Fuzzy‐Gated Selective Machine Learning for CTI‐Based Network Connection Management: A Pareto Evaluation

ABSTRACT

Modern network operations require timely IP risk decisions without executing complete machine learning pipelines for every observed address. This work proposes an interpretable and conservative fuzzy‐gated selective inference architecture for multisource cyber threat intelligence (CTI)‐based network connection management. Indicators from multiple CTI sources are first evaluated by an interpretable fuzzy system. Clear allowlist or denylist cases receive direct decisions, while uncertain cases are referred to an ML fallback, ensuring that only necessary observations undergo preprocessing and inference. Eight ML approaches are evaluated using a public CTI‐derived dataset with 10,000 labeled IP addresses. The reference classes represent a multisource CTI consensus rather than independently verified incident ground truth. The proposed solution directly solved 57.95% of observations with no false‐block or false‐allow decisions relative to these consensus labels, referring the remaining 42.05% to ML. Selective inference reduced mean local decision pipeline latency by 15.79%–55.39% compared with full model execution while preserving Balanced Accuracy to the reported precision relative to full model execution. The numerically highest Balanced Accuracy was 99.883% relative to the consensus reference labels, considering a Pareto analysis that identified nondominated configurations spanning lightweight and near‐maximum agreement alternatives. These results show that interpretable fuzzy routing can substantially reduce ML processing overhead while preserving agreement with the adopted CTI consensus decision policy; they should not be interpreted as independently validated malicious‐IP detection accuracy.