TSK-FCM Ensemble on the BETH Dataset
A hybrid TSK-FCM ensemble tackles the closed-world problem in ML-based anomaly detection, offering interpretable scores that could reduce SOC false-positive fatigue.
Summary written by editorial AI · Source link below
arXiv:2610.30576v1 Announce Type: new Abstract: A fundamental paradox plagues the deployment of Machine Learning in cybersecurity: supervised models generalize poorly to novel, Out-of-Distribution (OoD) attacks, whereas unsupervised models often suffer from poor separability, leading to unmanageable false-alarm rates. This challenge is exemplified by the BETH dataset, a kernel-level benchmark in which the training data consists solely of benign and suspicious insider behaviors, whereas the test
Editorial Analysis
SOC teams struggling with ML-driven false-positive floods could benefit from interpretable hybrid models that better separate novel attacks from benign anomalies.
Forward-looking interpretation drafted by editorial AI under human review — not a reproduction of the source. See methodology.
External link — opens at arXiv Crypto & Security in a new tab.
More from the Research Desk
- Signed, Sealed, and Relayed, NTLM-style: Bypassing LDAP Signing Through Reauthentication3d
- Not Where You Think: Protecting Location Privacy Against Reasoning-Based Geolocation4d
- Social-HUMINT: An LLM-Augmented Unified Framework for Measuring Social Media Exposure4d
- Practical Auditing of Differentially Private Graph Release Mechanisms: Methodology, Toolkit, and Case Study4d
- SecLog-Bench: A Scalable Benchmark for Cybersecurity Log Reasoning with Scaffolded Evidence4d