Fuzzy logic-based decision support framework for cybersecurity threat assessment in information technology systems
Abstract
The rapidly evolving landscape of cybersecurity threats presents significant challenges for information technology systems, demanding robust assessment mechanisms capable of handling uncertainty and imprecision inherent in cyber threats. Conventional threat assessment techniques based on classification and threshold-based decision rules cannot effectively handle the uncertainty, impreciseness, and complexity inherent in cyber threats. This paper presents a fuzzy logic-based decision support framework for cybersecurity threat assessment that overcomes the limitations of conventional techniques through multi-criteria decision-making grounded in fuzzy systems theory. The framework employs a three-layer architecture consisting of data collection, fuzzy processing, and decision output. Four key variables — threat severity, attack frequency, vulnerability index, and destination-host exposure profile — are defined as fuzzy sets, and decisions are produced by a Mamdani fuzzy inference system operating on 256 expert-generated rules, yielding a composite risk level output. Experimental validation on benchmark datasets NSL-KDD and CICIDS2017 demonstrates that the proposed framework achieves 96.8% accuracy with a false positive rate of 1.8%, achieving higher accuracy and lower false positive rate than all compared baseline models under identical experimental conditions, with statistically significant differences (p < 0.05) for all comparisons except the Transformer model (p = 0.08). A real-world enterprise case study involving a financial services organization further validates the practical applicability of the framework, with 93.2% agreement rate against expert assessments and an end-to-end assessment time of 2.1 milliseconds (comprising 0.7 ms preprocessing and 1.4 ms fuzzy inference). The results confirm that fuzzy logic provides an effective mathematical foundation for addressing the vagueness and imprecision that characterizes cybersecurity threat evaluation.