Explainable Adaptive Zero Trust Framework for AWS with Adversarial Robustness Evaluation

Cloud environments, particularly those utilizing Amazon Web Services, face a significant security vulnerability where authenticated credentials are implicitly trusted for their session duration, even if compromised. A new solution, the Explainable Adaptive Zero Trust Framework (EAZTF), addresses this by continuously re-evaluating the legitimacy of API actions during a session, providing real-time risk assessment and adaptive access control.

Why it matters

This development is strategically important as it introduces a proactive, adaptive approach to cloud security, mitigating the risk posed by compromised credentials. By continuously verifying trust and providing explainable decisions, it enhances organizational resilience against evolving cyber threats and strengthens the overall security posture in cloud environments.

Key insights

• Traditional cloud security models on AWS treat authenticated sessions as implicitly trusted, creating a vulnerability if credentials are stolen.
• The Explainable Adaptive Zero Trust Framework (EAZTF) is a cloud-native security layer designed to continuously re-evaluate API action legitimacy throughout a session.
• EAZTF utilizes a combination of Isolation Forest and XGBoost machine learning models to analyze eight behavioral features derived from CloudTrail and IAM data.
• The framework generates a Trust Risk Score (TRS) in real-time to determine if a session should continue, require step-up Multi-Factor Authentication (MFA), or be restricted.
• Each decision made by EAZTF is accompanied by an explanation using SHAP or LIME, enhancing transparency and understanding of risk assessments.

Source

arXiv — Computers and Society — https://arxiv.org/abs/2608.21477