Adaptive Cognitive Zero-Trust Risk Scoring for Behavioral Cloud Access Security

Abstract

In this paper, an Adaptive Cognitive Zero-Trust Risk-Scoring Framework for Behavioral Cloud Access Security is proposed. The work aims to overcome the gap between static access-control policies and binary anomaly alerts, which are insufficient to reflect changing user behavior, contextual access deviation, and session-level risk in cloud settings. The proposed approach relies on the dataset of cloud user/entity behavior log (CLUE-LDS) to build a session-level behavior profile by analyzing the authenticity of access behaviors, access behavior for files, sharing behaviors, resource-path structure, temporal access behavior, role of the user, and anomaly in the user's baseline. The cognitive risk engine generates a dynamically updated zero-trust risk score for each session, and categorizes them into low, medium and high-risk groups, resulting in 437 low-risk sessions, 181 medium-risk sessions and 110 high-risk sessions. Several classifiers were tested for elevated-risk detection, with the best overall performance being that of Random Forest, which achieved accuracy of 0.9670, precision of 0.9351, recall of 0.9863, F1-score of 0.9600, ROC-AUC of 0.9964, and PR-AUC of 0.9946. The grouped importance was 0.6593 for temporal behavior and 0.1824 for file and resource behavior as per explainability analysis. The contribution of this work is a novel cognitive zero-trust security layer which brings adaptive behavioral intelligence and interpretable risk scoring along with high-performing cloud access-risk classification for continual trust assessment.