M.A. Basarab1, V.A. Bobkov2
1, 2 Bauman Moscow State Technical University (Moscow, Russia)

1 basarab@bmstu.ru, 2 bobkovva@bmstu.ru

In modern conditions of rapid growth of digital data volumes and an increase in the number of cyber threats, information mining methods used in information security systems are of particular importance. Machine learning is widely used to detect anomalies, detect intrusions, analyze network traffic, and classify malicious activity. However, many modern algorithms, primarily deep neural networks, have limited interpretability, which makes it difficult to analyze decisions and use them in mission-critical systems. In this regard, an urgent task is to develop classification models that combine high accuracy with transparency of structure and the possibility of analytical interpretation.

The paper proposes a differentiable classifier with piecewise linear decision boundaries, constructed by leveraging the mathematical framework of Rvachev functions (R-functions) combined with neural network principles. The main idea of the method is to represent the dividing boundaries between classes in the form of an analytically specified piecewise linear function, the parameters of which are trained based on gradient optimization methods. The dividing surface is approximated by a polyline with fixed nodes in one coordinate and trainable parameters in the other, which allows you to adapt the shape of the border to the data structure. This approach ensures the continuity and differentiability of the model in terms of parameters, which makes it possible to use standard neural network learning algorithms.

Continuous logical operations based on R-functions are used to combine individual line segments and form complex decision-making areas. In particular, the R-conjunction operation makes it possible to implement an analogue of the logical intersection of geometric conditions, while maintaining the analytical form of the function and its smoothness. As a result, the final dividing surface is formed as a combination of piecewise linear approximation and additional linear constraints combined into a single differentiable structure. To obtain a probabilistic interpretation of the classification results, a sigmoidal activation function is used, which converts the value of the distance function to the separating surface into the probability of an object belonging to a certain class.

The model parameters are trained by minimizing the loss function based on the cross-entropy binary classification criterion. To increase the stability of the model and prevent overfitting, smoothness regularization is introduced, implemented by minimizing the second difference in the parameters of a piecewise linear function. This makes it possible to limit the excessive curvature of the approximation and ensure a more stable generalization of the model based on new data.

The experimental verification of the proposed approach has been carried out on synthetic datasets, as well as on the UNSW-NB15 real dataset, which is widely used in network attack detection tasks. The algorithm is implemented in the Python programming language using the NumPy and PyTorch libraries. The metrics AUC-ROC, PR-AUC, F1-score and Log-Loss have been used to assess the classification quality. The experimental results showed that the developed classifier demonstrates stable and competitive performance compared to common machine learning methods, including neural networks, random forest, SVM and gradient boosting.

A special advantage of the proposed approach is the high interpretability of the resulting solutions. Thanks to the analytical form of the separating function, it becomes possible to geometrically analyze the structure of the boundary between classes, as well as to study the contribution of individual features and constraints to the final classification result. This makes the proposed model a promising tool for use in information security systems, where not only the accuracy of threat detection is important, but also the ability to explain the reasons for decision-making.

Thus, the developed differentiable piecewise linear classifier based on R-functions is an effective and interpretable machine learning method suitable for analyzing complex data and building transparent systems for intelligent anomaly detection.

Basarab M.A., Bobkov V.A. Differentiable piecewise linear classification based on R-functions and artificial neural networks in information security problems // Neurocomputers. 2026. V. 28. № 4. P. 5–17. DOI: https://doi.org/10.18127/j19998554-202604-01

1. Rvachyov V.L. Teoriya R-funktsij i nekotorye ee prilozheniya. Kiev: Naukova dumka. 1982. (in Russian)
2. Molnar C. Interpretable machine learning. 2nd Ed. 2022. Online book [Elektronnyj resurs]. URL: https://christophm.github.io/interpretable-ml-book/ (data obrashcheniya: 29.01.2026).
3. Mao A., Mohri M., Zhong Y. Cross-entropy loss functions: Theoretical analysis and applications. Proceedings of the 40th International Conference on Machine Learning (ICML). PMLR 202. 2023. P. 22172–22194.
4. Paszke A., Gross S., Massa F. et al. PyTorch: An imperative style, high-performance deep learning library. Advances in Neural Information Processing Systems (NeurIPS). 2019. V. 32.
5. Pedregosa F., Varoquaux G., Gramfort A. et al. Scikit-learn: Machine learning in Python. Journal of Machine Learning Research. 2011. V. 12. P. 2825–2830.
6. Chandola V., Banerjee A., Kumar V. Anomaly detection: A survey. ACM Computing Surveys. 2009. V. 41. № 3. P. 1–58.
7. Harris C.R., Millman K.J., van der Walt S.J. et al. Array programming with NumPy. Nature. 2020. V. 585. P. 357–362.
8. Hunter J.D. Matplotlib: A 2D graphics environment. Computing in Science & Engineering. 2007. V. 9. № 3. P. 90–95.
9. UNSW-NB15 Dataset. University of New South Wales, UNSW Canberra Cyber [Elektronnyj resurs]. URL: https://research.unsw.edu.au/ projects/unsw-nb15-dataset (data obrashcheniya: 28.02.2026).
10. Moustafa N., Slay J. UNSW-NB15: a comprehensive data set for network intrusion detection systems (UNSW-NB15 network data set). Military Communications and Information Systems Conference (MilCIS). IEEE. 2015. P. 1–6.
11. Prokhorenkova L., Gusev G., Vorobev A. et al. CatBoost: unbiased boosting with categorical features. Advances in Neural Information Processing Systems (NeurIPS). 2018. V. 31.
12. Zhong Z., Zhu Z., Zhou Y. Learning specialized activation functions with the piecewise linear unit. IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR). 2021. P. 14847–14856.
13. Doshi-Velez F., Kim B. Towards a rigorous science of interpretable machine learning. arXiv preprint. arXiv:1702.08608. 2017.
14. Zhou Y., Li X., Ding R. et al. Piecewise affine regression and classification (PARC). Neural Networks. 2021. V. 138. P. 1–13.