Anomaly-based Intrusion Detection Systems (IDSs) ensure protection against malicious attacks on networked systems. While deep learning-based IDSs achieve effective performance, their limited trustworthiness due to black-box architectures remains a critical constraint. Despite existing explainable techniques offering insight into the alarms raised by IDSs, they lack process-based explanations grounded in packet-level sequencing analysis. In this paper, we propose a method that employs process mining techniques to enhance anomaly-based IDSs by providing process-based alarm severity ratings and explanations for alerts. Our method prioritizes critical alerts and maintains visibility into network behavior, while minimizing disruption by allowing misclassified benign traffic to pass. We apply the method to the publicly available USB-IDS-TC dataset, which includes anomalous traffic affected by different variants of the Slowloris DoS attack. Results show that our method is able to discriminate between low- to very-high-severity alarms while preserving up to 99.94% recall and 99.99% precision, effectively discarding false positives while providing different degrees of severity for the true positives.

翻译：异常入侵检测系统(IDSs)可保障网络系统免受恶意攻击。基于深度学习的IDS虽能实现有效性能，但其黑箱架构导致的有限可信度仍是一项关键制约因素。现有可解释技术虽能解读IDS生成的告警信息，但缺乏基于数据包序列分析的过程级解释。本文提出一种采用过程挖掘技术增强异常入侵检测系统的方法，通过提供基于过程的告警严重性评级与告警解释信息。该方法在优先处理关键告警并保持网络行为可见性的同时，通过允许被误分类的良性流量通过以最小化系统干扰。我们将该方法应用于公开的USB-IDS-TC数据集，该数据集包含受不同版本Slowloris DoS攻击影响的异常流量。结果表明，本方法能够区分低严重性至极高严重性告警，同时保持高达99.94%的召回率和99.99%的精确率，在有效剔除误报的同时为真实告警提供差异化的严重程度分级。