## 2 Numerical Association Rule Mining and Swarm Intelligence Algorithms  
### Numerical Association Rule Mining  
Association rule mining [27] aims to uncover hidden relationships between attributes within transactional databases. Traditional association rule mining algorithms [28; 29; 30] primarily target discrete attribute data. When dealing with numerical attributes, discretization strategies are often required [31; 32; 33], which inevitably leads to information loss. With the advent of swarm intelligence and evolutionary algorithms, methods capable of directly handling both discrete and continuous attributes have emerged, leading to the development of numeric association rule mining (NARM) [34].  
Formally, consider an ICS equipped with m sensors and n actuators. Let the data log \(\mathcal{D}^{1:T}=\{d^{1},d^{2},\ldots,d^{T}\}\), where each record \(d_{t}\) consists of two parts: a state vector \(x_{t}\in\mathbb{R}_{m}\), representing the readings of all sensors at time \(t\); and a control vector \(u_{t}\in\mathcal{K}_{n}\), denoting the operational states of the actuators at time \(t\), where \(\mathcal{K}_{n}\) is the set of control action categories. Further, construct an item set \(I=\{i_{1},i_{2},\ldots,i_{m+t}\}\), where each signal \(d_{t}\in\mathcal{D}^{1:T}\) corresponds to a subset of the item set \(I\). An association rule can be defined as an implication relationship, formally expressed as follows:  
\[X\Rightarrow Y \tag{1}\]  
where X and Y are non-empty and mutually exclusive subsets of I, i.e., \(X\subset I\wedge Y\subset I\wedge X\cap Y=\varnothing\).  
The practical utility of association rules is measured using metrics such as support, confidence, interest, and comprehensibility. Support reflects the frequency with which (X) and (Y) co-occur, defined as follows:  
\[supp(X\Rightarrow Y)=\frac{n(X\cap Y)}{|D|} \tag{2}\]  
where \(n(X\cap Y)\) denotes the number of transactions that contain both \(X\) and \(Y\), and \(|D|\) represents the total number of transactions in the dataset \(D\).  
Confidence quantifies the probability of Y occurring given X, defined as follows:  
\[conf(X\Rightarrow Y)=\frac{n(X\cap Y)}{n(X)} \tag{3}\]  
A confidence of 1 indicates that Y always occurs if X occurs. Strong association rules generally require both high support and high confidence.  
Interestingness measures the novelty and importance of the rule, defined as follows:  
\[inte(X\Rightarrow Y)=\frac{supp(X\Rightarrow Y)}{supp(X)}\cdot\frac{supp(X \Rightarrow Y)}{supp(Y)}\cdot\left(1-\frac{supp(X\Rightarrow Y)}{|D|}\right) \tag{4}\]  
Comprehensibility assesses the intuitiveness and understandability of the rule by quantifying the simplicity of the antecedent and consequent, defined as follows:  
\[comp(X\Rightarrow Y)=\frac{log(1+|Y|)}{log(1+|X\cup Y|)} \tag{5}\]  
Invariant rules can be defined as strong association rules. In the context of ICSs, they reflect the essential characteristics of a normal system operation, manifesting as patterns of state transitions among sensors and actuators. Any physical process violating these rules would be considered an anomaly, formally represented as follows:  
\[I_{1}\Rightarrow I_{2}\text{ where }I_{1},I_{2}\subset D\wedge I_{1}\cap I_{2}= \varnothing\wedge\frac{\sup(I_{1}\cup I_{2})}{\sup(I_{1})}\geq 1 \tag{6}\]  
In which \(I_{1}\) and \(I_{2}\) are the antecedent and consequent of the rule, respectively, and their relationship strictly meets specific conditions, that is, in all data logs, whenever \(I_{1}\) occurs,\(I_{2}\) must necessarily occur, ensuring that the rules with strong associative relationships are selected, which can minimize the risk of false positives to the greatest extent.