UNAD+: Explainable Hybrid Framework for Detecting Previously Unseen Network Attacks

arXiv·low signal

UNAD+ combines supervised and unsupervised methods for zero-day network attack detection, addressing the fundamental tension that supervised methods miss unknown attack types while unsupervised methods have unacceptably high false positive rates. The hybrid framework adds explainability to detections, helping operators understand why an alert was raised. Evaluated against real attack datasets showing improved detection of novel attack classes without the false-positive penalty of pure anomaly detection.