AI-Driven Cyber Risk Scoring for Multi-Tier Supply Chain Networks Using Federated Threat Intelligence and Anomaly Detection

Abstract

The multi-tier risk is an inherent aspect of the cyber threat since compromise could be spread out through direct suppliers, deep-tier vendors, logistics partners, software suppliers and managed service providers. Currently, the scoring of cyber-risks is fragmented and based on CVSS-levels (which does not take business dependency paths into account), centralized analytics often have problems with data-sharing and many anomaly-detectors only give local alerts. The paper proposes an AI-based intelligent decision support system FTI-ADS, combining federated threat intelligence and local anomaly detection, trust-weighted graph aggregation and explainable mitigation ranking, to dynamically score the cyber-risk in multi-tiered supply chain networks.The framework models supply chain as a directed dependency graph, learns a privacy-preserving local model from partner telemetry, performs trust-aware federated optimization of updates, and derives node-level and network-level cyber-risk scores from the collected anomaly evidence, the severity of the exploits, exposure, asset criticality, and the propagated upstream/downstream risk. In synthetic four-tier benchmark with 240 nodes, 30 federated participants and five cyberattack scenarios, the proposed method obtained an accuracy of 0.918, F1-score of 0.875, AUC of 0.974, false-positive rate of 0.063 and RMSE of 0.050, outperforming centralized anomaly detection, which obtained an accuracy of 0.568, rule-based scoring with an accuracy of 0.825, CVSS-based scoring with an accuracy of 0.844 and traditional vendor assessment with an accuracy of 0.807. The paper's contribution is an integrated, mathematically based, privacy-preserving and operationally explainable cyber-risk scoring and mitigation prioritization framework for multi-organizational supply ecosystems.