## 3 Methodology
### Generating Invariant Rules Using Swarm Intelligence Algorithms
#### 3.1.1 Feature Selection and Task Segmentation  
Given the large scale and complexity of ICS datasets, as well as the challenges associated with the extensive solution space encountered by traditional swarm intelligence algorithms in numeric association rule mining, we employ feature selection and task segmentation. Specifically, each feature is treated as a target feature, and machine learning algorithms are utilized to identify features that are highly correlated with the target feature. This approach decomposes the large-scale mining task into multiple smaller, more manageable sub-tasks, thereby enhancing both computational efficiency and interpretability of the algorithm. Let \(F=\{F_{1},F_{2},\ldots,F_{p}\}\) be the set of all features, where \(p\) is the total number of features. The strength of the correlation between features is calculated using the Pearson correlation coefficient:  
\[r_{F_{i},F_{j}}=\frac{\sum_{k=1}^{n}(x_{ik}-\bar{x}_{i})\Big{(}x_{jk}-\bar{x}_ {j}\Big{)}}{\sqrt{\sum_{k=1}^{n}(x_{ik}-\bar{x}_{i})^{2}}\sqrt{\sum_{k=1}^{n} \Big{(}x_{jk}-\bar{x}_{j}\Big{)}^{2}}} \tag{7}\]  
where \(r_{F_{i},F_{j}}\) represents the correlation coefficient between feature \(F_{i}\) and \(F_{j}\), \(x_{ik}\) is the value of feature \(F_{i}\) in the k-th data record, \(\bar{x}_{i}\) is the mean value of feature \(F_{i}\), and n is the number of data records. To ensure that the segmented sub-tasks possess clear correlations, a threshold \(\theta\) must be defined to select features \(F_{i}\) that exhibit a significant correlation with the target feature \(F_{i}\). Specifically, only features \(F_{j}\) for which the following condition holds:  
\[\{F_{j}\ |\ |r_{F_{i},F_{j}}|>\theta,F_{i}\
eq F_{j}\} \tag{8}\]  
are considered to have a strong correlation with \(F_{i}\) and are included in further analysis. Having selected the set of features correlated with \(F_{i}\), the original invariant rule mining task \(T\) can be divided into several smaller tasks \(T_{k}\), each involving a subset of correlated features:  
\[T_{i}=\{F_{i},F_{j_{1}},F_{j_{2}},\ldots,F_{j_{l}}\} \tag{9}\]  
where \(l\) is the number of selected features, and \(l<p\). This method allows us to effectively reduce the complexity of the mining task by focusing on the most relevant features, thus improving the efficiency and accuracy of the mining process and ensuring that the mined rules have a higher explanation and generalization capability. Figure 4: Flowchart of invariant rule generation based on swarm intelligence algorithms. To illustrate this process, we provide Algorithm 2, which details the steps involved in feature selection and task segmentation. In Algorithm 2, the input is the set of all features \(F\) and the correlation threshold \(\theta\). The output is a list of sub-tasks \(T\), where each sub-task contains a set of highly correlated features. The algorithm first initializes a correlation matrix \(R\) and then calculates the Pearson correlation coefficients for all pairs of features. It then selects features that are highly correlated with each target feature and forms sub-tasks based on these correlated features. This approach ensures that the sub-tasks are manageable and computationally efficient. ```
1:\(F\): Set of all features \(\{F_{1},F_{2},\ldots,F_{p}\}\), where \(p\) is the total number of features. 2:\(\theta\): Correlation threshold to filter highly correlated features. 3:
4:\(T\): List of sub-tasks, where each sub-task contains a set of highly correlated features. 5:\(p\leftarrow\text{length}(F)\)\(\triangleright\) Obtain the total number of features
6:\(R\gets\text{zeros}(p,p)\)\(\triangleright\) Initialize the correlation matrix with zeros. 7:for\(i=1\)to\(p\)do
8:for\(j=i\)to\(p\)do
9:\(R[i][j]\leftarrow\text{PearsonCorrelation}(F[i],F[j])\)
10:\(R[i][j]\gets R[i][j]\)\(\triangleright\) The correlation matrix is symmetric. 11:endfor
12:\(T\leftarrow[]\)\(\triangleright\) Initialize an empty list to store sub-tasks.