Explainable Adaptive Zero Trust Framework for AWS with Adversarial Robustness Evaluation

Technical Summary: Explainable Adaptive Zero Trust Framework for AWS with Adversarial Robustness Evaluation

Problem Statement
Current production deployments on Amazon Web Services (AWS) suffer from a critical structural vulnerability: once a credential passes authentication, the resulting session is implicitly trusted for its entire duration. This perimeter-based assumption fails immediately upon credential theft, often allowing attackers hours to exfiltrate data before traditional rule-based Security Information and Event Management (SIEM) systems raise alarms. While the NIST Zero Trust Architecture (ZTA) standard (SP 800-207) proposes eliminating implicit trust, existing implementations face three unresolved gaps: (1) access denials lack explainability, hindering audit and appeal; (2) trust scoring mechanisms rely on static thresholds vulnerable to behavioral mimicry; and (3) there is a lack of empirical evidence regarding how ZTA systems perform against deliberate adversarial evasion strategies.

Methodology and Architecture
The authors propose the Explainable Adaptive Zero Trust Framework (EAZTF), an AWS-native security layer that continuously re-evaluates the legitimacy of every API action throughout a session. The architecture maps NIST SP 800-207 logical components to specific AWS services:

• Policy Engine (PE): Implemented as an AWS Lambda function hosting a hybrid Machine Learning (ML) runtime.
• Policy Administrator (PA): An IAM and Lambda trigger combination that translates PE decisions into session-level access modifications (e.g., step-up MFA, restriction).
• Policy Enforcement Point (PEP): Realized through CloudTrail event capture feeding CloudWatch Events.

Core Components:

1. Behavioral Feature Engineering: The system extracts eight behavioral signals from CloudTrail logs and IAM metadata, including IP reputation, login time deviation, API call velocity, device credential trust, consecutive authentication failures, session length deviation, resource sensitivity tier, and geographic access deviation.
2. Hybrid Trust Scoring Engine:
   • Isolation Forest: An unsupervised anomaly detector used as the primary model to learn normal behavior structures without requiring labeled attack data.
   • XGBoost: A supervised benchmark used to quantify performance gains when labeled data is available.
   • Trust Risk Score (TRS): A weighted linear combination of normalized features adjusted by the Isolation Forest anomaly probability. Thresholds trigger automated responses: TRS < 50 (allow), 50 ≤ TRS < 80 (step-up MFA), and TRS ≥ 80 (restrict session).
3. Explainability Layer: To address the "black box" nature of ML decisions, the framework employs SHAP (for tree-based XGBoost) and LIME (for Isolation Forest) to generate human-readable audit records for every decision, detailing which features drove the risk score.

Experimental Setup
The framework was evaluated on a synthetic dataset of 8,500 records modeling AWS CloudTrail activity across four IAM roles. The dataset included Normal Activity (60%), Marginal Activity (25%), and Attack Simulations (15%). The attack simulations covered four adversarial scenarios:

• Credential Theft: Using valid keys from foreign IPs during off-hours.
• Behavioral Mimicry: Replicating target user patterns (timing, frequency) after a 72-hour observation window.
• API Rate Evasion: Throttling malicious enumeration to stay within 80% of baseline velocity.
• Privilege Escalation: Using lower-privilege credentials to access administrator-level resources.

Key Results

• Detection Performance: The Isolation Forest model achieved 94.4% precision and 91.2% recall (F1 = 0.928), performing nearly identically to the supervised XGBoost benchmark (F1 = 0.926). This validates the viability of unsupervised learning for organizations lacking labeled attack telemetry.
• Adversarial Robustness: Across the four adversarial scenarios, the mean detection rate was 91.0%.
  • API Rate Evasion was the easiest to detect (96.0%).
  • Credential Theft was detected at 92.0%.
  • Privilege Escalation was detected at 90.9%.
  • Behavioral Mimicry proved the most challenging, with a detection rate of 83.9% (16.1% bypass rate). Analysis revealed that mimicry attacks succeeded primarily during the first week of a user's behavioral baseline, where insufficient history existed to establish a reliable deviation score.
• Operational Efficiency: The Mean Time to Detect (MTTD) dropped from 43 hours under traditional rule-based SIEM to under 0.8 minutes under EAZTF. Notably, the credential-theft-specific MTTD under the baseline was measured separately at 72 hours.
• Explainability: SHAP attribution identified IP reputation, login time deviation, and API call velocity as the top three decision drivers, accounting for ~64% of TRS variance. The SHAP and LIME methods agreed on the top-3 influential features in 91.4% of high-risk instances.
• Compliance: A structured NIST SP 800-207 compliance audit yielded a mean score of 93% across all seven tenets for EAZTF, compared to 38% for a traditional perimeter-based baseline.

Significance and Claims
The paper claims to provide one of the first published adversarial robustness evaluations of a ZTA system, explicitly addressing the gap in NIST SP 800-207 regarding attacker adaptation. Its primary contributions are:

1. Operational Blueprint: A concrete mapping of abstract NIST ZTA components to deployable AWS services, moving beyond theoretical diagrams.
2. Unsupervised Viability: Empirical evidence that unsupervised models (Isolation Forest) can achieve detection performance comparable to supervised models in cloud environments, crucial for organizations without labeled attack data.
3. Explainability Integration: The integration of SHAP and LIME to provide per-decision justifications, enabling security teams to contest denials and satisfy regulatory audit requirements.
4. Adversarial Evaluation: A systematic testing of four evasion strategies, identifying behavioral mimicry as a specific structural weakness that requires architectural mitigations (e.g., extended baselining windows, graph-based sequence analysis).

Limitations and Future Work
The authors explicitly note that the evaluation relies on a synthetic dataset and does not yet reflect production telemetry distributions. They acknowledge that the 16.1% bypass rate for behavioral mimicry remains an unresolved challenge for persistent threat actors. Future directions proposed include validating the framework against real-world datasets (e.g., CERT Insider Threat, CICIDS2017), implementing graph-based lateral movement detection to address mimicry, exploring federated learning for cross-organizational threat intelligence, and extending the architecture to multi-cloud environments.