An underlying tenet within the zero-trust architecture is the statement of never trust, always verify, and therefore is strongly applicable for securing cloud environments that often lack defenses at the perimeter. The distributed nature of cloud infrastructures, the ability to dynamically scale resources, and complex access patterns render them particularly vulnerable to authorization attacks. In this paper we discuss how employing Zero Trust principles including but not limited to continuous identity verification, least access to any resource, and micro-segmentation can allow for better detection capabilities plant to authorization attacks in cloud environments. In this paper, we propose a framework utilizing real-time monitoring and other machine learning algorithms to detect abnormal behavior from this server which would suggest an attack of this nature is taking place. Our study shows that using Zero Trust strategy improves authentication threats detection and mitigation significantly via those simulations and empirical tests. These findings provide important information that can be used to strengthen cloud security frameworks and mitigate vulnerability to authorization attacks.
Cloud services are revolutionizing the information technology arena as they offer scalable, stateless
and on-demand access to a shared pool of configurable computing resources [
Traditional perimeter-based security frameworks are no longer enough to combat these threats.
These models assume that a trusted internal network is separated from an untrusted external
network, an assumption that falls apart in cloud environments wherein resources are accessed over
the internet and from different locations [
This brings us to ZTA or Zero Trust Architecture, a paradigm shift needed in in cybersecurity to overcome the limitations of the traditional security models. Based on the principle of outside-in security, Zero Trust ends the belief of trust in the network perimeter; the catch phrase "never trust always verify" is rooted in this approach. This put the emphasis on verifying users and controlling access no matter where a user or network is located.
And when you think about cloud security, Zero Trust becomes truly relevant. The dynamic and
distributed nature of cloud environments is conducive to Zero Trust principles, which are
fundamentally about enforcing least privilege access and continuous authentication [
To address authorization attacks, cloud adoption of the Zero Trust model must be implemented so that access to resources is determined by rigorous verification and real-time risk evaluations. This solution solves the problems of multi-tenancy and elastic provisioning of resources by applying adaptive and contextual policies.
The objective of this paper is to implement Zero Trust principles in order to create a strong authorization attack detection solution in cloud environments. The specific objectives are: • • •
To develop a mathematically rigorous model that allows one to combine Zero Trust principles for ongoing identity verification and access control in cloud-based environments. Machine learning algorithms: modeling anomalous behaviors as a sign of authorization attacks.
To validate the proposed model with simulations and empirical analysis, so as to prove its relevance for improving detection mechanisms.
This study makes the following contributions: • • •
In this paper, we present a new model that combines Zero Trust principles with sophisticated mathematical models to enhance the detection of authorization attacks in cloud platforms. Real-time anomaly detection by machine learning based detection algorithms We evaluate the proposed solution and show how it outperforms traditional security models in detection accuracy and reduction of false positives.
This research is unique in its approach of using Zero Trust to talk on the most prominent issue of authorization attacks in cloud environments, hence adding one more piece in the puzzle of Zero Trust for academia and also providing some critical insights for the industry too. These findings can help strengthen cloud security frameworks and mitigate vulnerabilities arising from attacks targeting authorization mechanisms.
Authorization attacks are a type of security breach in which an attacker defeats intended access
control policies by obtaining access or escalating privileges within a system [
Moreover, many cloud-specific attributes, such as the multi-tenancy of cloud architecture,
dynamic resource allocation, and complex access patterns make the authorization attacks harder to
detect in the cloud environment [
In addition, there are complex access control requirements due to the use of distributed systems
and microservices in the cloud [
In such environments, legitimate requests for access can be high-volume, and user behavior can
vary widely, making it difficult to detect authorization attacks. The attacker has control over the
normal user activity; therefore, normal-intended activity is similar to malicious user activity, which
is hard for rule-based systems to identify legitimate activity from malicious activity [
Zero Trust Architecture (ZTA) is a concept that works with a zero-trust approach - "never trust, always verify" - which removes any form of implicit trust. Key principles include: • • •
Continuous Verification: all access requests are continuously verified based on real-time context including user identity and device health.
Least Privilege Access: users receive only the minimum level of access necessary, limiting potential harm to a compromised account.
Micro-Segmentation: resources are partitioned into fine-grained areas to protect them from a lateral movement of an attacker.
For instance, Zero Trust was applied in the field of cybersecurity to provide better defense against
sophisticated threats. One such example is Google's BeyondCorp [
For cloud environments, Zero Trust concepts help manage the resource and user distributed
nature. The adoption of continuous verification and least privilege access reduces the risk of such
attacks on authorization systems [
Here are some methods for detecting authorization layer attacks: • •
Rule-Based Systems: these systems employ predefined rules to identify unauthorized
activities [
Anomaly Detection Techniques: they monitor user behavior to capture deviations from
established baselines between users and normal behaviors [
But there are limitations to these approaches. To overcome that rule-based systems are updated
frequently and lead to high false positives [
They don't natively support Zero Trust principles, and as a result, existing mechanisms are often inadequate in cloud environments. Advanced detection methodologies must be paired with Zero Trust concepts to protect against these threats.
Traditional security models, largely focused on perimeter defense mechanisms, are failing to meet
the cloud environment security challenges [
Firewalls, intrusion detection systems, and network segmentation are the core elements of
perimeter-based security [
Dynamic Resource Provisioning: the dynamic allocation of the resources of cloud services
leads to constant changes in the network topology [
Multi-tenancy: the sharing of physical resources among multiple tenants amplifies the attack
surface and potential for cross-tenant attacks [
Remote Access: cloud users access services from multiple locations and devices, where
enforcing network perimeter security is impractical [
Complex access patterns: The cloud being associated with microservices and in turn APIs are not accounted for in any traditional models, and such access patterns are very complex.
The limitations of these traditional models reveal an urgent need for a security framework that is
able to adjust to the dynamic and distributed nature of cloud computing. A Zero Trust Architecture
(ZTA) provides such a framework by completely re-imagining the management of access and trust
[
The limitations identified by are mitigated with Zero Trust principles: •
No Implicit Trust: since every access request is verified regardless of its origin, Zero Trust eliminates dependence on network perimeter. Real-time verification with Continuous Authentication and Authorization: Security policies withstand the impact of network conditions or user contexts.
Fine-Grained Access Control: making use of least privilege access minimizes the effect of
compromised credentials [
Micro-Segmentation: splitting the network into smaller, controllable sections limits lateral
movement by an adversary [
Zero Trust integrates additionally into cloud security, improving detection and protection against authorization attacks by:
Better Insight: ongoing monitoring helps in having a better understanding of user actions and access patterns.
Adaptive Policies: security policies can be adapted dynamically depending on contextual
information [
Improved Anomaly Detection: using Zero Trust and advanced analytics together enables
detecting unauthorized access attempts [
A Zero Trust-based Solution proceeding on this, if organizations implement Zero Trustbased solution, they will develop a far more resilient security posture better fit for the realities of cloud environments.
We formalize these components of the cloud environment relevant to our model in the following section. Users, resources, access requests, and security policies make up the system and are critical to establishing which assets the user can reach as well as enforcing Zero Trust.
Let: = { 1, 2, … , } be the set of users. = { 1, 2, … , } be the resource pool (e.g., data, applications, services). = { 1, 2, … , } be the collection of permissible actions (e.g., read, write, execute). = { 1, 2, … , } be the set of sessions.
An access request is defined as a tuple: = ( , , , ) (1) where ∈ , ∈ , ∈ , and ∈ .
Governable actions are dictated by security policies, and we define an authorization function Auth( , , )that returns true (Authorized) if user is authorized to perform action on resource , and false (Unauthorized) otherwise.
To determine continuous verification, we associate each user with a class of identity attributes = { 1, 2, … , }, which may include credentials, biometric data, device IDs, and behavioral patterns.
We introduce a verification function ( , ) which at time returns a confidence score ∈ [
Attr be the attribute set of a user .
Attr be the resource attributes set .
Attr be the collection of environmental attributes (time, location, device, etc.) An access control policy is a rule defined as:
: (Attr , Attr , Attr ) → {Permit,Deny} (4) The access request is evaluated by the policy decision function PDP( ) which applies the policy where this function gives the probability of the identity attributes ( ) that is observed at time belong to the legitimate user . Techniques like probabilistic models or machine learning classifiers (e.g. Support Vector Machines, Neural Networks) are employed to calculate ( , ).
As an example, we can model the distribution of identity attributes using a gaussian mixture model (GMM):
= [ 1, 2, … , ] where features may include:
Temporal Features: access time, access frequency.
Spatial Features: IP address, geolocation.
Behavioral Features patterns of access sequences, resource usage, etc.
Device Attributes: hashed device ID, hashed operating system.
Anomaly detection model. We use an anomaly detection function
: → {0,1} where 0 means normal behavior and 1 means anomaly.
Possible algorithms include:
( ( )) = ∑ ( ( ); , ) where is the number of Gaussian components, are the mixture weights, and denotes the Gaussian distribution with mean and covariance .
We use an Attribute Based Access Control (ABAC) model [
Let: (3) (6) (7) (8)
PDP( ) = (Attr , Attr , Attr ) (5)
We follow the least privilege principle and give users only access the minimal necessary access rights. Formally, for each user , we define their permission set Perm :
Perm = {( , ) ∨ Auth( , , ) = true}
Some of them involve machine learning algorithms that model legitimate access patterns so that odd behavior can be detected.
Feature vector construction. We construct a feature vector ∈ for each access request : • • •
OC SVM (One-Class Support Vector Machine): it learns a boundary among normal data. Autoencoders: Neural networks are trained to reconstruct input data, where the reconstruction error indicating anomalies.
Isolation Forest: Finds anomalies based on how well you can isolate data points.
The anomaly score ( ) is calculated, with higher values indicating greater deviation from normal behavior.
We introduce a risk score ( ) for each access request , combining identity check and outlier detection:
( ) = (1 − ( , )) + ( )
where:
•
•
•
( , ) refers to the identity verification confidence score.
( ) and is the normalized anomaly score ( ) ∈ [
, are weighting factors + = 1.
It assigns a risk score ( ) ∈ [
Otherwise, the access request will go to the authorization function Auth( , , ).
The described mathematical model represents the Zero Trust principles the following methods: (9) (10) • • • • • • Process flow consists of:
Continuous verification, the identity verification function continuously evaluates the user
identity and their real-time traits to ensure that trust is not assumed [
Least Privilege Access: minimal permission sets Perm defined deliver tight access control
in accordance with Zero Trust [
Anomaly Detection: machine learning algorithms identify abnormal access patterns,
contributing to the dynamic assessment of risk [
Adaptive Policies: the risk score ( ) helps guide policies to adapt based on contextual
information and current threat levels [
User requesting action on resource during session .
And in terms of Identity Verification: compute ( , ) to assess confidence in the user's identity.
Feature Extraction: creating feature vector from the access request and contextual data. Anomaly Detection: compute anomaly score ( ).
Risk Assessment: calculate the risk score ( ) based on the defined weighting.
Policy Decision: evaluate PDP( ) based on ( ) and access control policies.
Authorization Check: if PDP( ) = Permit, then goto Auth( , , ); else, reject.
Zero Trust is an approach of validating all access requests without implicit trust and all accesses are validated against some rigorous protocols. This enables us to propose a general and solid solution • • • for detecting authorization-based attacks in cloud environment by mathematically formalizing the constituents.
We created an experiment to assess the effectiveness of the suggested Zero Trust-based detection model in detecting authorization attacks in a cloud environment. There were user operations and malicious operations made by a real attack to simulate a real cloud-computing environment.
The phases during experimenting include: 1. Data Gathering and Data Preprocessing 2. Implementing a Detection Model 3. Baseline Model Setup 4. Performance Evaluation
We leveraged both real-world and synthetic datasets for a comprehensive evaluation: Production Data: anonymized access logs from a cloud service provider which includes logs on user requests on cloud resources for a duration of 6 months.
Synthetic Data: through a simulation tool for known attack scenarios (Varied Security Implications of Authorization Attacks), from privilege escalation to access without authorization.
The required datasets were preprocessed in order to get them ready for analysis: Data Cleaning: removed the incomplete, duplicate or inconsistent entries to enhance data quality.
Normalization: used min-max scaling for numerical features for uniformity. Categorical Encoding: categorical features (such as user roles, and user actions) were onehot encoded.
Feature Selection: the multiple features have been obtained through domain knowledge and statistical significance, such as user ID, resource ID, action type, timestamp, IP address, and device information.
The following were implemented using the following tools and technologies: Language: Python 3.8.
Libraries For Processing Data: Pandas, NumPy.
Machine Learning Libraries: Scikit-learn, TensorFlow.
Database: Provides PostgreSQL for storing and querying large datasets.
Computing Environment: the experiments have been run in a workstation including an Intel Core i7 as processor, 16 GB of RAM and an NVIDIA GeForce GTX 1060 as GPU. • •
This work used the theoretical model introduced in Section 4 as follows:
Identity Verification Module: accreting the identity verification confidence score based on Gaussian Mixture Models (GMM) to calculate the identity verification confidence score ( , ).
Anomaly Detection Module: used One-Class Support Vector Machines (OC-SVM) and Autoencoder neural networks to calculate the anomaly score ( ).
Risk Scoring Mechanism: developed a method to generate a risk score ( ), which is the result of the outputs from identity verification and anomaly detection modules. Access Control Policies: wrote ABAC policies and used a policy engine to allow or deny all requests based on attributes of the requester user, requested resource and the environment in which the request was made.
It combined the code into a complete application to be deployed on a production system that handles access to services and applies risk-based access control in real-time according to the Zero Trust paradigm of continuous verification and least privilege access to data.
5.4.2. Testing
Training Phase: this is the stage of training the identity verification and anomaly detection takes the input the preprocessed data containing legit access logs.
Validation Phase hyperparameters were optimized based on a validation set to improve model performance and avoid overfitting.
Test Dataset: a set of legitimate access requests mixed with simulated authorization attacks. Attack Simulation: malicious behavior was injected in to the test dataset to simulate different attack vectors that embodied: a. Privilege Escalation: attempting to access resources beyond their privileges. b. Session Hijacking: access requests using stolen session tokens. c. Abnormal Access: Access patterns that are out of the ordinary (e.g. access at odd hours, or from atypical locations). • •
The integrated system processed the test dataset, and each access request was tested against the detection model.
Outcome (allow or deny) and risk scores were logged for analysis.
To evaluate model performance, we used the following metrics: •
True Positive Rate (Recall): identifies the actual attacks versus the ones detected. Recall =
False Positive Rate
The rate at which legitimate requests are flagged as attacks. False Positive Rate =
Precision: The fraction of attacks discovered that were actual attacks False Positive Rate =
F1-Score: The harmonic means of precision and recall which gives a balance between the two.
F1-Score = 2 ×
AUC-ROC: Area Under the Receiver Operating Characteristic Curve; a metric of the model's ability to distinguish legitimate requests from malicious requests.
Computational Efficiency: Evaluating the average time needed to process each access request offers insight into the model's performance applicable to real-time applications. (11) (12) (13) (14) • • • • • • • • • • •
Data Privacy: we will anonymize personal identifiers according to data protection regulations (GDPR) and secure all data at rest.
Responsible Use: the synthetic attack data are only generated for research and doesn t have security impact.
To put the proposed model performance fit into context, we applied the following baseline detection methods:
Rule-Based System: a deployment that would rely on static rules and thresholds that are set in advance and that are the industry norm for the legacy security.
Statistical Anomaly Detection: uses statistical methods to find outliers based on difference between features mean & standard deviation.
Performances of the baseline models were extracted after processing the same test dataset and comparison with the proposed model was made.
Statistical Tests: the significance of the results of the study was verified through statistical tests: Confidence Intervals: calculated 95% confidence intervals for evaluation metrics to assess their stability.
Hypothesis Testing: run t-tests to determine whether improvements in accuracy over baseline models were statistically significant.
In this section, the results of the experiments performed to assess the proposed detection model based on the concept of Zero Trust are detailed. These results show the ability of the model to accurately detect the authorization attacks in cloud settings with a low false positive rate.
A dataset of legitimate access requests and simulated authorization attacks was used to test the proposed model. The following metrics were considered:
It shows that a very high portion of the authorization attacks (high recall) were correctly identified as such, while precision, which measures how much of what the model has found is malicious actually the case, was at the same time also high so the model was working well to separate benign from malicious behavior.
The average processing time of each access request is 0.012(s) which demonstrates the model is qualified to utilize in real-time detection in the cloud environment and does not introduce too much computation overhead.
To put the proposed model performance in context, we compared it to classical detection approaches, namely to a rule-based system and to a statistical anomaly detection approach.
Rule-Based System:
Summary statistics of the comparative performance are reported in Table 2. Comparison of Performances of the Detection Methods
Metric
Proposed Model
Rule-Based System
Statistical Anomaly
Detection
Statistical analysis: A paired t-test was performed to analyze the significance of the improvements. The differences in F1-Scores between the proposed model and the statistical anomaly detection method were statistically significant (p < 0.01).
To demonstrate the practical effectiveness of the proposed model, we illustrate several examples of successful detection of authorization attacks.
An end-user account made a request for an admin manipulation of a sensitive asset. The confidence score for identity verification was high ( , ) = 0.95, indicating the user's credentials were accepted. The anomaly detection module however detected identified the action as inconsistent with normal behavior, assigned a high anomaly score ( ) = 0.9. The risk score calculated was ( ) = 0.475, which is greater than = 0.4, so the access was denied.
An insider with a planned exit date accessed sensitive information on an outside date and from an anomalous location. The risk score ( ) = 0.475 calculated from the identity verification score ( , ) = 0.85 and the anomaly score was ( ) = 0.8, so the access request was blocked and an alert was created.
A legitimate user was denied access when connecting from a new device while traveling. The identity verification score was low ( , ) = 0.6, and the anomaly score was high ( ) = 0.85, resulting in a risk score of ( ) = 0.625. These false-positives highlight the need for mechanisms to handle such scenarios, such as step-up authentication or user notifications.
The findings imply that applying Zero-Trust principles at the mathematical modeling level can potentially augment the discovery rate of authorization attacks in the cloud. A good true positive rate means that the model is doing a good job of identifying malicious activities, and a low false positive means that it is not disturbing legitimate users too much.
The better performance over baseline methods comes from:
Dynamic Identity Verification: probabilistic identification enables real-time assessment of user legitimacy outside of static credentials.
Using OC-SVM and Autoencoders for Anomaly Detection with Machine Learning Machine learning, by default, is better at detecting small discrepancies from normal behavior which a rules-based system may miss Risk-Based Access Decisions: The risk scoring mechanism is combined which correlates to risk-based access control decisions where it adheres with Zero Trust principle of "never trust, always verify."
The computational speed signifies that the model is suitable to be deployed in a real cloud environment, to grant access in a code-turned-real-time manner.
Though the model displays good performance, the following limitations were experienced: Data Quality Dependency: the model performance depends on the quality and representativeness of the training data. It may be difficult to find abnormalities not included in the training set.
User Experience Impact: as legitimate users may exhibit atypical behavior work is needed on a verification mechanism so that these users are not locked out of the system thereby causing frustration.
Scalability: the ability of the system to maintain performance in large-scale cloud computing environments will need further consideration as it performed adequately for the testing environment used.
The authors would like to express their sincere gratitude to all those who have supported and contributed to this research. We are particularly grateful to our colleagues and mentors for their insightful feedback and guidance throughout the development of this work. We acknowledge the support of our institution's research facilities, which provided the necessary resources and environment for conducting this study. Special thanks to the technical staff for their assistance in data collection and system implementation. We also extend our appreciation to the anonymous reviewers and editors for their valuable comments and suggestions, which have significantly improved the quality of this paper.
The authors have not employed any Generative AI tools.