Explainable Machine Learning or AI Using Association Rule Mining

Abstract

In this paper feature selection is performed using Association Rule Mining, a widely used data mining technique. Association Rule Mining is used as a preprocessing step before machine learning algorithms are applied. Association Rule Mining allows us to not only select the features, but also select the feature values, thus creating a useful feature-value subset that can be used as input for machine learning algorithms. To date, a lot of work has been done on feature selection prior to running machine learning algorithms, but work has not been done on selecting the useful value or range/subset of the feature to be used for better and more efficient machine learning classification. Selecting the useful part of the feature would help in better explaining the machine learning results. This research is conducted using a newly created Cybersecurity dataset, UWF-ZeekData22, labeled as per the MITRE ATT&CK framework. Due to the volume of network data, the Hadoop Distributed File System (HDFS) and Apache Spark were used. The results determined the feature range/value/subset that would be useful in the classification of attack tactics in each machine learning classifier, Decision Trees, Support Vector Machines, Naïve Bayes and Random Forest, as well as in all classifiers as a whole, confirming that Association Rule Mining can be useful for explainable machine learning/artificial intelligence and showing inter-feature-value relationships. One of the documented drawbacks of ARM, the generation of too many rules, turned out to be an advantage in this research to help classify rare attacks. That is, in addition to ARM feature-subsets being used for regular explainable AI, ARM’s feature-subsets can also be used in explaining rare attacks.