Explainable Adaptive Zero Trust Framework for AWS with Adversarial Robustness Evaluation

Explainable Adaptive Zero Trust Framework for AWS with Adversarial Robustness Evaluation Yagyaraj Pandey∗ , Om Singh∗ , Nandini Pathak∗ ∗ Department of Computer Science and Engineering,

arXiv:2608.21477v1 [cs.CR] 21 Aug 2026

Dr. A.P.J. Abdul Kalam Technical University, Lucknow, Uttar Pradesh, India Abstract—Cloud environments built on Amazon Web Services face a structural security vulnerability that most production deployments leave unaddressed: once a credential passes authentication, the session it initiates is treated as trusted for its entire duration. This assumption breaks down the moment those credentials are stolen. We introduce the Explainable Adaptive Zero Trust Framework (EAZTF), a cloud-native security layer that continuously re-evaluates the legitimacy of every API action throughout a session, not just at login. EAZTF advances the state of practice in three concrete ways. First, an adaptive trust scoring engine combining Isolation Forest and XGBoost evaluates eight CloudTrail and IAM-derived behavioral features in real time, producing a Trust Risk Score (TRS) that governs whether a session proceeds, faces step-up MFA, or is immediately restricted. Second, every TRS decision is accompanied by a SHAP or LIME explanation rendered as a human-readable audit record—allowing security teams to contest denials, refine thresholds, and satisfy regulatory audit requirements. Third, and most distinctively, the framework is subjected to systematic adversarial testing across four deliberate evasion strategies (credential theft, behavioral mimicry, API rate evasion, and privilege escalation), a gap that NIST SP 800-207 itself acknowledges as unresolved in the published literature. Experiments on an 8,500-record synthetic CloudTrail dataset show that Isolation Forest achieves 94.4% precision and 91.2% recall (F1 = 0.928).All results are derived from this synthetic dataset and should be interpreted as indicative of framework behavior rather than as validated performance on production telemetry. Across all four adversarial scenarios the mean detection rate reaches 91.0%, with behavioral mimicry proving the hardest to catch at 83.9%—a finding that directly motivates the architectural mitigations proposed in Section VII. SHAP attribution identifies IP geolocation reputation, login-time deviation, and API call velocity as the three features carrying the greatest decision weight, together accounting for roughly 64% of cumulative TRS variance. A structured NIST SP 800-207 compliance audit yields a mean score of 93% across all seven tenets, versus 38% for a perimeter-based baseline.Mean time to detect drops from 43 hours under traditional rule-based SIEM to under 0.8 minutes under EAZTF (with credential-theft-specific MTTD separately measured at 72 hours under the baseline; see Section VII-D). Index Terms—Zero Trust Architecture, AWS Security, Explainable AI, SHAP, LIME, Isolation Forest, XGBoost, Behavioral Anomaly Detection, CloudTrail, IAM Security, NIST SP 800-207, Adversarial Robustness

I. I NTRODUCTION An AWS access key used at 3 AM from an unfamiliar IP address to enumerate S3 buckets is, by every measure a

conventional SIEM can see, a valid authenticated session. It has a legitimate user ID. It passes signature verification. It lands inside the organization’s own account. Under perimeter-based security thinking, that is enough—the session proceeds until something downstream raises an alarm, typically hours later, by which point the exfiltration may already be complete. This is not an edge case. IBM’s 2024 Cost of a Data Breach Report records the average incident cost at USD 4.88 million, the highest figure since the study began, with compromised credentials consistently cited as the most common initial attack vector [10]. AWS now holds over 33% of the global cloud services market [11], meaning that a large fraction of enterprise credential misuse occurs on infrastructure where behavioral context is, in principle, fully observable via CloudTrail—but rarely exploited for continuous session evaluation. The NIST Zero Trust Architecture standard (SP 800-207) [1] proposes the right structural answer: eliminate implicit trust at every layer and treat each access request on its own merits. In practice, however, implementations of this principle encounter three problems that the standard itself does not resolve. First, when a ZTA engine denies access, it almost never explains why, leaving security administrators with binary outcomes and no basis for audit or appeal. Second, most trust scoring mechanisms rely on fixed thresholds applied to static feature sets, making them systematically vulnerable to an attacker who studies normal behavior before attempting replication. Third, no published ZTA implementation provides empirical evidence of how it performs when a skilled adversary deliberately attempts evasion. NIST SP 800-207 [1, Appendix B.4.5] identifies attacker adaptation to behavioral analytics as an area requiring further research. EAZTF is designed to address all three problems within a single AWS-native architecture. Rather than treating Zero Trust as a policy statement, we treat it as an engineering problem with measurable outputs: a precision-recall tradeoff on a behavioral anomaly detector, a SHAP attribution vector per access decision, and a detection rate curve across four adversarial evasion strategies. The contributions are: • An explicit mapping of NIST SP 800-207 logical components (PE, PA, PEP) to deployable AWS services, producing an operational blueprint rather than an architectural diagram.

A hybrid unsupervised/supervised ML trust scoring engine (Isolation Forest + XGBoost) trained on CloudTrail behavioral features, with empirical performance metrics on a held-out test set. • A dual-method explainability layer (SHAP for tree models, LIME for the Isolation Forest) providing per-decision justification and cross-method agreement analysis. • To the best of our knowledge, one of the first published adversarial robustness evaluations of a ZTA system, covering four attack categories and reporting both detection rates and bypass rates with direct analysis of why each evasion strategy succeeds or fails. Section II reviews the relevant literature and situates these contributions. Section III presents the EAZTF architecture. Sections IV–VI cover the dataset, ML engine, and explainability layer. Section VII reports the adversarial evaluation. Sections VIII and IX discuss consolidated results and NIST compliance. Section X concludes with limitations and future directions.

TABLE I G AP A NALYSIS ACROSS R ELATED L ITERATURE

•

II. R ELATED W ORK A. The Structural Response to Perimeter Collapse

Work

AWS

ML

XAI

Adv.

Emp.

NIST SP 800207 [1] Syed et al. [2] Mensah [3] Shepherd [4] Fernandez & Brazhuk [5] EAZTF (this work)

×

×

×

Gap

×

× × Azure ×

Rec. Disc. × ×

× × × Cited

× × × ×

× × Case ×

✓

IF+XGB

SHAP+LIME 4 scen.

Full

Rec. = recommended only; Disc. = discussed; Adv. = adversarial evaluation; Emp. = empirical results.

and Brazhuk [5] provide a critical analysis of ZTA that identifies the opacity of trust decisions as a fundamental operational weakness—a critique that directly motivates EAZTF’s explainability layer. They do not, however, propose a technical solution. Recent adjacent work has explored Zero Trust in 5G and 6G edge computing [16], [17] and in military UAV networks [18], confirming the paradigm’s breadth of applicability. None of these works provide SHAP-level decision attribution or adversarial robustness data.

Enterprise security has historically been organized around a defensible outer boundary where authenticated insiders received implicit trust. Over the past decade, cloud adoption, remote work, and third-party integrations have progressively dissolved D. Gap Summary that boundary. Rose et al. [1] formalized the industry’s response Three gaps persist across the literature. First, no published through NIST SP 800-207, articulating seven foundational work delivers an AWS-native ZTA implementation with empirZero Trust tenets and introducing the Policy Engine / Pol- ical performance metrics on behavioral anomaly detection. Secicy Administrator / Policy Enforcement Point (PE/PA/PEP) ond, despite widespread recognition that opaque access denials logical architecture. Notably, the standard is candid about impede operational adoption, SHAP or LIME integration into what it does not resolve: it identifies attacker adaptation to ZTA trust scoring appears nowhere in the existing corpus. Third, ZTA—specifically behavioral mimicry—as an open research deliberate adversarial evasion testing—credential mimicry, rate question requiring dedicated investigation. evasion, privilege escalation—is absent from every reviewed implementation. Table I maps these gaps against key related B. Survey-Level Findings and Their Limits works. Syed et al. [2] catalogued over 200 ZTA publications III. EAZTF S YSTEM A RCHITECTURE and found that machine learning-based behavioral analytics represent the most promising direction for adaptive trust scoring, EAZTF is organized as an eight-layer security architecture in while noting that empirical implementations with quantified which each layer corresponds to a specific AWS native service performance metrics remain scarce. Mensah [3] extended or analytical capability. The design principle is behavioral this survey through the lens of AI integration, post-quantum validation at depth: rather than concentrating security at cryptography, and 5G infrastructure, without presenting a the authentication checkpoint, EAZTF distributes verification concrete implemented system. Neither work moves beyond across the lifecycle of every API action, from initial IAM identifying what should be built. credential presentation through session termination. C. Implementation-Level Work and Its Gaps Shepherd [4] offers the most operationally detailed published framework, combining NIST SP 800-207 tenets with NIST SP 800-160v2 cyber-resiliency constructs and the CISA Zero Trust Maturity Model, validated against Microsoft Azure services. The Azure specificity is a meaningful constraint: AWS IAM structures, CloudTrail log schemas, Lambda invocation patterns, and GuardDuty threat feed integration differ substantially from their Azure equivalents, and an implementation designed for one platform does not transfer directly to the other. Fernandez

A. Mapping NIST ZTA Components to AWS Services A central contribution of EAZTF is translating NIST SP 800-207’s abstract logical architecture into a concrete AWS deployment blueprint. Table II presents this mapping. The Policy Engine is instantiated as an AWS Lambda function hosting the ML runtime; the Policy Administrator becomes the IAM + Lambda trigger combination that converts PE decisions into session-level access modifications; the Policy Enforcement Point is realized through CloudTrail event capture feeding CloudWatch Events.

TABLE II NIST ZTA C OMPONENT TO AWS S ERVICE M APPING NIST Component

AWS Service

Role in EAZTF

Policy Engine (PE) Policy Admin. (PA)

Lambda + ML Runtime IAM + Lambda Triggers CloudTrail + CloudWatch AWS GuardDuty

Evaluates behavioral features; computes real-time TRS Translates PE decisions into sessionlevel access changes

IAM Roles & Policies CloudTrail S3 + Athena GuardDuty + IP Feeds

Enforces least-privilege; manages device credential registry Persists audit trail; enables SHAP decision archiving Provides external context to TRS weight calculation

Policy Enf. (PEP) Continuous Diag. (CDM) Identity Mgmt Comprehensive Log Threat Intel

Captures API calls; triggers Lambda on anomaly Supplies real-time threat intelligence to PE

TABLE IV T UNED TRS F EATURE W EIGHTS (C ROSS -VALIDATED G RID S EARCH ) Feature IP Reputation Score Login Time Deviation API Call Velocity Device Credential Trust Consecutive Auth Failures Session Length Deviation Resource Sensitivity Tier Geographic Access Dev. P Sum ( wi )

Weight wi

Rank

0.22 0.18 0.17 0.14 0.12 0.08 0.05 0.04

1 2 3 4 5 6 7 8

1.00

—

by the Isolation Forest anomaly probability: TRS =

8 X

wi · fi + λ · sIF

(1)

i=1

TABLE III B EHAVIORAL F EATURE D EFINITIONS AND R ISK I NTERPRETATION Feature

Source

Type

IP Reputation Score Login Time Deviation API Call Velocity

GuardDuty + feeds

[0, 100] Score < 40: TOR nodes, known malicious ranges, unfamiliar country Binary Access outside the user’s 90-day time window Integer Velocity > 2σ above user baseline

Device Credential Trust Consec. Auth Failures Session Length Deviation Resource Sensitivity Tier Geographic Access Dev.

CloudTrail timestamp CloudTrail event count/hr IAM session metadata CloudTrail auth events IAM session duration IAM resource ARN Source IP geolocation

High-Risk Indication

[0, 100] Unregistered device ID or missing TPM attestation Integer

> 5 failures in a 10-minute window

Binary

Duration significantly exceeds user baseline

Ordinal Higher tiers (KMS, S3 PII, {0, 1, 2} billing) require higher TRS threshold Binary Access from a country absent from the user’s 90-day history

B. Behavioral Feature Engineering Eight behavioral signals are extracted per access event from CloudTrail log entries and IAM session metadata. Table III defines each feature, its source, data type, and the observable pattern that elevates risk. These features were selected on the basis of two criteria: availability in standard AWS CloudTrail output without additional instrumentation, and empirical linkage to known cloud compromise patterns in the AWS incident response literature [12]. C. Trust Risk Score Formulation The Trust Risk Score (TRS) is computed as a weighted linear combination of the eight normalized features, adjusted

where fi ∈ [0, 1] is the normalized value of feature i, wi is its empirically tuned weight, sIF ∈ [0, 1] is the Isolation Forest anomaly probability (obtained by calibrating the raw anomaly score against the training set), and λ is a scaling coefficient. All parameters were selected via five-fold cross-validated grid search on the training partition (80% of the dataset), spanning weight increments of 0.02 across the range 0.02–0.30 for each feature weight, and λ values from 0 to 0.2 in steps of 0.02, optimizing for validation-fold F1 subject to a false-positive-rate ceiling of 10%. Table IV reports the tuned weights. IP Reputation carries the largest weight (0.22) consistent with its SHAP dominance. The λ coefficient was set to 0.08, contributing a modest regularizing term that captures global anomaly structure not fully represented by the individual features. Three automated response thresholds govern downstream action: TRS < 50 allows the session to continue without interruption; 50 ≤ TRS < 80 triggers step-up multi-factor authentication; TRS ≥ 80 results in immediate session restriction and a GuardDuty alert dispatch. These thresholds were set empirically by maximizing the F1 score on the validation fold while targeting a false positive rate below 10% for the allow/restrict boundary. IV. DATASET C ONSTRUCTION AND E XPERIMENTAL M ETHODOLOGY A. Synthetic CloudTrail Dataset We constructed a synthetic behavioral dataset of 8,500 records modeling AWS CloudTrail activity across four IAM user roles: Administrator, Developer, Employee, and Viewer. Each record represents a single API access event characterized by the eight features defined in Table III. Record generation followed AWS CloudTrail log field specifications [12] and was informed by published enterprise cloud access pattern research. Three label classes were assigned based on TRS ranges. Table V presents the distribution.

TABLE V S YNTHETIC DATASET R ECORD D ISTRIBUTION Category

Label

Count

%

Normal Activity Marginal Activity Attack Simulation

Safe (0)

5,100

60.0%

Medium Risk (1)

2,125

25.0%

High Risk (2)

1,275

15.0%

—

8,500

100%

Total

6, and learning rate 0.1. SHAP TreeExplainer was applied post-hoc to the XGBoost model for both global and local attribution. LIME LocalExplainer was applied separately to Isolation Forest decisions on a 500-record random sample of high-risk predictions. All metrics reported in Sections V–VII are computed on the held-out 20% test set (n = 1,700 records) not used at any point during training or threshold selection. V. M ACHINE L EARNING T RUST S CORING E NGINE A. Model Selection Rationale

Isolation Forest [8] was chosen as the primary detection model for a reason grounded in operational reality: in producFour adversarial scenarios populate the High Risk records. tion cloud environments, labeled attack examples are scarce and Each reflects a realistic threat-actor methodology informed by often lag actual threat evolution by weeks or months. Isolation Forest is an unsupervised anomaly detector that requires no published AWS incident response case studies [13]: Credential Theft (n = 350). Valid IAM keys are used from labeled anomalies during training—it learns the structure of foreign IP addresses during off-hours to access sensitive S3 normal behavior and flags deviations, making it deployable buckets and EC2 resources outside the compromised identity’s in organizations that have only benign baseline data at hand. established behavioral envelope. This represents the most XGBoost [9] serves as a supervised benchmark that quantifies common cloud credential compromise pattern seen in practice. the performance premium available when labeled attack data Behavioral Mimicry (n = 280). The attacker observes exists. Three additional models—Random Forest, SVM, and the target user’s access patterns across a simulated 72-hour Logistic Regression—establish comparative baselines. The window before attempting replication of login timing, API Logistic Regression model uses the same eight features with call frequency, and resource access sequence. This scenario no non-linear transformation, providing a lower bound on the is designed deliberately to minimize TRS elevation; it is the performance achievable from these signals. most sophisticated evasion attempt in the test suite and the B. Model Performance on the Held-Out Test Set most direct test of EAZTF’s baselining mechanism. The attack Table VI presents full performance metrics. Isolation Forest maps to MITRE ATT&CK technique T1078 (Valid Accounts) achieves 94.4% precision and 91.2% recall (F1 = 0.928, AUCcombined with T1119 (Automated Collection) executed at ROC = 0.971) at an average inference latency of 180 ms throttled rates. per event—well within the operational budget of the Lambda API Rate Evasion (n = 325). Malicious enumeration and pipeline. The near-equivalence of Isolation Forest and XGBoost data access are deliberately throttled to maintain API velocity F1 scores (0.928 vs. 0.926) is the key empirical result validating within 80% of the user’s observed baseline, evading simple ratethe unsupervised deployment pathway: organizations without based detection while still achieving incremental exfiltration labeled attack data can achieve essentially the same detection over extended sessions. performance as organizations that have it. SVM’s substantially Privilege Escalation (n = 320). Employee or Developer lower recall (0.854) and the high inference latency (440 ms) role credentials are used to probe Administrator-level remake it poorly suited to the real-time pipeline requirements. sources—IAM policy modifications, AWS KMS key access, and billing dashboard queries—without possessing the requisite Logistic Regression’s AUC-ROC of 0.871 establishes that the permissions. Corresponds to MITRE ATT&CK technique eight features carry genuine discriminative signal even under a T1078.004 (Valid Accounts: Cloud Accounts) with T1548 linear model; the gap to Isolation Forest (0.971) quantifies the value of non-linear anomaly modeling. (Abuse Elevation Control Mechanism). B. Adversarial Attack Scenario Construction

C. Training and Evaluation Protocol

C. Trust Risk Score Distribution by Attack Type

All models were implemented using scikit-learn 1.4.0 and The TRS distributions expose where behavioral separation XGBoost 2.0 on Python 3.11. Dataset partitioning used an succeeds and where it struggles. Normal access events cluster 80/20 stratified train/test split preserving class proportions at a mean TRS of 22.3 (σ = 10.1), credential theft events across all three label categories. Five-fold cross-validation at 81.4 (σ = 7.2), and privilege escalation events at 79.1 was applied on the training partition during hyperparameter (σ = 8.3). The separation from the normal population is large search. Cross-validated performance varied by ±1.1 percentage for these two categories, which directly explains their high points across folds for the primary Isolation Forest model detection rates. Behavioral mimicry attacks cluster at a mean of (F1 range: 0.917–0.939), indicating stable convergence across 63.4 (σ = 8.9)—straddling the boundary between medium-risk partitions. The Isolation Forest contamination parameter was normal activity and the MFA trigger threshold. This overlap is set to 0.15, matching the High Risk proportion in the dataset. intentional by design: the mimicry attacker’s goal is precisely to XGBoost used 200 boosting rounds, maximum tree depth land in the medium-risk zone, where the TRS trigger requires

TABLE VI ML M ODEL P ERFORMANCE ON H ELD -O UT T EST S ET (n = 1,700) Model Isolation Forest† XGBoost‡ Random Forest SVM Logistic Regression

Prec.

Rec.

F1

AUC

ms

0.944±0.012 0.931±0.014 0.913 0.871 0.792

0.912±0.015 0.921±0.013 0.934 0.854 0.743

0.928±0.011 0.926±0.012 0.923 0.862 0.767

0.971 0.968 0.962 0.924 0.871

180 210 195 440 12

† Primary (unsupervised). ‡ Supervised benchmark. ms = mean inference

latency. Variance is reported only for the two primary models evaluated via five-fold cross-validation; comparator baselines (Random Forest, SVM, Logistic Regression) were evaluated on the same held-out test set but without fold-level variance tracking.

step-up MFA rather than session termination. Resolving this overlap is the central motivation for the architectural extensions proposed in Section VII.

TABLE VII SHAP I NSTANCE E XPLANATION — R EPRESENTATIVE H IGH -R ISK E VENT (TRS = 87.3, ACTION : RESTRICT) Feature

Value

SHAP Interpretation

IP Reputation Login Time Dev. API Call Velocity Device Cred. Trust Auth Failures Resource Sensitivity Geographic Dev. Session Length Dev.

12/100

+0.31

TOR exit node infrastructure

1 (anom) 847/hr

+0.27

02:47 UTC; baseline 08:30–18:00

+0.22

4.2× user baseline (201/hr)

34/100

+0.18

Device absent from IAM registry

7

+0.15

7 failures in preceding 10 min

High (2) 1 (anom) 0 (norm)

+0.10

KMS key access attempted

+0.09

Source country: Russia; baseline: India

−0.04 Within expected duration range

VI. E XPLAINABLE AI D ECISION L AYER A. Why Explainability Matters Operationally

differs from normal baselines. Together, these three features account for approximately 64% of cumulative SHAP variance.

A Zero Trust system that issues access denials without explanation creates a new kind of problem for security C. Instance-Level Decision Justification operations teams. When a developer’s legitimate deployment Beyond aggregate attribution, SHAP generates per-decision pipeline is blocked at 2 AM, the on-call engineer needs to know explanations that allow a security analyst to examine exactly which signal crossed a threshold—not a binary DENY code. why a specific session was flagged. Table VII presents the When a compliance officer audits a month’s worth of access complete SHAP breakdown for a representative high-risk event restrictions for GDPR or ISO 27001 purposes, they need a (TRS = 87.3, automated action: RESTRICT). Every feature machine-readable record attributing each decision to specific contributing to the decision—including the single modest feature values. When a security architect wants to tune the negative contribution from Session Length Deviation, which TRS thresholds for a new team with unusual working hours, was within normal range—is visible in the audit record. they need to understand the relative weight of each feature before touching the configuration. EAZTF addresses all three D. LIME Complementarity and Agreement Rate scenarios through a dual-method explainability layer. LIME LocalExplainer [7] was applied independently to B. SHAP Global Feature Attribution 500 randomly sampled high-risk Isolation Forest decisions—a SHAP TreeExplainer [6] was applied to the trained XGBoost population for which SHAP TreeExplainer is architecturally model across the full 8,500-record dataset, producing mean incompatible, since the Isolation Forest is not a tree-ensemble absolute SHAP values for each of the eight behavioral features. model in the SHAP sense. LIME constructs a locally linear These values measure the average magnitude of each feature’s surrogate model through feature perturbation, approximating contribution to TRS outcomes, averaged over the entire decision the decision boundary around each individual prediction. population, and are independent of direction (a feature can Across these 500 cases, LIME and SHAP agreed on the push TRS both up and down; the mean absolute value captures top-3 most influential features in 91.4% of instances. The 8.6% disagreement cases were concentrated in records where its overall influence). IP Reputation Score is the single most influential feature Device Credential Trust and API Call Velocity had nearly at mean |SHAP| = 0.31. This is expected: in the synthetic equal SHAP values, making their ordering sensitive to small simulation, virtually every credential theft event involves an IP perturbations—a finding that motivates more granular feature address outside established usage patterns, and the GuardDuty engineering for those two signals in future work. The 91.4% threat feed assigns low reputation scores to TOR exit nodes agreement rate provides strong evidence that the explainability and known malicious ranges. Login Time Deviation contributes layer is consistent across model architectures. 0.27, reflecting a property of legitimate enterprise users that is fairly consistent across roles—access patterns are strongly timestructured. API Call Velocity at 0.22 captures the automated enumeration activity present in both credential theft and API rate evasion, even when the attacker attempts to throttle below the single-feature threshold; the session-level trajectory still

VII. A DVERSARIAL ROBUSTNESS E VALUATION A. Threat Model and Adversary Assumptions The adversary is modeled as a black-box attacker possessing valid IAM credentials for a legitimate user account who can observe that behavioral anomaly detection is active, but cannot

TABLE VIII A DVERSARY C APABILITY M ATRIX Capability Valid IAM credentials Knows behavioral detection is active ML model weights / architecture Ability to modify CloudTrail logs 72-hr behavioral observation Unlimited auth attempts

Assumed

Rationale

Yes Yes

Core assumption Assumes modern ZTA

No No

Black-box model S3 Object Lock

Yes No

Persistent threat actor Lockout after 10 failures

TABLE IX A DVERSARIAL S IMULATION O UTCOMES BY ATTACK C ATEGORY Scenario

n

Det.

Det.%

Bypass%

Credential Theft Behavioral Mimicry API Rate Evasion Privilege Escalation

350

322

92.0%

8.0%

280

235

83.9%

16.1%

325

312

96.0%

4.0%

320

291

90.9%

9.1%

All Scenarios

1,275

1,160

91.0%

9.0%

access model weights, training data, or CloudTrail logs. This represents the realistic threat envelope for both insider threats and external actors operating with stolen credentials—the dominant cloud compromise scenario. Table VIII documents the full capability matrix. B. Detection Results by Attack Category Table IX presents detection and bypass rates across all four scenarios. The overall mean detection rate is 91.0% at a 9.0% bypass rate. API Rate Evasion achieves the highest detection rate (96.0%) despite being designed to stay below simple rate thresholds, because session-level velocity changes relative to the individual user’s baseline remain detectable even when absolute velocity is moderate. Privilege Escalation reaches 90.9% primarily because the Resource Sensitivity Tier feature reliably flags the jump from employee-level to administratorlevel resource access. Credential Theft’s 92.0% detection rate reflects the difficulty of fully masking the combination of foreign IP, off-hours access, and velocity elevation. Behavioral Mimicry at 83.9% is the primary remaining gap and is analyzed in detail below. C. Analysis of Behavioral Mimicry Bypass Events The 83.9% detection rate for mimicry warrants direct examination, because the 45 bypass events expose a specific structural weakness rather than a general modeling failure. All 45 occurred during the first seven days of a user’s behavioral baseline window, before enough event history had accumulated for reliable deviation scoring. The attacker used a VPN endpoint in the correct country, so Geographic Deviation and

IP Reputation scored normally. Login Time Deviation scored zero because the attacker had observed the target’s timing precisely over the 72-hour window. The only distinguishing signal—API Call Velocity—showed only marginal elevation because the attacker maintained 80% of the target’s average rate. In short, within the first week of a behavioral baseline, EAZTF cannot reliably distinguish a careful mimicry attacker from a legitimate user who happens to have slightly atypical activity during the onboarding period. Three targeted architectural responses address this gap: 1) Extended baselining window. Increasing the minimum baselining period from 7 to 21 days before full behavioral trust is established limits the window during which the bypass pattern is exploitable. New users or newly issued credentials would operate under a stricter asymmetric detection threshold during this period, requiring a lower TRS to trigger MFA. 2) Graph-based sequence analysis. The current feature set captures volume (velocity, session length) but not sequencing. Adding a graph layer that evaluates the order and co-occurrence patterns of resource access across IAM sessions—rather than aggregate counts—would expose the attacker’s inability to perfectly replicate the target’s resource access graph, even when timing and velocity match. 3) Credential issuance anomaly scoring. New API key pairs that have never been used before (zero historical baseline) could automatically receive elevated TRS requirements for their first 14 days, regardless of behavioral signals, reducing the value of freshly stolen credentials. These mitigations are estimated to reduce the mimicry bypass rate to below 8% based on retrospective analysis of the 45 bypass events; they are the primary target for the next development phase. D. Mean Time to Detect MTTD analysis makes the operational significance of realtime behavioral scoring concrete. Under the traditional rulebased SIEM baseline, credential theft required a mean of 72 hours to detect—reflecting manual alert triage pipelines and the absence of behavioral baselining. EAZTF’s automated Lambda evaluation pipeline achieves MTTD under 0.8 minutes for credential theft and under 1.2 minutes for the most evasive behavioral mimicry scenario. This three-to-four orderof-magnitude reduction directly constrains the scope of damage achievable before containment: a 72-hour credential theft window can drain an entire S3 bucket; a 1-minute window cannot. VIII. C ONSOLIDATED R ESULTS A. Overall Performance Summary Table X compares EAZTF against the traditional perimeter security baseline across all primary metrics. The 58.6 percentage-point improvement in mean threat detection rate is the headline figure, but the MTTD reduction (3,323× faster)

TABLE X C OMPREHENSIVE P ERFORMANCE S UMMARY — T RADITIONAL VS . EAZTF

TABLE XI EAZTF P IPELINE C OMPUTATIONAL OVERHEAD

Metric

Trad.

EAZTF

Change

Stage

Service

Lat.

Notes

Mean Detection Rate† False Positive (pre) False Positive (post) MTTD NIST Compliance Explainability

33.2%

91.8%

+58.6 pp

S3 notification delay

6.7%

−11.7 pp

1.2 s

18.4%

4.1%

−14.3 pp

CloudTrail + S3 Lambda (Python) Lambda + IF

≈8 s

18.4%

CloudTrail capture Feature extraction ML inference

Parsing 8 features from JSON Pre-loaded model container

2,592 min 38%

0.78 min 93%

3,323× +55 pp

None

Full audit

Lambda + SHAP Lambda + IAM

N/A

SHAP+ LIME 91.0%

SHAP explanation Risk decision + IAM Total

—

N/A

0.928

Quantified

Adversarial Robustness Model F1 (primary)

New capability

180 ms 220 ms 0.8 s ≈10.4 s

Per-decision, stored to S3 Session restriction via IAM API Within real-time operational req.

† Mean Detection Rate reflects overall classification performance across all

bypassing the S3 notification pathway; this optimization is projected to reduce total latency below 3 seconds.

label categories (Table V); see Table IX for detection rates specific to the four adversarial evasion scenarios (mean 91.0%).

IX. NIST SP 800-207 C OMPLIANCE A SSESSMENT

Table XII presents an author-conducted structured selfassessment mapping EAZTF against each of the seven NIST SP and the shift from zero explainability to full per-decision SHAP 800-207 tenets. Each tenet was scored on a 0–100 scale using attribution are operationally at least as significant. a rubric evaluating component coverage, automation level, and B. False Positive Root Cause Analysis auditability (see Appendix A); this is not an independent thirdThe pre-mitigation false positive rate of 6.7% is not party audit and should be read as a structured internal evaluation. uniform—three root causes account for roughly 90% of The mean EAZTF compliance score of 93% compares against cases. International travel by legitimate users contributes 38% for the traditional perimeter baseline—a 55 percentageapproximately 38% of false positives: geographic deviation point improvement that reflects the fundamental architectural and IP reputation features correctly flag foreign access, but difference between perimeter-centric and session-continuous authorized travel creates legitimately anomalous high-scoring security models. The highest individual score (T7, Information Logging, events. CI/CD pipeline activity contributes 31%: automated deployment processes generate API velocities far exceeding 96%) results from the combination of comprehensive Cloudindividual user baselines, which the behavioral model cannot Trail persistence and the SHAP decision archive, which easily distinguish from exfiltration at the default threshold. Ad- creates an auditable explanation record for every access ministrator after-hours maintenance rounds out approximately decision—something no prior ZTA implementation has pro21%. Three targeted mitigations address each: a self-service vided. The lowest score (T3, Per-Session Access Grants, 90%) travel notification system pre-authorizing known travel periods, reflects a residual implementation challenge: revoking active IAM service roles that apply distinct scoring parameters to in-flight API calls when TRS crosses the restriction threshold pipeline identities, and time-bounded maintenance windows requires IAM session invalidation, which carries a maximum that grant pre-approved trust elevation for declared periods. propagation delay of 30 seconds. A polling-based mechanism Applying these mitigations reduces the false positive rate to mitigates this gap but cannot close it entirely without changes to AWS’s session management architecture. 4.1%. C. Computational Overhead

X. C ONCLUSION AND F UTURE D IRECTIONS

Table XI documents the end-to-end latency of the EAZTF A. Summary of Contributions decision pipeline. The dominant term is the CloudTrail event EAZTF addresses three capabilities that are absent from the capture delay (≈8 seconds), a structural property of the S3 existing Zero Trust literature: an AWS-native implementation notification pathway. The ML inference step (180 ms) and with empirical behavioral anomaly detection metrics, perSHAP explanation generation (220 ms) contribute marginally. decision explainability through SHAP and LIME, and, to the Total end-to-end latency of approximately 10.4 seconds is best of our knowledge, one of the first published adversarial operationally acceptable for the credential theft, mimicry, robustness evaluations of a ZTA system covering four deliberate and privilege escalation scenarios evaluated—all of which evasion strategies. unfold over minutes to hours. Scenarios requiring sub-second The primary detection model (Isolation Forest) achieves automated response (e.g., rapid bulk-delete operations) would F1 = 0.928 with 94.4% precision—near-equivalent to the require a streaming architecture using Kinesis Data Streams supervised XGBoost benchmark (F1 = 0.926)—validating the

TABLE XII NIST SP 800-207 T ENET C OMPLIANCE D ETAIL NIST Tenet

Trad. EAZTF Implementation

T1: All sources as resources

45%

T2: All comms secured

40%

92%

T3: Per-session access T4: Dynamic policy

30%

90%

95%

Every AWS resource classified by sensitivity tier; IAM policies enforced accordingly CloudTrail traffic encrypted at rest and in transit; Lambda calls use TLS IAM temp credentials per session; revoked on TRS threshold breach ML trust scores update IAM permissions in real time via Lambda triggers CloudWatch + GuardDuty provide continuous device health monitoring Step-up MFA triggered dynamically by TRS; session-level re-auth enforced All events persisted via CloudTrail to S3; per-decision SHAP records archived

would be insufficient for scenarios requiring sub-second automated response. Addressing this requires a stream processing architecture that is outside the current implementation scope. C. Data and Code Availability Code and synthetic data generation scripts are not yet publicly released but are available from the author upon reasonable request. D. Future Research Directions

The most pressing next step is validation against realworld behavioral datasets. The CERT Insider Threat Dataset and CICIDS2017 provide established benchmarks that would T5: Asset integrity 42% 91% complement the synthetic evaluation and surface any distribution mismatches. Beyond this, four research directions follow T6: Dynamic 38% 94% directly from the current work’s findings: authentication Graph-based lateral movement detection. As discussed in Section VII, adding a layer that analyzes resource access 50% 96% T7: sequencing patterns across IAM sessions is the most direct Comprehensive logging architectural response to the mimicry bypass problem. Federated learning across AWS accounts. Collaborative Mean 40% 93% +53 pp across all seven tenets threat intelligence without centralizing sensitive CloudTrail data would enable cross-organizational behavioral models, unsupervised deployment pathway for organizations without particularly relevant for regulated industries where data cannot labeled attack telemetry. Mean threat detection improves by leave organizational boundaries. Post-quantum cryptographic integration. Current session 58.6 percentage points over the perimeter baseline, and mean time to detect drops from 43 hours to under one minute. token encryption using RSA and ECC faces a projected Adversarial evaluation returns a 91.0% mean detection rate vulnerability window within the next decade. Integrating postacross four scenarios, with behavioral mimicry identified as the quantum key encapsulation mechanisms for long-term session primary remaining evasion challenge at a 16.1% bypass rate. token protection is a forward-looking but tractable engineering The NIST SP 800-207 tenet compliance audit yields a mean task. Multi-cloud extension. Mapping EAZTF’s architecture to score of 93%, versus 38% for the traditional baseline. SHAP attribution confirms IP reputation, login-time deviation, and equivalent services on Microsoft Azure and Google Cloud PlatAPI call velocity as the three dominant trust-score determinants, form—where Entra ID, Activity Log, and Security Command together accounting for approximately 64% of cumulative Center play analogous roles—would enable unified behavioral ZTA across hybrid enterprise environments. decision variance. 35%

93%

B. Limitations Three limitations require clear acknowledgment. First and most importantly, the evaluation dataset is entirely synthetic. It was constructed to reflect real AWS CloudTrail behavioral patterns, but it was not derived from production cloud telemetry, and real-world behavioral distributions—particularly across unusual IAM roles, legacy services, and multi-account architectures—may differ in ways the synthetic generator does not capture. The performance numbers in this paper should be interpreted as indicative rather than validated until the framework is tested against production or established benchmark datasets (see Section X-D). Second, behavioral mimicry achieves a 16.1% bypass rate, which is an unresolved detection gap for persistent threat actors with sufficient time to observe their targets. The architectural mitigations proposed in Section VII are promising but have not yet been empirically tested. Third, the current pipeline latency of approximately 10.4 seconds is acceptable for the attack patterns evaluated but

ACKNOWLEDGMENTS The author acknowledges the research environment and infrastructure support provided by Bright Mentee Ventures, Lucknow, India. This work was conducted independently without external funding. All experimental data was synthetically generated; no proprietary or production AWS data was used at any stage. R EFERENCES [1] S. Rose, O. Borchert, S. Mitchell, and S. Connelly, “Zero Trust Architecture,” NIST Special Publication 800-207, National Institute of Standards and Technology, Aug. 2020. doi: 10.6028/NIST.SP.800-207. [2] N. F. Syed, S. W. Shah, A. Shaghaghi, A. Anwar, Z. Baig, and R. Doss, “Zero Trust Architecture (ZTA): A Comprehensive Survey,” IEEE Access, vol. 10, pp. 57143–57179, 2022. doi: 10.1109/ACCESS.2022.3174679. [3] F. Mensah, “Zero Trust Architecture: A Comprehensive Review of Principles, Implementation Strategies, and Future Directions in Enterprise Cybersecurity,” Int. J. Advance Research, Ideas and Innovations in Technology, vol. 10, no. 6, 2024. [4] C. Shepherd, “Zero Trust Architecture: Framework and Case Study,” Graduate Projects and Theses, Cyber Operations and Resilience Program, Boise State University, 2022.

[5] E. B. Fernandez and A. Brazhuk, “A Critical Analysis of Zero Trust Architecture (ZTA),” Computer Standards & Interfaces, vol. 89, p. 103832, 2024. [6] S. M. Lundberg and S.-I. Lee, “A Unified Approach to Interpreting Model Predictions,” in Advances in Neural Information Processing Systems, vol. 30, pp. 4765–4774, 2017. [7] M. T. Ribeiro, S. Singh, and C. Guestrin, “ ‘Why Should I Trust You?’: Explaining the Predictions of Any Classifier,” in Proc. 22nd ACM SIGKDD Int. Conf. Knowledge Discovery and Data Mining, pp. 1135– 1144, 2016. [8] F. T. Liu, K. M. Ting, and Z.-H. Zhou, “Isolation Forest,” in Proc. 8th IEEE Int. Conf. Data Mining (ICDM), pp. 413–422, 2008. doi: 10.1109/ICDM.2008.17. [9] T. Chen and C. Guestrin, “XGBoost: A Scalable Tree Boosting System,” in Proc. 22nd ACM SIGKDD Int. Conf. Knowledge Discovery and Data Mining, pp. 785–794, 2016. [10] IBM Security, “Cost of a Data Breach Report 2024,” IBM Corporation, 2024. [Online]. Available: https://www.ibm.com/reports/data-breach. [11] Statista, “Cloud infrastructure services market share worldwide Q1 2024,” 2024. [Online]. Available: https://www.statista.com. [12] Amazon Web Services, “AWS CloudTrail Developer Guide,” AWS Documentation, 2024. [Online]. Available: https://docs.aws.amazon.com/ awscloudtrail/latest/userguide/. [13] Amazon Web Services, “AWS IAM User Guide: Security Best Practices,” AWS Documentation, 2024. [Online]. Available: https://docs.aws.amazon. com/IAM/latest/UserGuide/. [14] CISA, “Zero Trust Maturity Model, Version 2.0,” Cybersecurity and Infrastructure Security Agency, Apr. 2023. [Online]. Available: https: //www.cisa.gov/zero-trust-maturity-model.

[15] R. S. Ross et al., “Developing Cyber Resilient Systems: A Systems Security Engineering Approach,” NIST SP 800-160, Vol. 2, 2019. doi: 10.6028/NIST.SP.800-160v2. [16] H. Sedjelmaci and N. Ansari, “Zero Trust Architecture Empowered Attack Detection Framework to Secure 6G Edge Computing,” IEEE Network, vol. 38, no. 1, pp. 196–202, Jan./Feb. 2024. [17] M. Lyu and J. Farooq, “Zero Trust in 5G Networks: Principles, Challenges, and Opportunities,” in Proc. 2024 Resilience Week (RWS), pp. 1–8, 2024. [18] G. Alquwayzani and A. Albuali, “A Systematic Literature Review of Zero Trust Architecture for Military UAV Security Systems,” IEEE Access, vol. 12, pp. 176033–176056, 2024. [19] G. Kornaros et al., “From Cloud to IoT Device Authenticity under Kubernetes Management,” in Proc. 11th Int. Conf. Internet of Things: Systems, Management and Security, pp. 218–223, 2024. [20] S. Teerakanok, T. Uehara, and A. Inomata, “Migrating to Zero Trust Architecture: Reviews and Challenges,” Security and Communication Networks, 2021. doi: 10.1155/2021/9947347.

A PPENDIX Each tenet in Table XII was scored on a 0–100 scale according to the following bands: • 90–100: Fully automated, continuously enforced, and logged in real time. • 70–89: Automated with manual fallback or periodic (non-real-time) enforcement. • 50–69: Partial implementation; enforcement requires manual intervention. • Below 50: Policy exists but is not technically enforced.

Related documents

• Tanyuan: A Three-Tier Hardware-Enforced Mission Integrity Architecture for Autonomous AI Systems#689962
• Verification of Adaptive Agentic Controllers through Finite Rule Revision#999268
• TADP-RME: A Trust-Adaptive Differential Privacy Framework for Enhancing Reliability of Data-Driven Systems#2448
• ECO/CPO-DAG: A Contradiction-Based Accountability Layer for Adversarial Supply Chains#349607
• Calibrated Trust, Not Sharper Prediction: An Empirical Test of Uncertainty Fusion#609055