Explainable neural network for anomaly detection

Abstract

Disclosed are a process, system and medium for explaining an anomaly detected in an authentication request by a classifier, including. obtaining the anomaly detection model, with the anomaly detection model having been trained to detect anomalous authentication requests. Also disclosed is obtaining a multi-layer perceptron (MLP) model trained to provide MLP results similar to anomaly detection results when the same features are provided to both the anomaly detection model and the MLP model. During the MLP model training, the anomaly detection model results serve as ground truth; also, detecting, by the anomaly detection model, that the authentication request is anomalous and providing the authentication request features to an explanation tool using the MLP. Based on the detecting, also disclosed is obtaining, from the explanation tool, an explanation comprising at least one identification of the authentication request feature that contributed most to the detection of anomaly.