Bridging the Closed-World Gap: Interpretable Anomaly Detection via a Hybrid TSK-FCM Ensemble on the BETH Dataset

• Supervised IDS models detect known threats but can fail on zero-day attacks, while unsupervised models may produce prohibitive false-alarm rates without semantic context.Source: §1 · p. 2
• BETH training contains benign traffic and suspicious insider anomalies, whereas its test set introduces novel evil botnet activation attacks.The dataset records raw kernel-level system calls.Source: §1 · p. 2
• The paper proposes a hybrid ensemble to address the difficulty of detecting novel attacks that standard supervised classifiers struggle to recognize on BETH.Source: §1 · p. 2
• The proposed ensemble combines a gradient-optimized TSK fuzzy system for known insider threats with an FCM module that flags novel attacks by Euclidean distance from benign clusters.The TSK module provides interpretable rule-based detection.Source: §1 · p. 2
• AUROC 0.9951, surpassing the Isolation Forest baseline by 17.1%, is the reported result for the hybrid architecture.The introduction also reports high operational interpretability.Source: §1 · p. 2

• Supervised models such as Random Forests and DNNs rely on labeled decision boundaries and can generalize poorly to novel threats beyond the training manifold.Source: §2 · p. 2
• Stream-based unsupervised approaches can adapt to concept drift and identify emergent process behaviors in kernel-level telemetry [2, 4].Source: §2 · p. 2
• FCM uses soft membership assignments to identify suspicious instances in sparse or ambiguous feature-space regions, including when attack labels and semantics are unknown.Source: §2 · p. 3
• Fuzzy logic offers rule-based explanations that let analysts trace alerts to triggering conditions and features, unlike black-box probability scores.Source: §2 · p. 3
• Gradient-optimized TSK frameworks can tune membership functions while retaining rule-level explainability, and TSK systems are universal approximators.Source: §2 · p. 3
• Hybrid systems combining learning paradigms have been reported to reduce false alarms, while clustering-derived initialization can improve convergence stability in fuzzy learners.Large-scale ensembles have also reported low false-alarm rates using weak learners and probabilistic calibration.Source: §2 · p. 3
• The literature frames hybrid detection as combining unsupervised discovery of latent structure with supervised or rule-based refinement and interpretable explanations.Source: §2 · p. 3

3 Methodology

• The system pairs a supervised classifier for known suspicious behaviors with unsupervised identification of novel out-of-distribution malicious events.This is the proposed three-stage hybrid ensemble architecture.Source: §3 · p. 4

3.1 Data Preprocessing

• Preprocessing selects nine features from BETH’s 14 raw fields, binarizes privilege identifiers, label-encodes names, maps return values to three categories, and z-scores using training statistics.The transformations address heterogeneous system-call features and apply training-set standardization consistently to validation and test data.Source: §3.1 · p. 4

3.2 System Architecture

• The supervised TSK module is a gradient-optimized first-order fuzzy classifier trained on labeled suspicious behaviors for rule-based detection.Its membership-function parameters are initialized with k-means and then optimized by gradient descent.Source: Stage 1: Supervised TSK Fuzzy… · p. 5
• The FCM module clusters training samples labeled non-suspicious to model normality and identify out-of-distribution events.It partitions benign data into fuzzy clusters using membership degrees and centroids.Source: Stage 2: Unsupervised FCM OoD – · p. 6
• Standard membership-based outlier scores underperform in high dimensions, so the method uses raw Euclidean distance to the nearest benign prototype to score anomalies.The paper attributes membership-score weakness to OoD samples becoming equidistant from multiple cluster centers and resembling benign boundary points.Source: Stage 2: Unsupervised FCM OoD – · p. 6
• The ensemble calibrates the distance score with a validation-set sigmoid and combines it with the supervised probability using a maximum operator.The unified threat score brings the two detection modules into a single decision rule.Source: Stage 2: Unsupervised FCM OoD – · p. 6, Stage 3: Hybrid Fuzzy Aggregation – · pp. 6–7

4.1 Validation of Supervised TSK Component

• Recall was 1.0 for both TSK configurations, but the full rule base reduced FPR from 3.2% to 0.48% and was selected for the ensemble.The compact model flagged over 6,000 benign samples; the full model flagged 910.Source: Table 1 · p. 7, Precision-Recall Analysis · p. 8

4.2 Ensemble Performance & Baseline Comparison

• The test-set Recall was 0.9930, identifying 157,329 of 158,432 malicious samples from the novel Evil botnet class.Table 2 reports that the ensemble identifies over 99.3% of unknown botnet activation attacks.Source: Detailed Classification Analysis · p. 8, §4.2 · p. 8, Table 2 · p. 9
• 0.9951 Test AUROC, with +17.1% over Isolation Forest (0.850) and +6.8% over TSK Only (0.932), was achieved by the ensemble.The ROC curve also shows a high True Positive Rate at very low False Positive thresholds.Source: Comparison with State-of-the-Art · p. 8, Figure 1 · p. 9

4.3 Mechanism Analysis & Ablation Study

• Membership-based metrics plateaued at AUROC ≈0.87, while the geometric Min Distance metric performed significantly better across cluster counts c ∈[6, 18].The authors attribute membership-score weakness in high dimensions to OoD samples becoming equidistant from multiple cluster centers; absolute Euclidean distance preserves their separation.Source: The Failure of Membership in High… · p. 10, Table 3 · p. 10
• Benign samples stayed within distance 10^1 while malicious samples clustered above 10^2, creating an order-of-magnitude separation and a wide thresholding margin.Figure 2 also shows an empty valley between benign and malicious score modes.Source: Figure 2 · p. 10, Visual Confirmation of Geometric… · p. 11

4.4 Operational Implications

• Min Distance remained stable across c ∈[6, 18], while the 15.3% test FPR was described as manageable through alert grading based on the bimodal anomaly scores.The authors propose prioritizing analyst attention toward the most likely threats.Source: Detailed Classification Analysis · p. 9, §4.4 · p. 11

• Supervised models failed to generalize to novel attacks, while standard fuzzy membership metrics degraded in high-dimensional feature spaces.Source: §5 · p. 11
• The ensemble pairs a gradient-optimized TSK expert for known threats with a geometric OoD detector for novel anomalies.Source: §5 · p. 11
• 0.9951 Test AUROC, 17.1% above the original Isolation Forest baseline, with 99.3% of zero-day botnet attacks detected.Sensitivity analysis found the unsupervised component stable across c ∈[6, 18], reducing the tuning burden for deployment.Source: §5 · p. 11
• 0.9951 AUROC for Min Distance exceeded 0.8798 for probabilistic membership scores, indicating botnet attacks were geometric outliers rather than uncertain boundary points.Source: §5 · p. 11
• Future work includes testing adversarial resilience, adding online FCM learning for concept drift, and generating linguistic explanations for OoD alerts.The proposed online learning would adapt benign cluster centroids incrementally without full retraining.Source: Future Work · pp. 11–12