Hybrid fuzzy ensemble reports 0.9951 AUROC on BETH botnet detection
Original title: Bridging the Closed-World Gap: Interpretable Anomaly Detection via a Hybrid TSK-FCM Ensemble on the BETH Dataset
A TSK classifier plus Fuzzy C-Means and a Min Distance metric beats Isolation Forest by 17.1% on the BETH test set.
A cs.CR paper proposes a Hybrid Fuzzy Ensemble for the BETH dataset, where training covers benign and suspicious insider behavior and the test set is mostly novel botnet activation attacks. A gradient-optimized Takagi-Sugeno-Kang classifier handles known insider threats while a parallel Fuzzy C-Means module looks for geometric anomalies. The authors say ordinary fuzzy membership degrades in high dimensions and introduce a Min Distance metric. They report an AUROC of 0.9951, 17.1% above the original Isolation Forest baseline.
- BETH training data contains only benign and suspicious insider behaviors.
- The test set consists almost entirely of novel botnet activation attacks.
- Reported AUROC is 0.9951 on the BETH test set.
- The stated gain over Isolation Forest is 17.1%.
From the original article
1 min read at arxiv.orgA fundamental paradox plagues the deployment of Machine Learning in cybersecurity: supervised models generalize poorly to novel, Out-of-Distribution (OoD) attacks, whereas unsupervised models often suffer from poor separability, leading to unmanageable false-alarm rates.
By Lohith Srikanth Pentapalli · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.