Interpreting Unsupervised Anomaly Detection in Security via Rule Extraction Ruoyu Li, Qing Li, Yu Zhang

Compared to supervised methods, this type of method is more desirable in security domains as 1) it hardly requires labeled attack/malicious data during the training (i.e., zero-positive