Validation of a Fuzzy Model for Categorizing Critical Digital Objects

Abstract

The Digital Code of the Republic of Kazakhstan places the approval of rules and criteria for designating critical digital objects with the authorized cybersecurity body, but no formalized procedure yet exists for assigning a criticality category to an individual object. This paper reports a validation study of a three-level Mamdani fuzzy inference model proposed for that purpose. The model derives a criticality score from an object passport of eighteen indicators, evaluates confidentiality, integrity and availability breach scenarios separately, and assigns the category from the worst of the three. We implemented the model in Python and checked it against the reference example supplied with the methodology, reproducing the stated score of 49.3 to within rounding. Four computational tests were then run on a uniform sample of 30,000 synthetic passports, covering closure, monotonicity under single-step degradation of indicators, non-compensatory behaviour relative to a weighted additive convolution, and threshold sensitivity. Inference was defined everywhere on the sample and scores stayed within 16.12 to 83.51. Among 28,114 degradation steps, 4.68 % lowered the score, the median drop being 0.48 points, yet not one step changed the assigned category. Correlation with the additive convolution was 0.408, and two objects that shared an additive score of 37.4 differed by 67.4 points under fuzzy inference. The output proved to take only 33 distinct values with a 22-point gap between 55.97 and 77.96, which leaves the declared borderline zone of 65 to 70 points unreachable. The model is structurally sound but its output terms need recalibration, and three specific measures are proposed.