Explainable Adaptive Zero Trust Framework for AWS with Adversarial Robustness Evaluation

Om Singh; Yagyaraj Pandey; Nandini Pathak

Source-linked AI summary

Explainable Adaptive Zero Trust Framework for AWS with Adversarial Robustness Evaluation

Om Singh, Yagyaraj Pandey, Nandini Pathak

arXiv:2608.21477v1Aug 21, 2026cs.CRcs.CYcs.LGcs.NI

TL;DR

AWS sessions authenticated with stolen credentials can retain implicit trust, motivating EAZTF’s continuous behavioral reevaluation of API actions. The framework combines AWS-native Zero Trust architecture, hybrid machine learning, and per-decision explanations, then evaluates adversarial evasion. It reports strong synthetic-data results, including 91.0% mean adversarial detection and a 93% NIST self-assessment score, while cautioning that production validity remains unestablished.

Problem
Authenticated AWS sessions may retain implicit trust after credential compromise, while reviewed Zero Trust implementations lack combined AWS-native behavioral detection, explainability, and adversarial evaluation.
Method
EAZTF continuously validates API behavior through an eight-layer AWS-native architecture using Isolation Forest and XGBoost, Trust Risk Scores, and SHAP or LIME explanations.
Results
91.0% mean detection rate across four adversarial scenarios accompanies 93% mean NIST SP 800-207 compliance, compared with 38% for the traditional baseline.
Takeaways & Limitations
EAZTF provides an unsupervised deployment pathway with explainable, continuously evaluated access decisions and adversarial robustness measurements.
Takeaways & Limitations
The evaluation dataset is entirely synthetic, so reported performance is indicative rather than validated until testing uses production or established benchmark datasets.

Abstract

from arXiv · show

Cloud environments built on Amazon Web Services face a structural security vulnerability: once a credential passes authentication, the resulting session is often treated as trusted for its entire duration. This assumption fails when credentials are stolen. We introduce the Explainable Adaptive Zero Trust Framework (EAZTF), a cloud-native security layer that continuously reevaluates the legitimacy of API actions throughout a session. EAZTF combines Isolation Forest and XGBoost to evaluate eight CloudTrail and IAM-derived behavioral features in real time and produce a Trust Risk Score (TRS) that determines whether a session continues, requires step-up MFA, or is restricted. Each decision is accompanied by a SHAP or LIME explanation, providing human-readable audit records for security analysis and compliance. The framework is also evaluated against four adversarial evasion strategies: credential theft, behavioral mimicry, API rate evasion, and privilege escalation. Experiments on an 8,500-record synthetic CloudTrail dataset show that Isolation Forest achieves 94.4% precision, 91.2% recall, and an F1 score of 0.928. Across the four adversarial scenarios, the mean detection rate is 91.0%, with behavioral mimicry being the most difficult at 83.9%. SHAP analysis identifies IP reputation, login-time deviation, and API call velocity as the three dominant features. A structured NIST SP 800-207 self-assessment gives EAZTF a mean compliance score of 93%, compared with 38% for a traditional perimeter baseline. Mean time to detect decreases from hours to under one minute. Because the evaluation uses synthetic data, these results should be interpreted as indicative rather than validated production performance.

I. INTRODUCTION

EAZTF addresses the problem of authenticated AWS sessions receiving implicit trust by continuously evaluating behavioral legitimacy, explaining decisions, and testing adversarial robustness. Its design combines AWS-native Zero Trust components with machine-learning anomaly detection and per-decision explanations.

Motivation: Compromised credentials can produce valid authenticated sessions that perimeter-based security may allow to continue until downstream alarms occur hours later.The paper frames continuous session evaluation as necessary because exfiltration may already be complete before detection.
Framework Response: EAZTF treats Zero Trust as an engineering problem with measurable anomaly-detection, explainability, and adversarial-evaluation outputs.The framework evaluates precision-recall tradeoffs, generates SHAP attribution vectors, and reports detection curves across four evasion strategies.
Contributions: The framework maps NIST SP 800-207 logical components to deployable AWS services, producing an operational blueprint rather than only an architectural diagram.The contribution explicitly connects the Policy Engine, Policy Administrator, and Policy Enforcement Point to AWS-native deployment elements.
Contributions: A hybrid Isolation Forest and XGBoost engine uses CloudTrail behavioral features and reports empirical performance on a held-out test set.Isolation Forest supports anomaly detection when labeled attack examples are limited, while XGBoost provides a supervised benchmark.
Contributions: A dual-method explainability layer uses SHAP for tree models and LIME for Isolation Forest to provide per-decision justification and cross-method agreement analysis.This addresses the paper’s stated concern that access denials often lack explanations suitable for audit or appeal.
Contributions: The paper evaluates adversarial robustness across four attack categories, reporting detection and bypass rates alongside analyses of evasion success and failure.The evaluation is presented as one of the first published adversarial robustness assessments of a Zero Trust Architecture system.

B. Survey-Level Findings and Their Limits

The literature identifies behavioral analytics as a promising direction for adaptive Zero Trust but lacks implemented, empirically evaluated systems that combine AWS specificity, explainability, and adversarial testing. EAZTF is positioned as an AWS-native architecture that distributes behavioral verification across API-action lifecycles.

Survey-Level Findings: Surveys identify machine-learning behavioral analytics as promising for adaptive trust scoring, but empirical implementations with quantified performance metrics remain scarce.Related work discusses what should be built without presenting a concrete implemented system.
Implementation-Level Limits: Azure-validated Zero Trust frameworks do not transfer directly to AWS because IAM structures, CloudTrail schemas, Lambda patterns, and GuardDuty integration differ substantially.The paper treats platform specificity as a meaningful implementation constraint.
Implementation-Level Limits: Prior critical analysis identifies opaque trust decisions as an operational weakness, while adjacent 5G, 6G, and UAV work does not provide SHAP-level attribution or adversarial robustness data.The cited work motivates explainability but does not propose a technical solution.
Gap Summary: The reviewed literature lacks an AWS-native behavioral anomaly-detection implementation with empirical metrics, SHAP or LIME integration, and deliberate adversarial evasion testing.The gap summary specifically names credential mimicry, rate evasion, and privilege escalation as absent from reviewed implementations.
EAZTF Positioning: EAZTF distributes behavioral validation across every API action from credential presentation through session termination instead of concentrating security at authentication.The architecture is organized as eight layers corresponding to AWS services or analytical capabilities.

A. Mapping NIST ZTA Components to AWS Services

EAZTF translates NIST Zero Trust logical components into AWS services and computes a Trust Risk Score from normalized behavioral features plus Isolation Forest anomaly probability. Tuned weights and response thresholds convert those assessments into adaptive session actions.

NIST-to-AWS Mapping: The Policy Engine is implemented with AWS Lambda, the Policy Administrator with IAM and Lambda triggers, and the Policy Enforcement Point with CloudTrail capture feeding CloudWatch Events.This mapping turns the NIST logical architecture into a concrete AWS deployment blueprint.
Behavioral Features: Eight behavioral signals are extracted from CloudTrail log entries and IAM session metadata using features available in standard CloudTrail output.Feature selection also reflects empirical links to known cloud compromise patterns.
Trust Risk Score Formulation: The Trust Risk Score is a weighted linear combination of eight normalized features adjusted by calibrated Isolation Forest anomaly probability.Each feature has a tuned weight, while λ scales the anomaly-probability contribution.
Trust Risk Score Formulation: Five-fold cross-validated grid search on the 80% training partition tunes feature weights and λ for validation-fold F1 under a false-positive-rate ceiling of 10%.Feature-weight increments span 0.02–0.30, and λ values span 0–0.2 in 0.02 steps.
Trust Risk Score Formulation: IP Reputation receives the largest tuned weight at 0.22, while λ is set to 0.08 to capture global anomaly structure not fully represented by individual features.The paper reports this weighting as consistent with IP Reputation’s SHAP dominance.
Adaptive Response: TRS thresholds allow sessions below 50, trigger step-up MFA from 50 to below 80, and restrict sessions at 80 or higher with a GuardDuty alert.The thresholds were selected empirically to maximize validation F1 while targeting a false-positive rate below 10% for the allow/restrict boundary.

IV. DATASET CONSTRUCTION AND EXPERIMENTAL METHODOLOGY

The study uses a synthetic CloudTrail dataset and evaluates EAZTF against four adversarial scenarios using stratified held-out testing and cross-validation.

Dataset: 8,500 synthetic AWS CloudTrail records represent Administrator, Developer, Employee, and Viewer IAM roles using eight behavioral features.Records model individual API access events and receive labels based on TRS ranges.
Adversarial scenarios: Four scenarios model credential theft, behavioral mimicry, API rate evasion, and privilege escalation as high-risk activity.Behavioral mimicry observes 72 hours of target behavior, while rate evasion limits API velocity to within 80% of baseline.
Evaluation protocol: 80/20 stratified train/test partitioning preserves proportions across three label categories, with five-fold cross-validation during hyperparameter search.The held-out test set contains 1,700 records excluded from training and threshold selection.
Evaluation protocol: Cross-validated Isolation Forest F1 varies by ±1.1 percentage points across folds, ranging from 0.917 to 0.939.The reported variation indicates stable convergence across training partitions.

V. MACHINE LEARNING TRUST SCORING ENGINE

The trust scoring engine prioritizes Isolation Forest for settings with scarce labeled attacks and compares it with supervised and conventional baselines on held-out data.

Model selection: Isolation Forest requires no labeled anomalies, learning normal behavior to flag deviations, while XGBoost measures the performance available with labeled attack data.Random Forest, SVM, and Logistic Regression provide comparative baselines using the same behavioral signals.
Held-out test performance: 94.4% precision, 91.2% recall, and F1 = 0.928 are achieved by Isolation Forest, with AUC-ROC = 0.971 and 180 ms average inference latency.Metrics are reported on the held-out test set.
Held-out test performance: Isolation Forest and XGBoost obtain near-equivalent F1 scores of 0.928 and 0.926, respectively.The comparison supports an unsupervised deployment pathway when labeled attack data is unavailable.
Trust Risk Score distributions: Normal events average TRS 22.3, compared with 81.4 for credential theft and 79.1 for privilege escalation.Behavioral mimicry averages 63.4 and straddles the medium-risk boundary, where step-up MFA is triggered rather than session termination.

VI. EXPLAINABLE AI DECISION LAYER

The explainability layer combines global and local attribution to identify influential behavioral signals and expose the feature contributions behind individual access decisions.

Local explanations: Per-decision explanations provide analysts with feature-level reasons for flagged sessions rather than only binary access outcomes.The records support audit and investigation of why a specific session was restricted.
Global attribution: SHAP TreeExplainer measures average absolute feature contributions to XGBoost TRS outcomes across all 8,500 records.Mean absolute SHAP values capture overall influence regardless of whether a feature raises or lowers TRS.
Global attribution: IP Reputation Score contributes mean |SHAP| = 0.31, Login Time Deviation contributes 0.27, and API Call Velocity contributes 0.22.These three features account for approximately 64% of cumulative SHAP variance.
Local explanations: A representative high-risk event has TRS = 87.3 and an automated RESTRICT action, with every feature contribution recorded.Session Length Deviation is the only modest negative contribution because it remains within the normal range.

D. LIME Complementarity and Agreement Rate

LIME complements SHAP for high-risk Isolation Forest decisions, achieving strong top-feature agreement while exposing sensitivity in two closely ranked signals. Adversarial evaluation further shows that behavioral mimicry remains EAZTF’s primary detection gap.

LIME Complementarity and Agreement Rate: 91.4% of sampled high-risk decisions showed agreement between LIME and SHAP on the top three influential features.The comparison covered 500 randomly sampled high-risk Isolation Forest decisions.
LIME Complementarity and Agreement Rate: SHAP TreeExplainer is incompatible with the Isolation Forest decisions, so LIME provides locally linear explanations through feature perturbation.LIME approximates each individual decision boundary using a local surrogate model.
LIME Complementarity and Agreement Rate: The 8.6% disagreement cases concentrated where Device Credential Trust and API Call Velocity had nearly equal SHAP values.Small perturbations could change the ordering of these two signals, motivating more granular feature engineering.
Adversarial Evaluation: 91.0% was the overall adversarial mean detection rate, while Behavioral Mimicry was lowest at 83.9%.API Rate Evasion reached 96.0%, Privilege Escalation 90.9%, and Credential Theft 92.0%.
Adversarial Evaluation: Mimicry bypasses occurred during the first seven days of baseline collection, before reliable deviation scoring had accumulated.The proposed response is extending the baselining period and applying stricter thresholds to new users or credentials.

D. Mean Time to Detect

EAZTF substantially reduces detection time relative to the traditional perimeter-oriented SIEM baseline. Its operational effect is paired with explainable per-decision attribution and targeted false-positive mitigations.

Mean Time to Detect: Under one minute was EAZTF’s reported mean time to detect, compared with 43 hours for the traditional baseline.The reported comparison corresponds to a 3,323× faster detection time.
Mean Time to Detect: A 58.6 percentage-point improvement in mean threat detection was reported against the perimeter baseline.The comparison is presented as the headline overall performance figure.
Mean Time to Detect: 91.0% was the mean detection rate across the four adversarial evasion scenarios.This mean covers the scenario-specific rates reported for Credential Theft, Behavioral Mimicry, API Rate Evasion, and Privilege Escalation.
Mean Time to Detect: Full per-decision SHAP attribution replaced zero explainability in the traditional baseline comparison.The attribution records support operational review of individual access decisions.
False Positive Root Cause Analysis: 4.1% was the false-positive rate after mitigations, down from a pre-mitigation rate of 6.7%.The main causes were international travel, CI/CD activity, and administrator after-hours maintenance.

C. Computational Overhead

EAZTF’s computational overhead is dominated by event capture rather than model inference or explanation generation. The reported latency is acceptable for the evaluated attack patterns but bounds applicability to sub-second response scenarios.

Computational Overhead: Approximately 10.4 seconds was the total end-to-end latency of the EAZTF decision pipeline.CloudTrail event capture contributed approximately 8 seconds, while ML inference took 180 ms and SHAP generation 220 ms.
Computational Overhead: 180 ms was the average Isolation Forest inference latency per event.The paper reports this as within the operational budget of the Lambda pipeline.
Computational Overhead: CloudTrail event capture delay of approximately 8 seconds was the dominant computational-pipeline term.The delay is attributed to the S3 notification pathway.
Computational Overhead: 220 ms was the reported SHAP explanation-generation time.The explanation step contributed marginally compared with event capture.
Computational Overhead: Sub-second automated-response scenarios would require bypassing the S3 notification pathway.The paper projects that this optimization could reduce total latency below 3 seconds.

B. Limitations

The evaluation is constrained by synthetic data, a behavioral-mimicry detection gap, and latency limits; proposed mitigations remain untested. Future work prioritizes production validation and extensions for sequence analysis, federated learning, post-quantum protection, and multi-cloud deployment.

Limitations: The evaluation dataset is entirely synthetic, so reported performance remains indicative rather than validated against production or established benchmark datasets.Real-world distributions across unusual IAM roles, legacy services, and multi-account architectures may differ from the synthetic generator.
Limitations: Behavioral mimicry achieves a 16.1% bypass rate, leaving an unresolved detection gap for persistent threat actors with sufficient observation time.The proposed architectural mitigations have not yet been empirically tested.
Limitations: The approximately 10.4-second pipeline latency is acceptable for evaluated attack patterns but insufficient for scenarios requiring sub-second automated response.Addressing this limitation requires a stream-processing architecture outside the current implementation scope.
Future Research Directions: Validation against real-world behavioral datasets is identified as the most pressing next step.CERT Insider Threat Dataset and CICIDS2017 are proposed as established benchmarks to complement the synthetic evaluation and reveal distribution mismatches.
Future Research Directions: Graph-based lateral movement detection is proposed to analyze IAM resource-access sequencing and address the mimicry bypass problem.The approach extends the current feature set with sequence analysis across IAM sessions.
Future Research Directions: Future directions also include federated learning across AWS accounts, post-quantum cryptographic integration, and multi-cloud extension.These directions target collaborative behavioral modeling, long-term session-token protection, and unified behavioral Zero Trust across hybrid environments.

APPENDIX

The appendix scores each NIST tenet on a 0–100 scale using bands ranging from fully automated continuous enforcement to policies that are not technically enforced.

APPENDIX: Each NIST tenet is scored on a 0–100 scale according to defined implementation bands.The scoring bands distinguish automation, enforcement timing, and whether manual intervention is required.
APPENDIX: Scores of 90–100 represent fully automated, continuously enforced, and real-time logged implementation.
APPENDIX: Scores of 70–89 indicate automated implementation with manual fallback or periodic non-real-time enforcement.Scores of 50–69 indicate partial implementation requiring manual intervention, while scores below 50 indicate policy without technical enforcement.