Applying Xfuzzy for the Development of Fuzzy Logic-Based Anomaly Detection Systems in Network Security: Moroccan Agribusiness SME

In today's increasingly interconnected world, network security has become a critical concern for enterprises of all sizes, particularly for small and medium-sized enterprises (SMEs) in the agribusiness sector [1]. As these businesses transition to digital platforms to enhance operational efficiency and streamline supply chains, they also become more vulnerable to a myriad of cyber threats [2]. This necessitates the adoption of advanced security measures that are both effective and adaptable to the dynamic nature of cyber environments. One promising approach is the implementation of fuzzy logic-based anomaly detection systems, which leverage the inherent flexibility of fuzzy logic to identify deviations from normal network behavior [3].

The Moroccan agribusiness sector plays a vital role in the national economy, contributing significantly to employment, food security, and economic development [4]. However, like many other industries, agribusinesses are increasingly relying on digital technologies and networked systems to optimize operations [5]. This digital transformation, while beneficial, also exposes these enterprises to various cyber threats, including data breaches, malware attacks, and unauthorized access [6]. Traditional security mechanisms often fall short in detecting and mitigating these sophisticated attacks, leading to significant financial and operational risks [7].

Fuzzy logic, first introduced by Lotfi Zadeh in 1965, provides a robust framework for handling uncertainty and imprecision, making it particularly well-suited for complex and dynamic environments such as network security [8]. Unlike binary logic, which operates on precise true or false values, fuzzy logic allows for degrees of truth, enabling more nuanced and flexible decision-making processes [9]. By applying fuzzy logic to anomaly detection, it is possible to develop systems that can adapt to changing network conditions and effectively identify unusual patterns that may indicate potential security threats [10].

Xfuzzy is an integrated development environment specifically designed to facilitate the design, verification, and implementation of fuzzy systems [11]. It offers a comprehensive set of tools for building and testing fuzzy logic controllers and decision-making systems, making it an ideal platform for developing anomaly detection systems.

In this study, we focus on the practical application of Xfuzzy in a Moroccan agribusiness SME that has recently adopted digital technologies to improve its operational processes. The Moroccan agribusiness SME in question has implemented an open-source Enterprise Resource Planning (ERP) system to streamline its operations and improve decision-making. However, this digitalization process has also increased the company's exposure to cyber threats. To address these concerns, the SME has adopted a fuzzy logic-based anomaly detection system developed using Xfuzzy. The system monitors network traffic in real-time, identifies unusual patterns, and alerts the IT team to potential security breaches. The implementation of this system has resulted in significant improvements in the company's network security posture, demonstrating the practical benefits of fuzzy logic in enhancing network security.

The implementation of Xfuzzy in a Moroccan agribusiness SME presents a practical case study of how fuzzy logic can enhance network security. This SME operates in the production and export of citrus fruits, making it a vital player in the regional agricultural economy. The company has adopted digital technologies to optimize its operations, including an open-source ERP system tailored to manage agricultural processes.

The ERP system has enabled the company to streamline processes such as inventory management, financial reporting, and supply chain logistics. For example, by integrating IoT sensors in their orange groves, they can monitor soil moisture and optimize irrigation, leading to a 15% reduction in water usage. Additionally, the implementation of automated inventory tracking has reduced stock discrepancies by 20%, resulting in a 25% overall increase in operational efficiency.

However, this digitalization has increased the enterprise's vulnerability to cyber threats. Over the past year, the company has experienced a 40% rise in attempted cyber-attacks, including phishing attempts aimed at stealing sensitive employee information, malware infections targeting the ERP system, and unauthorized access attempts to their financial records. These incidents have underscored the need for advanced security measures to protect sensitive data and ensure operational continuity.

In response, the company implemented a fuzzy logic-based anomaly detection system using Xfuzzy. This system continuously monitors network traffic across key segments, including the Office LAN, Production Network, External WAN, and ERP System. By analyzing patterns and detecting anomalies in real-time, the system provides early warnings of potential security breaches, enabling the IT team to take swift action. Figure 1 shows the application of the Xfuzzy logic process, aimed at identifying and prioritizing security threats.

Step 1. Defining the Problem Space: This involves mapping out the entire network topology, identifying all connected devices, the protocols they use to communicate, and the patterns of data flow between them (Table 1).

By analyzing network traffic patterns and historical security incidents, common sources of anomalies in this context may include:

• Unusual Traffic Patterns: Anomalies such as sudden spikes in traffic volume, unusual communication patterns between devices, or unexpected access attempts can indicate potential security threats.
• Unauthorized Access Attempts: Attempts to access restricted areas of the network, such as the ERP system or production control systems, by unauthorized users.
• Malware Activities: Indicators of compromise such as known malicious IP addresses, unusual outbound connections, or unexpected data exfiltration attempts.

1.png

Figure 1. Xfuzzy logic process

Table 1. The network of the Moroccan agribusiness SME

Table 2. Weekly network traffic analysis and anomaly detection summary

Table 3. Network traffic preprocessing

Table 4. Normalized dataset for network traffic preprocessing

By analyzing typical traffic patterns during business hours and off-peak hours, it is possible to detect deviations that may indicate potential security threats. This involves comparing the expected data flow characteristics across different segments of the network (Table 2).

This table reveals that average and peak traffic volumes are consistently higher during weekdays, ranging from 480 MB to 520 MB and 680 MB to 750 MB, respectively, indicating robust operational activity. Notably, the number of detected anomalies correlates with increased traffic volumes, particularly on Fridays, which recorded the highest peak traffic (750 MB) and the most anomalies (4 events). This suggests a higher likelihood of detecting anomalies during periods of intense network activity. In contrast, weekends show significantly lower traffic volumes and no detected anomalies, reflecting reduced network usage.

Step 2. Data Collection and Preprocessing: We collect comprehensive network traffic data for analysis, which involves setting up monitoring tools to capture data packets, log connection attempts, and record access logs. This collected data is then preprocessed to remove noise and normalize values for consistency [20-22]. Key attributes to be extracted include packet size, which refers to the size of data packets transmitted over the network; connection duration, indicating the length of time each network connection remains active; source and destination IP addresses, which help in identifying the origin and target of network traffic; and protocol type, defining the communication protocol used, such as HTTP, FTP, or SSH (Table 3).

Data preprocessing is a crucial phase in developing a fuzzy logic-based anomaly detection system, ensuring that the dataset is clean, consistent, and ready for effective modeling [23]. The raw data often contains noise, such as incomplete or irrelevant packets, which can affect the accuracy of the anomaly detection system [24-27]. For instance, missing data is addressed through imputation methods such as replacing missing numerical values with the mean or median of the attribute, while categorical data may be filled using mode imputation.

Normalization is another essential step, as it is performed to ensure consistency across different attributes, making the data suitable for the fuzzy logic system [25]. This involves scaling the values to a common range, typically between 0 and 1, using methods like min-max normalization [26] (Table 4). For example, packet sizes and connection durations are normalized as follows:

$Normalized\,\, Value =\frac{{ original-Min }}{{ Max-Min }}$  (1)

The preprocessed data is then divided into training and testing datasets. Typically, 70% of the data is used for training the fuzzy logic-based anomaly detection model, while the remaining 30% is reserved for testing and validation [27]. This division ensures that the model can learn patterns from the training data and be evaluated on unseen data during the testing phase (Table 5).

Table 5. Dataset division for training and testing

For supervised learning approaches, the datasets are labeled to indicate normal and anomalous traffic. Historical data on known anomalies is used to label the dataset, providing a ground truth for training the model. The labeled dataset helps the system learn to differentiate between normal and suspicious activities (Table 6).

This table illustrates the crucial distinction between typical network behavior (labeled as "Normal") and suspicious activities (labeled as "Anomaly"), essential for supervised learning. For instance, an HTTP packet from 192.168.1.100 to 192.168.1.101 with a packet size of 0.20 and a connection duration of 0.80 is considered normal, while an FTP packet from 192.168.1.102 to 10.0.0.1 with a packet size of 1.00 and a connection duration of 0.40 is flagged as anomalous.

Table 6. Labeled dataset for network traffic preprocessing

Step 3. Designing FIS Using Xfuzzy: For the Moroccan agribusiness SME's network traffic, the input variables are Packet Size (PS), Connection Duration (CD), and Protocol Type (PT), while the output variable is Anomaly Likelihood (AL). The selection of input variables was guided by their strong correlation with anomalous behavior in network security studies. For instance, packet size and connection duration are critical indicators of data flow irregularities, while protocol type provides context to classify traffic patterns more effectively.

Membership functions play a crucial role in fuzzy logic systems by defining how each input variable is mapped to a degree of membership in a fuzzy set [28]. These functions can take various shapes, such as triangular, trapezoidal, or Gaussian, depending on the specific requirements of the application [29-31]. In our context, we utilize triangular membership functions for simplicity and computational efficiency.

This choice was driven by considerations of computational efficiency and domain suitability for real-time anomaly detection in network traffic. Triangular membership functions are computationally less intensive as they require fewer mathematical operations—specifically, simple linear equations—compared to the exponential calculations involved in Gaussian functions or the additional parameters required for trapezoidal ones [32-33]. This simplicity makes triangular functions particularly suitable for scenarios like the Moroccan agribusiness SME environment, where resource constraints and the need for swift anomaly detection are critical. Moreover, triangular functions provide sufficient precision for modeling the input variables, allowing for clear distinctions between membership grades without overly complex boundaries. Given the real-time requirements of the application, the use of triangular functions strikes an optimal balance between accuracy and computational practicality, ensuring the system remains effective and adaptable without overburdening processing resources.

A triangular membership function for Packet Size (PS) is defined as follows [22]:

$\mu_{{Small }}(x)=\left\{\begin{array}{cc}0 & { if } x \leq a \\ \frac{x-a}{b-a} &{ if } a<x<b \\ 1 & { if } x \geq b\end{array}\right.$   （2）

where, a and b are the lower and upper bounds of the triangular function for "Small" packet size. This simple yet effective representation allows for smooth transitions between different degrees of membership, making it suitable for real-time anomaly detection systems [30, 31] (Table 7).

In this table, the packet size range is divided into three fuzzy sets: Small, Medium, and Large. Each set is represented by a triangular membership function, for instance, a packet size of 800 bytes would have a higher membership value in the medium set compared to the small or large sets.

Table 7. Membership functions for packet size

Step 4. Constructing the Rule Base and Validating the Fuzzy System: It consists of a set of if-then rules that dictate the behavior of the FIS. These rules define the relationships between the input variables and the output [34].

The rule base design for FIS was carefully crafted to reflect the unique characteristics of the network traffic in the Moroccan agribusiness SME environment. It was established through expert validation, incorporating domain knowledge from network security professionals who identified common attack patterns and normal traffic behavior. To ensure robustness, sensitivity analysis was conducted, examining the impact of varying input parameters on the system's output (Anomaly Likelihood). This process enabled the fine-tuning of membership functions and rule thresholds to minimize false positives and negatives. The iterative optimization of these rules ensured a balance between computational efficiency and detection accuracy, making the system both practical and reliable for real-world anomaly detection applications.

• Rule 1: If PS is Small and CD is Short and PT is HTTP, then AL is Low.
• Rule 2: If PS is Large and CD is Long and PT is FTP, then AL is High.
• Rule 3: If PS is Medium and CD is Medium and PT is SSH, then AL is Medium.
• Rule 4: If PS is Large and PT is FTP, then AL is High.

These rules are encoded into the Xfuzzy environment, forming the decision-making framework of the FIS. This involves using Xfuzzy's graphical interface to input the rules and set the corresponding membership functions (Table 8).

Table 8. Rule base for anomaly detection

Table 9. Simulated FIS output vs. Actual outcomes