doi: 10.18178/JAAI.2026.4.2.125-142
Explainable Machine Learning or AI Using Association Rule Mining
Sikha S. Bagui
1,*
,
Emily Summers
1
,
Dustin Mink
2
,
Subhash C. Bagui
3
- 1 Department of Computer Science, University of West Florida, Pensacola, Florida, USA.
- 2 Department of Cybersecurity and Information Technology, University of West Florida, Pensacola, Florida, USA.
- 3 Department of Mathematics and Statistics, University of West Florida, Pensacola, Florida, USA.
- Manuscript received March 1, 2026
- accepted March 23, 2026
- published June 29, 2026
Abstract
In this paper feature selection is performed using Association Rule Mining (ARM), a widely used data mining technique. Association Rule Mining is used as a preprocessing step before machine learning algorithms are applied. Association Rule Mining allows us to not only select the features, but also select the feature values, thus creating a useful feature-value subset that can be used as input for machine learning algorithms. To date, many works have been done on feature selection prior to running machine learning algorithms, but work has not been done on selecting the useful value or range/subset of the feature to be used for better and more efficient machine learning classification. Selecting the useful part of the feature would help in better explaining the machine learning results. This research is conducted using a newly created Cybersecurity dataset, UWF-ZeekData22, labeled as per the MITRE Adversarial Tactics, Techniques, and Common Knowledge (MITRE ATT&CK) framework. Due to the volume of network data, the Hadoop Distributed File System (HDFS) and Apache Spark were used. The results determined the feature range/value/subset that would be useful in the classification of attack tactics in each machine learning classifier, Decision Trees (DT), Support Vector Machines (SVM), Naı̈ve Bayes (NB), and Random Forest (RF), as well as in all classifiers as a whole, confirming that Association Rule Mining can be useful for explainable machine learning/artificial intelligence and showing inter-feature-value relationships. One of the documented drawbacks of ARM, the generation of too many rules, turned out to be an advantage in this research to help classify rare attacks. That is, in addition to ARM feature-subsets being used for regular explainable AI, ARM’s feature-subsets can also be used in explaining rare attacks.
Keywords
- explainable Artificial Intelligence (AI)
- feature selection
- cyberattacks
- association rule mining
- data mining
- MITRE Adversarial Tactics
- Techniques
- and Common Knowledge (MITRE ATT&CK) framework
- frequent pattern mining
- feature-values
How to Cite
Sikha S. Bagui, Emily Summers, Dustin Mink, and Subhash C. Bagui, "Explainable Machine Learning or AI Using Association Rule Mining," Journal of Advances in Artificial Intelligence, vol. 4, no. 2, pp. 125-142, 2026. https://doi.org/ 10.18178/JAAI.2026.4.2.125-142
Copyright & License
Copyright © 2026 by the authors. This is an open access article distributed under the Creative Commons Attribution License which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited (CC BY 4.0).