# AI-Based Approach to Firewall Rule Refinement on High-Performance Computing Service Network
## 3 Methodology
### Machine-Learning Algorithms
#### 3.2.3 OneR  
OneR is a simple and interpretable algorithm used for classification tasks. The main concept of the OneR algorithm [7] is to select one feature (predictor) and one value of that feature (rule) for performing predictions. It operates by selecting the best rule (feature and value pair) based on misclassification minimization, and no function is provided by any packages. In this experiment, we developed the pseudocode of the partial code in the code block in Listing 1 as follows:```
FunctionTrainFeatureValue(x, y, feature_index, value): For each sample, i in zip(x, y): If feature value of the sample at feature_index is equal to value: Increment count of corresponding class label in class_counts Sort class_counts by counts in descending order Select most frequent class label as predictor Calculate total number of incorrect predictions Return predictor and total number of incorrect predictions FunctionTrainOnFeature(x, y, f_i): For each unique value i in feature f_i: Train predictor for feature f_i and value i using TrainFeatureValue Add predictor to predictors dictionary Append total error of predictor to errors list Select value with minimum total error as best value Return predictors for best value and minimum total error Function Predict(x_test, model): For each sample in x_test: Retrieve best value and predictors from model Apply predictor associated with best value to corresponding feature of the sample Assign predicted class label to the sample Return predicted class'labels Train the model: For each feature index f_i in the dataset: Train model for feature using TrainOnFeature Store predictors and errors for feature in all_predictors and errors Select the best feature and value pair with minimum error Make predictions on the test set using the selected model Evaluate the performance of the model (e.g., calculate accuracy)
```

**Listing 1**Psedocode of OneR. The functions _TrainFeatureValue(), TrainOnFeature()_, and _Predict()_ implement the main concept of the feature-value pair. Although OneR offers simplicity, interpretability, and low computational costs, it has limitations in terms of expressiveness, robustness to outliers and noise, performance, and overfitting. This algorithm is suitable for simple classification tasks with well-behaved data. #### 3.2.4 J48

For J48, which is also known as a decision tree classifier, we used _DecisionTreeClassifier_ provided by scikit-learn 1.4.0. J48 constructs a decision tree recursively by splitting the dataset based on the attribute that provides the best information gain or gain ratio at each node [7]. Information gain measures the reduction in uncertainty about the class label after a split. In this experiment, information gain, which measures the reduction in entropy, is achieved by splitting the data on a particular attribute. It is calculated using the following equation (in Equation (3)):

\[IG(D,A)=H(D)-\sum_{v\in\text{Values}(A)}\frac{|D_{v}|}{|D|}H(D_{v}) \tag{3}\]

where \(IG(D,A)\) is the information gain of attribute \(A\) on dataset \(D\); \(H(D)\) is the entropy of dataset \(D\); \(|D|\) is the number of instances in dataset \(D\); \(|D_{v}|\) is the number of instances in dataset \(D\) with a value \(v\) for attribute \(A\); and \(H(D_{v})\) is the entropy of dataset \(D_{v}\) (the subset of \(D\) with a value \(v\) for attribute \(A\)). While J48 offers simplicity, interpretability, and versatility in handling mixed data types, it exhibits overfitting, a high variance, instability, and biases toward certain features. The careful tuning of hyperparameters and tree pruning techniques can help mitigate some of these disadvantages. We tuned the number of _max_depth_ to be 16 with the entropy criterion for _DecisionTreeClassifier_. #### 3.2.5. Svm

For SVM, we used _svm_ provided by scikit-learn 1.4.0.