# Enhancing Anomaly-Based Intrusion Detection Systems with Process Mining

arXiv: https://arxiv.org/abs/2604.18066 · HTML: https://mlsanity.com/paper/2604.18066/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 4 of its 26 references that are in the map.
- First posted on arXiv 20 Apr 2026.

## Builds on (most cited first, 4 of 4)

- [Control-flow anomaly detection by process mining-based feature extraction and dimensionality reduction](https://mlsanity.com/paper/2502.10211/) (2025)
- [xSemAD: Explainable Semantic Anomaly Detection in Event Logs Using Sequence-to-Sequence Models](https://mlsanity.com/paper/2406.19763/) (2024)
- [Detection, Explanation and Filtering of Cyber Attacks Combining Symbolic and Sub-Symbolic Methods](https://mlsanity.com/paper/2212.13991/) (2022)
- [Network Traffic Analysis with Process Mining: The UPSIDE Case Study](https://mlsanity.com/paper/2512.23718/) (2025)

## Abstract (arXiv)

Anomaly-based Intrusion Detection Systems (IDSs) ensure protection against malicious attacks on networked systems. While deep learning-based IDSs achieve effective performance, their limited trustworthiness due to black-box architectures remains a critical constraint. Despite existing explainable techniques offering insight into the alarms raised by IDSs, they lack process-based explanations grounded in packet-level sequencing analysis. In this paper, we propose a method that employs process mining techniques to enhance anomaly-based IDSs by providing process-based alarm severity ratings and explanations for alerts. Our method prioritizes critical alerts and maintains visibility into network behavior, while minimizing disruption by allowing misclassified benign traffic to pass. We apply the method to the publicly available USB-IDS-TC dataset, which includes anomalous traffic affected by different variants of the Slowloris DoS attack. Results show that our method is able to discriminate between low- to very-high-severity alarms while preserving up to 99.94% recall and 99.99% precision, effectively discarding false positives while providing different degrees of severity for the true positives.