  In this paper, we introduce Anomaly Contribution Explainer or ACE, a tool to
explain security anomaly detection models in terms of the model features
through a regression framework, and its variant, ACE-KL, which highlights the
important anomaly contributors. ACE and ACE-KL provide insights in diagnosing
which attributes significantly contribute to an anomaly by building a
specialized linear model to locally approximate the anomaly score that a
black-box model generates. We conducted experiments with these anomaly
detection models to detect security anomalies on both synthetic data and real
data. In particular, we evaluate performance on three public data sets: CERT
insider threat, netflow logs, and Android malware. The experimental results are
encouraging: our methods consistently identify the correct contributing feature
in the synthetic data where ground truth is available; similarly, for real data
sets, our methods point a security analyst in the direction of the underlying
causes of an anomaly, including in one case leading to the discovery of
previously overlooked network scanning activity. We have made our source code
publicly available.
