A Threefold Approach for Enhancing Fuzzy Interpolative Reasoning: Case Study on Phishing Attack Detection Using Sparse Rule Bases

Abstract

Fuzzy systems are powerful modeling systems for uncertainty applications. In contrast to traditional crisp systems, fuzzy systems offer the opportunity to extend the binary decision to continuous space, which could offer benefits for various application areas such as intrusion detection systems (IDSs), because of their ability to measure the degree of attacks instead of making a binary decision. Furthermore, fuzzy systems offer a suitable environment that is able to deal with uncertainty. However, fuzzy systems face a critical challenge represented by the sparse fuzzy rules. Typical fuzzy systems demand complete fuzzy rules in order to offer the required results. Additionally, generating complete fuzzy rules can be difficult due to many factors, such as a lack of knowledge base or limited data availability, such as in IDS applications. Fuzzy rule interpolation (FRI) was introduced to overcome this limitation by generating the required interpolation results in cases with sparse fuzzy rules. This work introduces a threefold approach designed to address the cases of missing fuzzy rules, which uses a few fuzzy rules to handle the limitations of missing fuzzy rules. This is achieved by finding the interpolation condition of neighboring fuzzy rules. This procedure was accomplished based on the concept of factors (which determine the degree to which each neighboring fuzzy rule contributes to the interpolated results, in cases of missing fuzzy rules). The evaluation procedure for the threefold approach was conducted using the following two steps: firstly, using the FRI benchmark numerical metrics, the results demonstrated the ability of the threefold approach to generate the required results for the various benchmark scenarios. Secondly, using a real-life dataset (phishing attacks dataset), the results demonstrated the effectiveness of the suggested approach to handle cases of missing fuzzy rules in the area of phishing attacks. Consequently, the suggested threefold approach offers an opportunity to reduce the number of fuzzy rules effectively and generate the required results using only a few fuzzy rules.

1. Introduction

The rapid growth of dynamic and uncertain environments enabled the widespread use of fuzzy systems. The strengths of the fuzzy systems make them a suitable framework to address cases of uncertainty. Fuzzy systems effectively cooperate with expert knowledge, which is integrated as an important factor for the inference engine. This integration of expert knowledge produces an understandable rule-based system. Adapting the fuzzy systems in this way helps to address the issues of binary decisions. For instance, in the intrusion detection application area, the binary decision is considered a serious challenge [1]. This is due to there being no clear boundaries between normal and abnormal traffic. Therefore, the fuzzy system could be a suitable detection approach that offers an acceptable extension of the binary decision to the continuous space.

However, effectively modeling a fuzzy system faces a critical challenge, characterized by the issue of sparse fuzzy rules. The typical inference methods, such as those of Mamdani and Takagi-Suegno, required complete fuzzy rules for the modeling of fuzzy systems. In other words, the inference of a fuzzy system, which is considered a critical step, could not be initiated in the case of sparse fuzzy rules [2]. In a sparse fuzzy rules scenario, the typical classical reasoning methods could not infer the required result from the new observation. There are several reasons for the case of sparse fuzzy rules or missing fuzzy rules [3,4,5]. These reasons can be summarized as follows:

• Limited data could lead to sparse fuzzy rule scenarios, as limited data cannot be used to build complete fuzzy rules that can cover all possible observation scenarios.
• In the case of a dynamic environment, the appearance of dynamic changes in input variables not previously investigated could lead to sparse fuzzy rules. Therefore, the shift to a dynamic environment could create a lack of knowledge. In this case, the system cannot generate the required results for all possible observations due to the dynamic changes in variables in the environment.
• In a complex system, there could be a lack of knowledge, thereby causing sparse fuzzy rules to be built. Some complex systems, such as intrusion detection, face the serious challenge of a lack of knowledge. Therefore, generating complete fuzzy rules could be a serious challenge. From another perspective, the existence of inadequate fuzzy rules would also cause a sparse region into which new observations may fall.

The cases of limited data availability and a lack of knowledge reflect the true nature of real-world application problems, as many application areas face these essential issues. One such domain that suffers from limited data availability and the lack of a knowledge base is phishing attacks detection and botnet attacks detection. Limited data availability and the lack of a knowledge base play a major role in limiting the fuzzy systems for these applications, due to their need for complete fuzzy rules. Therefore, in response to these critical issues, this paper introduces a novel FRI method, entitled the threefold approach. The threefold approach aims to handle the limitations of fuzzy systems in the case of sparse fuzzy rules. This benefit enables the threefold approach to be used as an inference engine in cases of limited data availability and a lack of knowledge, as found in phishing attack detection. Moreover, the threefold approach could offer an opportunity for the fuzzy system to generate the required results with missing fuzzy rules, as well as the opportunity to extend the binary decision to the continuous space. Furthermore, the suggested threefold approach could be beneficial in reducing the complexity of fuzzy systems by generating the required results using only a few fuzzy rules.

The suggested threefold approach interpolates the required results in the case of missing fuzzy rules by extracting the interpolation conditions of the new input and the existing fuzzy rules. This technique is introduced according to the factor concept. The factor concept is used to determine the degree to which each neighboring fuzzy rule contributes to the interpolated results, in the case of missing fuzzy rules. Consequently, the proposed threefold approach could be a beneficial fuzzy approach to implement in areas and applications where there is a lack of knowledge and limited data availability, such as phishing attack detection. In this paper, we break down the main contributions as follows:

• The development of a threefold approach by introducing a systematic three-step method to address the limitations of sparse fuzzy rules in fuzzy systems, which can make it challenging to generate the required results or conclusions.
• Introducing the factor concept, which determines the degree of participation of each neighboring fuzzy rule in handling the issue of sparse/missing fuzzy rules.
• Evaluating the suggested method using various FRI benchmark numerical metrics, the results of which demonstrate its ability to successfully handle various benchmark scenarios involving incomplete fuzzy rule sets.
• Evaluating the suggested method using an open-source real life phishing attacks dataset, the results of which demonstrated the ability of the suggested approach to handle cases of limited data availability and a lack of knowledge.

This paper is organized as follows: Section 2 presents related works on fuzzy rule interpolation and provides a brief overview of the studied FRI methods, including some advantages and limitations. Section 3 introduces the suggested threefold approach, including the main steps used to interpolate the required results in the case of missing fuzzy rules. This is followed by the experiments and results, which are set out in Section 4. Section 5 concludes the paper.

2. Related Works

This section presents related works on fuzzy rule interpolation. It also provides a brief overview of the studied FRI methods, including some advantages and limitations.

Kóczy and Hirota in [6] proposed one of the earliest interpolation methods (the KH method). The KH method was able to interpolate the required results using the linear interpolation technique and offered a chance to adapt the concept of similarity between fuzzy sets. Additionally, the suggested KH method could work within a multi-dimensional variable space. Furthermore, the authors introduced a linear equation for the interpolation technique. Vass et al., in [7], proposed an enhanced version of the KH method. This enhancement was summarized by modifying alpha-cut values based on the center points to avoid abnormal results. This enhancement eliminated the issue related to the abnormal results within the KH method. Furthermore, Tikk et al., in [8], noted the issue of abnormal results within the KH method, and they proposed a KH-stabilized method that overcame the abnormal conclusions by adapting the weighted distance concept.

From another perspective, Li et al., in [9], proposed another method that offered the ability to interpolate the results in the case of missing fuzzy rules. The suggested method was entitled weighted fuzzy interpolative reasoning and was concerned with adapting the center of gravity of trapezoidal fuzzy sets, in order to interpolate the required conclusions. Marsala et al., in [10], suggested an extension of linear reasoning methods using the analogical technique. This enhancement contributed to addressing the issue related to the premise of the existing fuzzy rules. The suggested method characterized the set of input variables as points of weights, where the interpolated results were determined by the location space of the observation and the shape of the observation. In [11], Chang et al. proposed a new interpolation method for addressing the missing fuzzy rules. The suggested interpolation method was designed based on adapting the area of the fuzzy set, employing the weighted technique as a baseline to interpolate the conclusion. The results generated by the suggested method were characterized by their convexity and normality. Moreover, different types of fuzzy sets could be used to interpolate the results. The suggested interpolation method was evaluated using the FRI benchmark metrics, demonstrating its effectiveness.

From another perspective, in [12], Alzubi et al. proposed a set of benchmark metrics that were designed to unify the evaluation of various FRI methods. The authors compared various FRI methods such the KH method, the incircle method, the VKK method, and others. The results demonstrated that some of the FRI methods fulfilled the suggested benchmark metrics, namely the incircle and MACI methods.

Huang et al., in [13], proposed an interpolative reasoning method using the techniques of scale and move. The suggested scale and move method was able to deal with the polygonal, triangular, and other fuzzy set shapes of membership functions. The suggested scale and move method started the interpolation procedure based on the extraction of the interpolated rule according to the nearest fuzzy rules.

Furthermore, the newly derived inference fuzzy rule was forwarded using the scale and move technique to interpolate the required results from the new observations. In terms of normality and convexity, the suggested scale and move method satisfied those metrics successfully. The suggested method was evaluated using FRI benchmark metrics, and it effectively generated the required results in cases with missing fuzzy rules. From another perspective, the feature ranking algorithms could be applied for the sake of fuzzy rule interpolation.

Zhou et al., in [14], proposed a mechanism that offered an interpolation technique based on a feature selection algorithm. The conducted experiments demonstrated the ability of the suggested method to address cases of missing fuzzy rules. Furthermore, Li et al., in [15], proposed a new FRI technique that was based on adapting various feature selection algorithms. The Information Gain (IG), Relief-F (RF), and Laplacian Score (LS) feature selection algorithms were adapted to enhance the results of the interpolated conclusion. The suggested FRI method was evaluated using several benchmark datasets. The achieved results demonstrated that the use of feature selection algorithms helped to enhance the interpolated conclusions.

Chen et al., in [16], proposed an FRI method based on defining the piecewise fuzzy entropies for each fuzzy set. The suggested FRI method aimed to characterize the initiated points of interpolation results using the representative values of each studied fuzzy set. Furthermore, the suggested FRI method extracted the piecewise values for every antecedent part of the fuzzy model. Subsequently, the weights of each fuzzy rule were calculated. The accomplished experiments demonstrated the effectiveness of the suggested FRI method. Some researchers also examined the effect of distance metrics on the interpolation of the results in cases of missing fuzzy rules.

Mou et al., in [17], proposed an FRI method that adapted the Euclidean distance within the sparse fuzzy rules when determining the nearest fuzzy rules. The suggested FRI method adapted the learned Mahalanobis distance matrix along with the learning method. This adaptation aimed to transform the existing sparse rule base into the new sparse rule base coordinate system. The transformed coordinate system was the baseline for the new observation to match the nearest fuzzy rules and adapt the required interpolation. The conducted experiments demonstrated the efficiency of the suggested FRI method, based on seven benchmark classification problems. Jiang et al., in [18], suggested a method for interpolation reasoning for cases with missing fuzzy rules. The suggested method was based on transforming the sparse fuzzy rule space into an isomorphic data space. This transformation was carried out using the mapping technique on the structural patterns of the existing fuzzy rules. This transformation assisted in defining the number of fuzzy rules that were required to handle the issue of the new observation. Moreover, it effectively reduced the number of fuzzy rules generated. The experimental results showed that the suggested FRI method effectively determined the number of fuzzy rules needed to perform the required interpolation for the new observation. In addition, in [19], Lin et al. proposed a dynamic FRI approach based on the density concept to overcome the issue related to missing fuzzy rules. The suggested FRI approach integrated the OPTICS clustering algorithm to provide and choose the most suitable candidates for fuzzy rules. The goal of using the density concept was to select suitable fuzzy rules that are frequently found. The suggested dynamic FRI approach was tested and evaluated according to open-source benchmark datasets. The conducted experiments demonstrated the effectiveness of the suggested approach.

From another perspective, Chen et al. in [20] proposed a new interpolation method to handle cases of missing fuzzy rules. The suggested FRI method employed a technique of selecting a random subset of sparse fuzzy rules, along with a weighting factor, to interpolate the results for the new observation. The suggested FRI method was tested and evaluated using various benchmark datasets. The results demonstrated the suggested FRI method’s efficiency in interpolating the results in cases of missing fuzzy rules.

These FRI methods offer a suitable way to use a few fuzzy rules to interpolate the required results. This advantage aids in reducing a large number of fuzzy rules and, at the same time, reduces the complexity of the fuzzy system. Tan et al., in [21], proposed a framework that was able to generate sparse fuzzy rules. These sparse fuzzy rules were able to handle the required conclusions. The suggested framework was initiated by identifying important fuzzy rules, which were characterized by their inability to be approximated based on neighboring fuzzy rules. The suggested framework was able to work in the sparse region. In addition, in [22], Alzubi et al. proposed an enhancement technique for the incircle FRI method. The incircle FRI method interpolates the required results by defining the weight of the center point of the incircle. The suggested enhancement technique enabled the required modifications of the weight calculations to be carried out, along with using the shift technique. This enhancement aimed to ensure that the new input could be covered, even in cases of extrapolation. The suggested enhancement encircle method was tested based on various FRI benchmark metrics. The results demonstrated that the suggested enhancement of the incircle FRI method handled the issues of extrapolation for the original incircle FRI method. Table 1 summarizes the previous related works.

Table 1. Summary of previous related works.

Reference	Method	Contributions	Evaluation Procedure
[6]	KH Method	Linear interpolation, adaptation of similarity concept, multi-dimensional variable space	Benchmark metrics
[7]	Enhanced KH Method	Modification based on alpha-cut values, address abnormal results	Benchmark metrics
[8]	KH-Stabilized Method	Overcoming abnormality conclusions, weighted distance adaptation	Benchmark metrics
[10]	Extension of Linear Reasoning	Analogical technique, addressing issues related to existing fuzzy rules	Benchmark metrics
[9]	Weighted Fuzzy Interpolative Reasoning	Adaptation of the center of gravity, interpolation for trapezoidal fuzzy sets	Benchmark metrics
[11]	Area-Adaptive Interpolation	Adaptation of fuzzy set area, convexity, and normality in results	Benchmark metrics
[16]	Weighted Fuzzy Rules	Piecewise fuzzy entropies, characterization of interpolation points, extraction of piecewise values	Experimental datasets
[14]	Feature Ranking for FRI	Interpolation based on feature selection algorithm, handling cases of missing fuzzy rules	Experimental datasets
[15]	FRI with Feature Selection Algorithms	Employed feature selection techniques (IG, RF, LS, LLCFS)	Experimental datasets
[13]	Scale and Move Method	Handling various fuzzy set shapes, nearest two existing fuzzy rules, normality and convexity in results	Benchmark metrics
[17]	Mahalanobis Distance in FRI	Adaptation of Mahalanobis distance matrix, transformation of sparse rule base	Benchmark metrics
[18]	Isomorphic Data Space FRI	Transformation of fuzzy rules space, reduction of generated fuzzy rules	Experimental datasets
[20]	Random Subset FRI	Selection of a random subset of sparse fuzzy rules with a weighting factor, handling missing fuzzy rules	Experimental datasets
[21]	Sparse Fuzzy Rule Generation	Identification and optimization of important fuzzy rules for sparse regions	Experimental datasets
[22]	Enhancement of incircle FRI method	Modify the weights, use the shift technique	Benchmark metrics
[19]	Dynamic FRI method	Integrated the OPTICS clustering	Experimental datasets

The previous related works highlight the urgent need to use FRI methods to handle the issues arising in cases with a lack of knowledge and missing fuzzy rules. The suggested threefold approach focuses on defining the distance between the new input and neighboring fuzzy rules to define the suitable factor parameters, while the typical FRI methods adapted the similarity measures or geometric properties. The typical FRI methods focused on handling interpolation, where the new input occurred between two surrounded fuzzy rules, while the suggested threefold approach handles extrapolation using the factor parameters. The suggested threefold approach defines the interpolation conditions, which offer a fair continuation of each fuzzy rule to determine the expected results.

3. The Proposed Threefold Approach

This section introduces in detail the suggested threefold approach along with its main requirements and steps for implementation. Typically, in fuzzy systems, the triangular membership functions are widely used, due to their simplicity [23]. The triangular membership function can be described as ($A_1,B_1,C_1$), where $A_1$ represents the left side, $B_1$ represents the height, and $C_1$ represents the right side. Figure 1 presents the triangular membership function.

Figure 1. The triangular membership function.

For simplicity, in the preliminary stage of the suggested reasoning method, the two fuzzy rules $A1\to B1$ and $A2\to B2$ adjacent to the new observation are considered from the rule base, where A1, A2, B1, and B2 illustrate the fuzzy sets of the antecedents and consequent parts, respectively.

The first essential step of the threefold approach is to determine the distance between the current fuzzy rules and the new observation. The distance between the current fuzzy rules and the new observation can be determined as follows:

$$\mathrm{Distance}(A_i,A^{\ast })=\sqrt{\sum _{j=1}^n{(A_i\left[j\right]-A^{\ast }\left[j\right])}^2}$$

(1)

The existing fuzzy rules are represented by $A_j$ and the new observation is represented by $A^{\ast }$. Figure 2 illustrates the distance between fuzzy rule $A_i$ and observation $A^{\ast }$. After the distance between the current fuzzy rules and the new observation is calculated, the next step is to define the interpolation conditions of the neighboring fuzzy rules.

Figure 2. The interpolation conditions extraction procedure based on the factor parameters.

The interpolation conditions in the threefold approach can be defined as follows:

$$\mathrm{Condition}\left(Rul{e}_{ij}\right)=\left[\begin{array}{c}{A}_{ij}\left[1\right]+{\mathrm{Factor}.\mathrm{R}}_{ij}\times (A_i^{\ast }\left[1\right]-A_{ij}\left[1\right])\\ A_{ij}\left[2\right]+{\mathrm{Factor}.\mathrm{R}}_{ij}\times (A_i^{\ast }\left[2\right]-A_{ij}\left[2\right])\\ ⋮\\ A_{ij}\left[k\right]+{\mathrm{Factor}.\mathrm{R}}_{ij}\times (A_i^{\ast }\left[k\right]-A_{ij}\left[k\right])\end{array}\right]$$

(2)

where $i=1,2,\dots ,n$ refers to the number of inputs and $j=1,2,\dots ,m$ refers to the number of fuzzy sets. It is worth mentioning that the derived interpolation condition in the threefold approach is based on the concept of factors. The ${\mathrm{Factor}.\mathrm{R}}_{ij}$ is used to determine the degree to which each neighboring fuzzy rule contributes to the interpolated results in cases of missing fuzzy rules. ${\mathrm{Factor}.\mathrm{R}}_{ij}$ can be calculated as the ratio distance between the new observation and the neighboring fuzzy rules, as follows:

$${\mathrm{Factor}.\mathrm{R}}_{ij}={\displaystyle \frac{\mathrm{Distance}(A_i^{\ast },A_{ij})}{\mathrm{Total}\mathrm{Distance}(A_{ij},A_{i(j+1)})}}$$

(3)

The aim behind using the factor parameter is to offer a balanced mechanism in the interpolation results. More precisely, each neighboring fuzzy rule has a factor parameter, which measures the effectiveness of each neighboring fuzzy rule for the new observation. This benefit allows the threefold approach to adjust the weights of the neighboring fuzzy rules dynamically.

It is worth mentioning that the previous factor parameter calculation scenario was based on the condition that the new observation’s position was between two adjacent fuzzy rules. However, in the case of the new observation’s position, if it is outside (extrapolation) two adjacent fuzzy rules, then the ${\mathrm{Factor}.\mathrm{R}}_{ij}$ can be calculated as follows:

$$Factor.R_i=\left|{\displaystyle \frac{Distance(A^{\ast },A_i)}{TotalDistance(A_i,A_{i+1})}}-round\left({\displaystyle \frac{Distance(A^{\ast },A_i)}{TotalDistance(A_i,A_{i+1})}}\right)\right|$$

(4)

Regarding the factor parameter, for instance, if there are three fuzzy rules, for example $(A_1\to B_1)$, $(A_2\to B_2)$, and $(A_3\to B_3)$, each rule has its own factor value, as follows:

• Factor.R1 corresponds to Rule 1 ($(A_1\to B_1)$);
• Factor.R2 corresponds to Rule 2 ($(A_2\to B_2)$);
• Factor.R3 corresponds to Rule 3 ($(A_3\to B_3)$).

The factor parameters offer the required balance for the interpolation of the required results by determining the degree to which neighboring fuzzy rule contributes to the interpolated results in cases with missing fuzzy rules. Subsequently, the final step of the threefold approach is to generate the required outputs for the new observation, which are not covered by any of the fuzzy rules. The final output for the new observation is defined as follows:

$$\begin{array}{c}\hfill Output\left(Rul{e}_i\right)=[B_{i1}+Factor.R_i\times (Condition\left(Rul{e}_i\right)-B_{i1}),\\ \hfill B_{i2}+Factor.R_i\times (Condition\left(Rul{e}_i\right)-B_{i2}),\\ \hfill B_{i3}+Factor.R_i\times (Condition\left(Rul{e}_i\right)-B_{i3})]\end{array}$$

(5)

Algorithm 1 summarizes the main steps of the threefold approach for interpolating the output for the new observation $A^{\ast }$, in the case of a single-antecedent part. The general architecture of the proposed threefold approach is shown in Figure 3.

Algorithm 1 Threefold approach algorithm for single-antecedent part with two fuzzy rules

Require: Fuzzy rule parameters: $A_1$, $A_2$, $B_1$, $B_2$, Observation: $A^{\ast }$ The attribute values of the fuzzy sets: $A_1=[a_{11},a_{12},a_{13}]$, $A_2=[a_{21},a_{22},a_{23}]$, $B_1=[b_{11},b_{12},b_{13}]$, $B_2=[b_{21},b_{22},b_{23}]$, $A^{\ast }=[a_{11}^{\ast },a_{12}^{\ast },a_{13}^{\ast }]$, $B^{\ast }=[b_{11}^{\ast },b_{12}^{\ast },b_{13}^{\ast }]$. Ensure: Fuzzy rule outputs: $B_{\mathrm{Rule}1}^{\ast },B_{\mathrm{Rule}2}^{\ast }$ $$ 2: Phase 1: Calculating the distance between the new observation and the existing fuzzy rules 3: Dis($A^{\ast }$, $A_1$) = $|a_{12}^{\ast }$ − $a_{12}|$. 4: Dis($A^{\ast }$, $A_2$) = $|a_{22}$ − $a_{12}^{\ast }|$. 5: Dis($A_1$, $A_2$) = $|a_{22}$ − $a_{12}|$. $$ 6: Phase 2: Determining the interpolation conditions based on factor concept 7: Condition($Rul{e}_1$) = [( $a_{11}$ + Factor.$R_1$ × ($a_1^{\ast }$ − $a_{11}$)),( $a_{12}$ + Factor.$R_1$ × ($a_2^{\ast }$ − $a_{12}$)), ( $a_{13}$ + Factor.$R_1$ × ($a_3^{\ast }$ − $a_{13}$))] 8: Condition($Rul{e}_2$) = [( $a_{21}$ + Factor.$R_2$ × ($a_1^{\ast }$ − $a_{21}$)),( $a_{22}$ + Factor.$R_2$ × ($a_2^{\ast }$ − $a_{22}$)), ( $a_{23}$ + Factor.$R_2$ × ($a_3^{\ast }$ − $a_{23}$))] $$ 9: The factor concept could measured based on two scenarios: 1. In case the observation hits between two adjacent fuzzy rules ($A_1\to B_1$ and $A_2\to B_2$ ), then, the Factor.$R_1$ and Factor.$R_2$ are as follows: $$ 10: if $a_2^{\ast }\ge a_{12}$ and $a_2^{\ast }\le a_{22}$ then 11:     Factor.R1 = (Dis($A^{\ast }$, $A_1$) / Dis($A_1$, $A_2$) ) 12:     Factor.R2 = (Dis($A^{\ast }$, $A_2$) / Dis($A_1$, $A_2$) ) 13: end if 2. In case the observation is extrapolation (outside range) adjacent fuzzy rules ($A_1\to B_1$ and $A_2\to B_2$), then, the Factor.R1 and Factor.R2 is as follows: $$ 14: if $a_2^{\ast }\le a_{12}$ and $a_2^{\ast }\ge a_{22}$ then 15:     Dis.$R_1$ = (Dis($A^{\ast }$, $A_1$) / Dis($A_1$, $A_2$) ) 16:     Factor.$R_1$ = | Dis.$R_1$ − round(Dis.$R_1$) | 17:     Dis.$R_2$ = (Dis($A^{\ast }$, $A_2$) / Dis($A_1$, $A_2$) ) 18:     Factor.$R_2$ = | Dis.$R_2$ − round(Dis.$R_2$) | 19: end if 20: $$ $$ 21: Phase 3: The interpolated results are computed as follows: 22: Output($Rul{e}_1$) = [($b_{11}$ + Factor.$R_1$ × (Condition($Rul{e}_1$) – $b_{11}$)),($b_{12}$ + Factor.$R_1$ × (Condition($Rul{e}_1$) – $b_{12}$)),($b_{13}$ + Factor.$R_1$ × (Condition($Rul{e}_1$) – $b_{13}$))] 23: Output($Rul{e}_2$) = [($b_{21}$ + Factor.$R_2$ × (Condition($Rul{e}_2$) – $b_{21}$)),($b_{22}$ + Factor.$R_i$ × (Condition($Rul{e}_2$) – $b_{22}$)),($b_{23}$ + Factor.$R_2$ × (Condition($Rul{e}_2$) – $b_{23}$))]

Figure 3. The general architecture of the proposed threefold approach.

4. Experiments and Results

This section presents the evaluation procedure for the suggested threefold approach for cases with missing fuzzy rules and a lack of knowledge base. Fortunately, there are FRI benchmark metrics that have been introduced in [11,13,24,25,26,27], which can be used to evaluate the effectiveness of the suggested FRI method when interpolating the required results in various scenarios. Although FRI benchmark metrics provide an initial demonstration of the effectiveness of the suggested FRI method, evaluating the suggested FRI method based on a benchmark dataset offers an opportunity to evaluate its effectiveness in terms of practical applications. Therefore, the evaluation procedure of the suggested threefold approach was undertaken using the following two steps. Firstly, the FRI benchmark metrics were used to evaluate the effectiveness of FRI methods in various scenarios. Secondly, the proposed threefold approach was evaluated based on a real-life benchmark dataset (a phishing dataset). The reason behind using the phishing attacks dataset is because it is a suitable application area with limited data availability and a lack of knowledge base [28]; thus, it is a suitable environment in which to apply the FRI evaluation methods. The characteristics of the applied FRI benchmark metrics are presented in Table 2.

Table 2. Characteristics of the applied FRI benchmark metrics.

Benchmark Metric	Antecedent Part	Consequent Part	Shape
Metric 1	A1 = [0 5 4 ], A2 = [11 13 14], ${\mathrm{A}}^{\ast }observation$ = [7 8 9 ]	B1 = [0 2 4 ], B2 = [10 11 13]	Triangular, triangular
Metric 2	A1 = [0 5 6], A2 = [11 13 14], ${\mathrm{A}}^{\ast }observation$ = [8 8 8]	B1 = [0 2 4 ], B2 = [10 11 13]	Triangular, singleton
Metric 3	A1 = [3 3 3 ], A2 = [11 13 14], ${\mathrm{A}}^{\ast }observation$ = [5 7 9 ]	B1 = [4 4 4 ], B2 = [10 11.5 13]	Mixed: singleton, triangular
Metric 4	A1 = [0 4 5 6 ], A2 = [11 12 13 14], ${\mathrm{A}}^{\ast }observation$ = [6 6 9 10]	B1 = [0 2 3 4], B2 = [10 11 12 13]	Trapezoidal

Benchmark metric 1 aimed to evaluate the effectiveness of the suggested threefold approach to interpolate the required results in cases of triangular fuzzy sets that represent all parts of a fuzzy system. Various FRI methods can be evaluated according to benchmark metric (1), as in [29]. The proposed threefold approach generates a meaningful conclusion to handle the scenario when evaluated using FRI benchmark metric (1). Precisely, the conclusion of the threefold approach was derived as follows: the new conditions between the antecedents and the new observation fuzzy sets (Condition(${\mathrm{Rule}}_i$)) were calculated using Equation (2), generating Condition(Rule1) = [3.11, 5.77, 6.7778] and Condition(Rule2) = [8.77, 10.22, 11.22]. Using Equations (3) and (4), the factor variables were computed as follows: Factor.R1 = 0.4444 and Factor.R2 = 0.5556. Then, the results of the factor values were used to calculate the Output(${\mathrm{Rule}}_i$) using Equation (5). Then, the new conditions of the output were represented as Output(Rule1) = [0, 1.11, 2.22] and Output(Rule2) = [4.44, 4.88, 5.77]. Finally, based on the factor values, the minimum value was selected, which was close to the observation. Therefore, the final result of this benchmark metric was Output(Rule1) = [0, 1.11, 2.22], which is close to the Rule 1 shown in Figure 4.

Figure 4. The results of the threefold approach evaluation compared to other FRI methods [22,25], based on benchmark metric (1).

In terms of benchmark metric 2, this benchmark metric aimed to evaluate the effectiveness of the proposed threefold approach in a scenario where the observation appeared as a singleton fuzzy set. The suggested threefold approach was able to successfully interpolate the required fuzzy rules able to handle the issue related to benchmark metric (2). The conclusion of the threefold approach was derived as follows: the new conditions between the antecedents and the new observation fuzzy sets (Condition(${\mathrm{Rule}}_i$)) were calculated using Equation (2), generating Condition(Rule1) = [3.00, 6.13, 6.75] and Condition(Rule2) = [9.33, 10.22, 10.66]. Using Equations (3) and (4), the factor variables were computed, resulting in Factor.R1 = 0.3750 and Factor.R2 = 0.6250. Thereafter, the results of the factor values were used to calculate the Output(${\mathrm{Rule}}_i$), using Equation (5). Therefore, the new conditions of the output were represented as Output(Rule1) = [0.00, 1.25, 2.50] and Output(Rule2) = [4.44, 4.88, 5.77]. Finally, based on the factor values, the minimum value was selected, which was close to the new observation. The final result of this benchmark metric was Output(Rule1) = [0.00, 1.25, 2.50], which was close to the Rule1 shown in Figure 5. The suggested threefold approach was able to interpolate the required conclusion for benchmark metric (2). With regards to [29], the suggested threefold approach was able to generate the required conclusion for this scenario of fuzzy set shapes.

Figure 5. The results of the threefold approach evaluation compared to other FRI methods [22,25], based on benchmark metric (2).

The suggested threefold approach successfully generated the required conclusion for the previous two benchmark metrics. However, in the case of mixed-shape fuzzy sets, where the singleton fuzzy sets illustrated the rule ($A_1$, $B_1$) and the triangular fuzzy sets illustrated the rule ($A_2$, $B_2$), the new observation appeared as a triangular fuzzy set. This case reflected benchmark metric 3.

The suggested threefold approach was able to handle the scenario of FRI benchmark metric (3) as the new condition between the antecedents and the observation fuzzy sets (Condition(${\mathrm{Rule}}_i$)), which was calculated using Equation (2) and generated Condition(Rule1) = [3.8, 4.6, 5.4] and Condition(Rule2) = [7.66, 9.66, 11.22]. Using Equations (3) and (4), the factor variables were computed, which totaled Factor.R1 = 0.4 and Factor.R2 = 0.6. Then, the results of the factor values were used to calculate the Output(${\mathrm{Rule}}_i$), using Equation (5). Subsequently, the new conditions of the output were Output(Rule1) = [2.4, 2.4, 2.4] and Output(Rule2) = [4.44, 5.11, 5.77]. Finally, based on the factor values, the minimum value was selected, which was close to the new observation. Therefore, the final result of this benchmark metric was Output(Rule1) = [2.4, 2.4, 2.4], which was close to the Rule1 shown in Figure 6.

Figure 6. The results of the threefold approach evaluation compared to other FRI methods [22,25], based on benchmark metric (3).

Benchmark metric 4 aimed to evaluate the effectiveness of the suggested threefold approach when using a trapezoidal fuzzy set. The threefold approach effectively generated the required fuzzy rules that could handle the new observation that appeared in the sparse region. The suggested threefold approach also derived the required conclusion for this benchmark metric through the calculation of new conditions between the antecedents and the observation fuzzy sets (Condition(${\mathrm{Rule}}_i$)), using Equation (2), which were Condition(Rule1) = [2.25, 4.75, 6.5, 7.5], and Condition(Rule2) = [7.875, 8.25, 10.50, 11.5]. Using Equations (3) and (4), the factor variables were computed as Factor.R1 = 0.3750 and Factor.R2 = 0.6250. Then, the results of the factor values were used to calculate the Output (${\mathrm{Rule}}_i$), using Equation (5). Subsequently, the new conditions of the output were Output(Rule1) = [0, 1.25, 1.875, 2.5] and Output(Rule2) = [3.75, 4.125, 4.5, 4.875]. Finally, based on the factor values, the minimum value was close to the new observation. Therefore, the final result of this benchmark metric was Output(Rule1) = [0, 1.25, 1.875, 2.5], which was close to the Rule1 shown in Figure 7. Table 3 summarizes the accomplished results, based on the studied FRI benchmark metrics. As discussed in Section 2, significant contributions were proposed to overcome the issues related to the missing fuzzy rules. We conducted a comparative analysis with other FRI methods that employed the same benchmark metrics for more in-depth analysis. Table 4 compares the results of the evaluation of the suggested threefold approach with that of other FRI methods, employing the same FRI benchmark metrics.

Figure 7. The results of the threefold approach evaluation compared to other FRI methods [22,25], based on benchmark metric (4).

Table 3. Summary of archived results generated using the FRI benchmark metrics.

Observation	Condition (Rule1)	Condition (Rule2)	Factor.R1	Factor.R2	Output
Metric 1	[3.11 5.77 6.7778]	[8.77 10.22 11.22]	0.4444	0.5556	[0 1.11 2.22]
Metric 2	[3.00 6.13 6.75]	[9.33 10.22 10.66]	0.3750	0.6250	[0.00 1.25 2.50]
Metric 3	[3.8 4.6 5.4]	[7.66 9.66 11.22]	0.4	0.6	[2.4 2.4 2.4]
Metric 4	[2.25 4.75 6.5 7.5]	[7.875 8.25 10.50 11.5]	0.3750	0.6250	[0 1.25 1.875 2.5]

Table 4. Comparison with Related FRI Methods.

Benchmark Metric	FRI Method	Reference	Interpolated Result
Benchmark Metric 1 and Benchmark Metric 2 Benchmark Metric 3 and Benchmark Metric 4	KH FRI	[6]	Metric (1) = [6.36 5.38 7.38]
			Metric (2) = [7.27 5.38 6.25]
			Metric (3) = [5.33 6.33 9.00]
			Metric (4) = [5.45 4.25 7.5 7.4]
	KHstab FRI	[8]	Metric (1) = [7.27 5.38 6.25]
			Metric (2) = [7.27 5.38 6.25]
			Metric (3) = [5.33 6.33 9.00]
			Metric (4) = [5.45 4.25 7.5 7.4]
	VKK FRI	[7]	Metric (1) = [6.15 5.38 7.84]
			Metric (2) = [7.00 5.38 7.00]
			Metric (3) = [—]
			Metric (4) = [5.3 4.4 7.4 7.7]
	CCL FRI	[11]	Metric (1) = [4.94 5.38 7.38]
			Metric (2) = [5.38 5.38 5.38]
			Metric (3) = [5.33 6.33 8.33]
			Metric (4) = [4.25 4.25 7.5 8.5]
	HS FRI	[13]	Metric (1) = [5.83 6.26 7.38]
			Metric (2) = [6.49 6.49 6.49]
			Metric (3) = [5.71 6.28 8.16]
			Metric (4) = [5.23 5.23 7.61 8.5]
	HTY FRI	[30]	Metric (1) = [5.76 6.42 7.30]
			Metric (2) = [6.49 6.49 6.49]
			Metric (3) = [—]
			Metric (4) = [4.98 7.44 6.44 8.06]
	HCL FRI	[31]	Metric (1) = [6.36 6.58 7.38]
			Metric (2) = [7.27 — 6.25]
			Metric (3) = [5.33 6.55 9.00]
			Metric (4) = [—]
	Threefold Approach		Metric (1) = [0 1.11 2.22]
			Metric (2) = [0 1.25 2.50]
			Metric (3) = [2.40 2.40 2.40]
			Metric (4) = [0 1.25 1.87 2.50]

Note: The symbol (—) denotes that the FRI method failed to generate the required results.

To summarize the accomplished results, the suggested threefold approach was successfully evaluated using the aforementioned FRI benchmark metrics and generated the required results in cases when a sparse region appeared. For a more extensive evaluation, the next step focused on applying the suggested threefold approach to a phishing attack dataset. The domain of phishing attacks is a relevant domain that suffers from a lack of knowledge base and limited data availability. The studied phishing attack dataset was introduced by Tan et al. in [32]. It includes 10,000 instances, along with 48 features. It is worth mentioning that this number of input parameters is considered a large number of fuzzy systems. Moreover, some input parameters may not reflect the real behavior of the phishing attack. Therefore, we have extracted only the top five features that were introduced by [33,34]. In addition, the extracted top five parameters were normalized to offer more consistency for the input observations as well as to simplify the rule base, and to mitigate the effect of outliers if they existed. The extracted input parameters and their linguistic terms are presented in Table 5.

Table 5. The top five features of the phishing attack dataset.

Index	The Top 5 Features of Phishing Attack Dataset	Linguistic Terms
1	PctExtHyperlinks	L, M, H
2	PctExtResourceUrls	L, M, H
3	NumNumericChars	L, M, H
4	PctExtNullSelfRedirectHyperlinksRT	L, M, H
5	PctNullSelfRedirectHyperlinks	L, M, H

L = low, M = medium, H = high.

For the sake of simplicity, the triangular fuzzy set was used to represent each input parameter. The consequent part, representing the class label, was a fuzzy singleton shape. The fuzzy singleton shape was used to present the discrete crisp output. It is important to note that no optimization technique was used for the membership function values, since the core contribution of this work is to introduce the concept of the threefold approach for interpolating the required results in cases with missing fuzzy rules. Certainly, adopting optimization techniques for the membership values and fuzzy rules could enhance the performance and effectiveness of the inference engine. The fuzzy rules and membership values were learned using a classical method in [35]. The fuzzy set parameters were generated to produce an environment that had highly sparse regions. Afterward, several observations (input parameters) that were located in the sparse region and not covered by any fuzzy rules were passed to the suggested threefold approach. The experiments conducted and the results obtained demonstrated the ability of the suggested threefold approach to generate the required results in the case of sparse regions, as shown in Figure 8 and Figure 9, respectively. Figure 10 presents the performance metrics of the suggested threefold approach based on the phishing attack dataset.

Figure 8. The results of the threefold approach in the case of missing fuzzy rules (part 1).

Figure 9. The results of the threefold approach in the case of missing fuzzy rules (part 2).

Figure 10. The performance metrics of suggested threefold approach for the phishing attack dataset.

The proposed threefold approach successfully interpolated the required results across various benchmark metrics and generated the required alerts for the case study involving the phishing attack dataset. This method could be suitable for use in other application areas that suffer from sparse fuzzy rules. Furthermore, the suggested approach was characterized by its ability to work even if there was only one neighboring fuzzy rule. In addition, the suggested threefold approach was able to generate the required interpolation results even in cases with mixed-shape fuzzy sets. Therefore, it was not restricted to a specific fuzzy set shape. Finally, the threefold approach was compatible with existing fuzzy rules. Specifically, it could produce accurate results when the new observation precisely matched one of the existing fuzzy rules.

Despite the promising results of the proposed threefold approach, the threefold approach results depended on the quality of the existing fuzzy rules. In other words, the results obtained here by the threefold approach could be unrealistic in cases involving low-quality fuzzy rules. One of the possible solutions is to adapt optimization algorithms as metaheuristic optimization algorithms. The metaheuristic optimization algorithms could be used to extract baseline fuzzy rules with high quality to be used to generate the required interpolated results. Moreover, achieving a balance between accurate interpolation results and a simple fuzzy system may not always be straightforward.

5. Conclusions

This paper introduced the threefold approach as a fuzzy rule interpolation reasoning method. The suggested threefold reasoning method aimed to handle the case of sparse regions in fuzzy systems with missing fuzzy rules. The suggested approach was initiated by computing the distance between the new observation and the current fuzzy rules. Subsequently, the fuzzy interpolation conditions were computed according to the neighboring fuzzy rules to determine the degree to which each neighboring fuzzy rule contributed to the interpolated results in cases with missing fuzzy rules. Consequently, the suggested threefold approach generated the required results using the computed interpolation conditions of each neighboring fuzzy rule. The suggested approach was characterized by its ability to work even if there was only one neighboring fuzzy rule. Moreover, it was able to work in the case of extrapolation, which could be beneficial in a dynamic environment. In addition, the suggested threefold approach was able to generate the required interpolation results even in the case of mixed-shape fuzzy sets. Therefore, it was not restricted to a specific fuzzy shape. The conducted experiments involved the following two scenarios. The first scenario used FRI benchmark metrics; the obtained results illustrated the effectiveness of the suggested approach in generating the required interpolation results for different FRI benchmark metric-based scenarios. The second scenario used a phishing attack dataset, which was considered a suitable candidate because it suffered from a lack of knowledge and limited data availability. The obtained results illustrated the effectiveness of the suggested approach in handling cases with missing fuzzy rules for the studied phishing attack dataset. Consequently, the suggested threefold approach could be a suitable reasoning method for handling cases with missing fuzzy rules as well as for reducing the complexity of fuzzy systems.

For future work, it could be worth extending the current threefold approach to handle cases involving different fuzzy set shapes. Moreover, it could be useful to adapt optimization algorithms for the extraction of high-quality base fuzzy rules, to be used later for interpolating results.