An Explainable Fuzzy–AI Framework for Cybersecurity ThreatAssessment under Uncertainty

Abstract

Artificial-intelligence-based intrusion detection systems can achieve strong predictive performance, but their probability outputs are often treated as final decisions without an explicit representation of operational context. This study proposes an explainable hybrid Fuzzy–AI framework that separates attack detection from threat assessment. A supervised detector estimates a calibrated probability of malicious activity (AP) from network-flow features, and a Mamdani fuzzy layer combines AP with traffic volume, connection duration, protocol anomaly and source reliability to produce a continuous Cyber Threat Level (CTL, 0–100) and five linguistic priority classes. The revised rule base (49 rules) covers all 243 antecedent combinations, guarantees that a high-confidence detection is never rated below Moderate, and keeps AP influential in every context. Experiments used a reproducible 10% file-wise sample of CICIDS2017 (269,091 flows). Because destination port and initial TCP window sizes act as capture artefacts, the detector was re-evaluated without them, under a stratified random split and two temporal hold-outs, over five seeds. With the leakage-reduced feature set, XGBoost reached F1 = 0.9875 ± 0.0014 on the random split, but F1 = 0.9691 ± 0.0014 on a within-file chronological hold-out and 0.4478 ± 0.0185 when all Friday traffic was held out, showing that near-perfect random-split scores overstate generalisation. Isotonic calibration changed the expected calibration error from 0.0052 ± 0.0005 to 0.0008 ± 0.0002. Run on every test flow with training-only context estimators, the revised fuzzy layer placed 98.60% ± 0.17 of attacks and 1.54% ± 0.14 of benign flows in the High/Critical classes (detector probability alone: 0.11% ± 0.02 of benign flows), whereas the original 35-rule base was undefined for 20.03% ± 0.10 of test flows. When Friday traffic was held out, contextual indicators did not recover the attacks missed by the detector. Controlled analyses showed that two events with the same AP of 0.82 received CTL 81.2 (Critical) and 50.0 (Moderate) under severe and benign context, and variance-based sensitivity analysis attributed the largest share of CTL variance to AP, followed by protocol anomaly and source reliability. SHAP explains the detector and the fired rules explain the threat level, supporting fuzzy contextualisation as a transparent post-detection layer for alert prioritisation rather than as a replacement for the classifier.