Ano2Rule: Rule-Based Global Interpretation for Unsupervised Anomaly Detection in Security

Ano2Rule is a new method that makes unsupervised anomaly detection models (AI systems that find unusual patterns without being trained on examples of what's normal) more understandable to humans by converting them into simple rules. The approach breaks down how normal data is distributed into multiple parts and creates boundary rules that explain when the model flags something as anomalous (abnormal), making it easier for security experts to trust and deploy these systems in high-stakes situations like detecting network intrusions or protecting IoT devices (internet-connected devices).