HYBRID INTELLIGENT DECISION-SUPPORT SYSTEM FOR CYBERSECURITY RISK ASSESSMENT AND SECURITY ACTION SELECTION

Selecting appropriate information security systems is a complex task influenced by organizational risks, infrastructure characteristics, evolving cyber threats, and regulatory requirements. Traditional approaches based on manual analysis and expert judgment often lack adaptability, scalability, and consistency in dynamic cybersecurity environments. This study proposes a hybrid intelligent decision-support system that combines fuzzy logic, machine learning, and ISO-based cybersecurity standards for risk assessment and security action recommendation. The fuzzy inference module evaluates cybersecurity events under uncertainty using parameters such as attack frequency, vulnerability level, and defense efficiency. Based on the calculated risk level, the system generates standardized response actions aligned with international ISO/IEC standards. In addition, a Random Forest machine learning model is used to evaluate whether the selected actions are likely to mitigate the attack successfully. Experimental evaluation performed on a synthetic dataset demonstrated that the proposed hybrid architecture achieves high predictive performance and improves both interpretability and adaptability of cybersecurity decision support systems in complex operational environments.

1. Apruzzese, G., et al. The Role of Machine Learning in Cybersecurity. Digital Threats: Research and Practice, 4 (1), 1–38 (2022). https://doi.org/10.1145/3545574

2. Kerimkhulle, S., et al. Fuzzy Logic and Its Application in the Assessment of Information Security Risk of Industrial Internet of Things. Symmetry, 15 (10), 1958 (2023). https://doi.org/10.3390/sym15101958

3. Merola, F., Bernardeschi, C., Lami, G. A Risk Assessment Framework Based on Fuzzy Logic for Automotive Systems. Safety, 10 (2), 41 (2024). https://doi.org/10.3390/safety10020041

4. Soori, M., et al. AI-Based Decision Support Systems in Industry 4.0: A Review. Journal of Economy and Technology, 4, 206–225 (2024). https://doi.org/10.1016/j.ject.2024.08.005

5. Singer, P., Friedman, A. Cybersecurity and Cyberwar: What Everyone Needs to Know. Oxford University Press (2014). https://doi.org/10.1093/wentk/9780199918096.001.0001

6. Peltier, T.R. Information Security Policies, Procedures, and Standards. CRC Press (2021).

7. Ahmed, M., Mahmood, A., Hu, J. A Survey of Network Anomaly Detection Techniques. Journal of Network and Computer Applications, 60, 19–31 (2015). https://doi.org/10.1016/j.jnca.2015.11.016

8. Wang, M., et al. Machine Learning for Networking: Workflow, Advances and Opportunities. IEEE Network, 32 (2), 92–99 (2018). https://doi.org/10.1109/MNET.2017.1700200

9. Ludonga, A., Singo, S. Systematic Review Cyber Risk Management: Frameworks, Strategies, and Case Studies in Cybersecurity (2025). https://doi.org/10.5281/zenodo.17372361

10. Zadeh, L.A. Fuzzy Sets. Information and Control, 8 (3), 338–353 (1965). https://doi.org/10.1016/S0019-9958(65)90241-X

11. ISO/IEC 27001:2022 Information Security Management Systems (2022). https://www.iso.org/standard/27001

12. Tukaram, L. Deep Learning in Cybersecurity: Applications, Challenges, and Future Prospects. International Journal of Innovations in Science Engineering and Management, 4 (2), 27–33 (2025). https://doi.org/10.69968/ijisem.2025v4i227-33