## 5 Conclusions  
This study proposes a numerical association rule mining method based on swarm intelligence algorithms for anomaly detection in ICS. The method models the association rule mining task as a single-objective continuous optimization problem. By applying feature selection and task partition strategies, the method simplifies the management of complex tasks, improving search efficiency while ensuring the quality of the generated rules. The representation of solutions in the search space is optimized, which not only enhances computational efficiency but also ensures the high quality of the generated rules, ultimately enabling accurate identification of anomalous behavior in ICSs. One significant advantage of this method is its ability to mine association rules across multiple subsystems, revealing the interactions between different components within the system. This cross-subsystem perspective allows for the identification of more complex anomaly patterns, which may only emerge through interactions between multiple subsystems and could be missed if individual subsystems were analyzed in isolation. Additionally, the generality of the method makes it adaptable to various types of ICS, requiring only the collection of log data during normal system operation for rule mining and anomaly detection. This characteristic gives the method strong applicability, allowing it to be deployed across diverse industrial control environments. Experimental results demonstrate that the swarm intelligence algorithms, based on PSO, DE, and BA, can detect over 84% of attack instances and achieve a detection accuracy of more than 97%. The method not only exhibits high detection performance but also provides excellent interpretability, offering detailed analyses of the causes of anomalies, which helps operators quickly identify the source of issues. However, there are still some limitations to the method. First, the quality of the data significantly impacts the performance of the method, as the size, completeness, and accuracy of the dataset directly affect detection results. Second, the method may struggle to detect certain complex attacks that have minimal impact on the physical state of the system, as these attacks may not cause significant anomalous behavior. Therefore, future research will explore the integration of deep learning and other technologies to further enhance the detection accuracy and robustness of the method, especially in dynamic and complex industrial environments. Overall, the swarm intelligence-based anomaly detection method proposed in this study, by mining cross-subsystem association rules and exhibiting strong generality, offers an effective and reliable solution for ICS security monitoring. Future work could further incorporate additional technologies and optimization strategies to achieve more efficient and precise anomaly detection. Figure 11: Detection performance of the invariant rules for multi-stage multi-point attacks on P501 and FIT502. The figure highlights the rule’s effectiveness in identifying complex, multi-stage, and multi-point attack scenarios. **Author Contributions:** Conceptualization, Y.S. and Q.W. ; methodology, Y.S. and H.H. ; software, Y.S. and H.H. ; validation, Y.S. and H.W. ; formal analysis, H.H. and Q.W. ; investigation, Y.S. and H.W. ; resources, Y.S. and H.H. ; data curation, Y.S. and H.H. ; writing--original draft preparation, Y.S. ; writing--review and editing, Y.S. and H.H. ; visualization, Q.W. ; supervision, Q.W. ; project administration, Q.W. All authors have read and agreed to the published version of the manuscript. This research received no external funding. Not applicable. The original data presented in the study are openly available at [[https://github.com/shouwangsheynuan/NARM.git](https://github.com/shouwangsheynuan/NARM.git)]([https://github.com/shouwangsheynuan/NARM.git](https://github.com/shouwangsheynuan/NARM.git)), accessed on 20 October 2024; see Section 3.1 for details.