Bridging the Closed-World Gap: Interpretable Anomaly Detection via a Hybrid TSK-FCM Ensemble on the BETH Dataset
The paper tackles the closed-world problem in cybersecurity intrusion detection, where supervised models trained on benign and insider-threat labels fail when confronted with entirely novel botnet activation attacks at test time. The core idea is a hybrid fuzzy ensemble that couples a gradient-optimized Takagi-Sugeno-Kang (TSK) classifier for known suspicious behaviors with a Fuzzy C-Means (FCM) module that flags out-of-distribution (OoD) samples via a raw Min Distance metric rather than traditional membership scores. The work is relevant because it directly targets the operational reality that security operations centers must detect attack vectors never seen during training, and it attempts to do so with an interpretable, rule-based architecture rather than a black-box neural network.
The paper presents a pragmatic hybrid architecture and reports strong detection numbers (Test AUROC 0.9951, Recall 0.9930) on the BETH benchmark. The ablation study supporting the Min Distance metric over traditional fuzzy membership scores is methodologically clean, and the TSK validation results demonstrate effective learning of labeled insider threats. However, the work is marred by citation inconsistencies, an unsupported characterization of a 9-dimensional space as high-dimensional, and an operationally problematic test false-positive rate of 15.3% that undermines its readiness for real-world SOC deployment.
The internal ablation in Table 3 provides convincing within-paper evidence that a raw Min Distance score outperforms probabilistic membership metrics for this specific dataset, with the ensemble reportedly reaching AUROC 0.9950 versus approximately 0.88 for membership-based alternatives. The supervised TSK component also validates cleanly: by retaining the full rule set, the model achieved perfect recall on suspicious insider behaviors while driving the validation false-positive rate down to 0.48%. These results suggest that the underlying geometric separation of botnet activations in the BETH feature space is strong and that the hybrid design principle is well matched to the OoD detection problem.
The most glaring issue is a citation mismatch: the introduction attributes the Isolation Forest baseline to Zoppi et al. [12], calling it the state-of-the-art Isolation Forest baseline, whereas Section 4.2 correctly attributes the 0.850 AUROC figure to the original BETH study by Highnam et al. [5]; Zoppi et al. is a general survey of unsupervised detectors and unlikely to contain BETH-specific results, so this sloppiness undermines confidence in baseline attribution. Second, the paper repeatedly invokes the curse of dimensionality to motivate the Min Distance metric, yet the preprocessing stage yields only 9 features, a scale where dimensionality arguments are tenuous at best. The test false-positive rate of roughly 15.3% is also alarmingly high for operational settings, and the proposed remedy of alert grading is speculative without additional experiments. Finally, the standalone FCM-only AUROC is never reported, making it impossible to judge whether the TSK-FCM aggregation actually yields any gain over the unsupervised module alone.
Within-paper evidence largely supports the geometric claim: Table 3 shows the Min Distance metric lifting ensemble AUROC to roughly 0.9950 while Max Membership plateaus near 0.8798, confirming that raw Euclidean separation is more discriminative than fuzzy partition coefficients on this data. Yet comparisons to external work are weak. The authors cite Eremin (2025) [3] and other stream-based approaches in the background but do not include them in the experimental baseline comparison, leaving only Isolation Forest and the paper's own ablated variants. Moreover, the 17.1% relative improvement over Isolation Forest is arithmetically consistent but relies on a baseline whose citation is internally inconsistent.
Independent reproduction would be severely hampered by the absence of released code, data preprocessing scripts, or exact hyperparameter values. Critical details are missing: the final number of FCM clusters $c$ is unspecified beyond a sensitivity range of $[6,18]$, the number of TSK rules $R$ is not stated, and the sigmoid calibration parameters $\alpha$ and $\beta$ are described only as 'a scaling factor derived from the interquartile range' and 'the median distance', respectively, without reported numeric values. Random seeds and the exact label-encoding mappings for categorical variables are also omitted, which is particularly problematic because Euclidean distance and Gaussian membership functions are applied to arbitrarily encoded process and host names.
A fundamental paradox plagues the deployment of Machine Learning in cybersecurity: supervised models generalize poorly to novel, Out-of-Distribution (OoD) attacks, whereas unsupervised models often suffer from poor separability, leading to unmanageable false-alarm rates. This challenge is exemplified by the BETH dataset, a kernel-level benchmark in which the training data consists solely of benign and suspicious insider behaviors, whereas the test set consists almost entirely of novel botnet activation attacks. To bridge this detection gap, we propose a Hybrid Fuzzy Ensemble that synergizes the precision of supervised learning with the adaptability of unsupervised clustering. Our architecture integrates a gradient-optimized Takagi-Sugeno-Kang (TSK) fuzzy classifier to act as an expert on known insider threats, with a parallel Fuzzy C-Means (FCM) module to detect geometric anomalies. A critical finding of our research is that traditional fuzzy membership scores degrade in high-dimensional feature spaces due to the curse of dimensionality. We overcome this by introducing a robust Min Distance metric that exploits the raw geometric isolation of botnet activation attacks. This approach yields a state-of-the-art AUROC of 0.9951 on the BETH test set, outperforming the original Isolation Forest baseline by 17.1%. By combining near-perfect OoD detection with the intrinsic interpretability of fuzzy logic, our framework offers a viable path toward robust, transparent, and autonomous network defense.
Pick a starting point or write your own. Challenges run in the background, so you can keep reading while the AI investigates.
No challenges yet. Disagree with the review? Ask the AI to revisit a specific claim.