Trust Threshold Policy for Explainable and Adaptive Zero-Trust Defense in Enterprise Networks

Ge, Yunfei; Zhu, Quanyan

doi:10.1109/cns56114.2022.9947263

Cited by 8 publications

(8 citation statements)

References 21 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…A new security paradigm known as zero trust has emerged as a method to improve the existing boundary security approach, and many organizations are introducing zero trust solutions and services. In zero trust, inspections, such as risk scoring, which ensure security and identify vulnerabilities in devices that request access to an organization's resources, are important elements that must be performed each time a user requests a resource [25,26]. In this study, we proposed an algorithm that resolves the imbalance between security and availability that occurs when risk scoring is performed according to the same criteria for all users, as is currently performed at many companies.…”

Section: Discussionmentioning

confidence: 99%

Endpoint Device Risk-Scoring Algorithm Proposal for Zero Trust

et al. 2023

View full text Add to dashboard Cite

The rapid expansion of remote work following the COVID-19 pandemic has necessitated the development of more robust and secure endpoint device security solutions. Companies have begun to adopt the zero trust security concept as an alternative to traditional network boundary security measures, which requires that every device and user be considered untrustworthy until proven otherwise. Despite the potential benefits of implementing zero trust, the stringent security measures can inadvertently lead to low availability by denying access to legitimate users or limiting their ability to access necessary resources. To address this challenge, we propose a risk-scoring algorithm that balances confidentiality and availability by evaluating the user’s impact on resources. Our contributions include (1) summarizing the limitations of existing risk scoring systems in companies that implement zero trust, (2) proposing a dynamic importance metric that measures the importance of resources accessible to users within zero trust systems, and (3) introducing a risk-scoring algorithm that employs the dynamic importance metric to enhance both security and availability in zero trust environments. By incorporating the dynamic importance metric, our proposed algorithm provides a more accurate representation of risk, leading to better security decisions and improved resource availability for legitimate users. This proposal aims to help organizations achieve a more balanced approach to endpoint device security, addressing the unique challenges posed by the increasing prevalence of remote work.

show abstract

Section: Discussionmentioning

confidence: 99%

Endpoint Device Risk-Scoring Algorithm Proposal for Zero Trust

et al. 2023

View full text Add to dashboard Cite

show abstract

“…For a specific attack scenario θ, a POMDP-based zerotrust defense under asymmetric information is developed in [12], where the defender dynamically evaluates the account's trustworthiness using the trust score (TS), defined as the belief that the user is legitimate, i.e., T S k := b k (s = 1). The defender's belief is updated in the following Bayesian manner:…”

Section: Scenario-agnostic Zero-trust Defensementioning

confidence: 99%

“…A stochastic gradient descent algorithm is proposed in [12] to minimize the cost U θ (π), leading to a simple approach to zero-trust defense (ZTD). However, the resulting optimal policy is generally scenario-dependent: the defense policy is designed for some specific system configuration and attacker capabilities.…”

Section: Scenario-agnostic Zero-trust Defensementioning

confidence: 99%

“…To be specific, we first note that for each scenario θ, the optimal policy, under some mild assumptions, is a stationary threshold policy [12,Theorem 1]. Hence, it suffices to find the minimizer π * θ to U θ (π) within the set of threshold policies Π, where each element is parameterized by a threshold τ ∈ [0, 1]: π θ (T S) = 1 {τ <T S≤1} .…”

Section: A Gradient-based Adaptation and Explainable Meta Policymentioning

confidence: 99%

“…We consider the following baseline configuration and train the model for different system vulnerability distributions: p d a = 0.2, p d u = 0.1, p n a = 0.8, q a = 0.9, q u = 0.1, C(0, 0) = 10, C(0, 1) = 15, C(1, 0) = 3, C(1, 1) = 0. To obtain the threshold policy [12], we consider the system vulnerability satisfies 0 ≤ p n u ≤ min{p n a , p n a − p d a + p d u }, i.e., p n u ∈ [0, 0.7]. Each p n u value represents one scenario θ = (p n u ) in our model.…”

Section: A System Vulnerabilitymentioning

confidence: 99%

See 2 more Smart Citations

Scenario-Agnostic Zero-Trust Defense with Explainable Threshold Policy: A Meta-Learning Approach

Ge¹,

Li²,

Zhu³

2023

Preprint

View full text Add to dashboard Cite

The increasing connectivity and intricate remote access environment have made traditional perimeter-based network defense vulnerable. Zero trust becomes a promising approach to provide defense policies based on agent-centric trust evaluation. However, the limited observations of the agent's trace bring information asymmetry in the decision-making. To facilitate the human understanding of the policy and the technology adoption, one needs to create a zero-trust defense that is explainable to humans and adaptable to different attack scenarios. To this end, we propose a scenario-agnostic zero-trust defense based on Partially Observable Markov Decision Processes (POMDP) and firstorder Meta-Learning using only a handful of sample scenarios. The framework leads to an explainable and generalizable trustthreshold defense policy. To address the distribution shift between empirical security datasets and reality, we extend the model to a robust zero-trust defense minimizing the worst-case loss. We use case studies and real-world attacks to corroborate the results.

show abstract