<figure><img src="image_1.png" /></figure>

HAL
open science

# Autonomous identity-based threat segmentation for zero trust architecture

Sina Ahmadi

► To cite this version:

Sina Ahmadi. Autonomous identity-based threat segmentation for zero trust architecture. Cyber Security and Applications, 2025, 3, pp.100106. 10.1016/j.csa.2025.100106. hal-05140944

HAL Id: hal-05140944

https://hal.science/hal-05140944v1

Submitted on 2 Jul 2025

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_2.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
<figure><img src="image_3.png" /></figure>

# Autonomous identity-based threat segmentation for zero trust architecture ☆

<figure><img src="image_4.png" /></figure>

Sina Ahmadi

The National Coalition of Independent Scholars (NCIS), USA

## ARTICLE INFO

### Keywords:

Zero Trust Architecture (ZTA)

Segmentation

Behavioral Analytics

Dynamic Access Governance

Machine Learning

Insider Threat Detection

## ABSTRACT

Zero Trust Architecture (ZTA) fundamentally redefine network security by adopting a "trust nothing, verify everything" approach requiring identity verification for all access. However, conventional access controls are static and fail to consider evolving user activities and contextual threats, leading to internal risks and breaches. This research proposes an AI-driven, autonomous, identity-based threat segmentation framework for ZTA. Behavioral analytics provide real-time risk scores by analyzing login patterns, access behavior, and resource utilization, while Machine Learning models dynamically adjust permissions based on geolocation, device type, and time of access. Automated threat segmentation enables the real-time isolation of compromised identities, minimizing breach progression. Practical use cases, such as insider threat mitigation across distributed offices, are discussed. Privacy concerns, false positives, and scalability challenges are addressed. Comparative analysis demonstrates the system's precision and scalability, enhancing dynamic access governance while maintaining user productivity.

## 1. Introduction

### 1.1. The Shift Towards Zero Trust Architecture

Traditional approaches to cyber protection have increasingly proven inadequate in the face of complex and evolving cyber threats, particularly with the rapid expansion of digitization across business organizations [1]. Perimeter-based security models, which draw a clear boundary between secure internal networks and dangerous external environments, are no longer sufficient against Advanced Persistent Threats (APT), insider attacks, and remote access vulnerabilities. This deficiency has led to the emergence of Zero Trust Architecture (ZTA), founded on the principle of "never trust, always verify," where every access request must be authenticated and authorized based on identity confirmation.

An overview of Zero Trust Architecture is depicted in Fig. 1.

According to the ZTA framework, all users, devices, and services that seek access to network resources must undergo authentication and authorization. However, the reliance on static access policies in most ZTA deployments remains a significant drawback. Static policies fail to accommodate the dynamic and continuously evolving threat landscape, where user actions, contextual changes, and temporal factors can greatly influence risk levels.

### 1.2. The need for dynamic security solutions

While static policies provide an essential foundation for access control, they exhibit limited adaptability to anomalies caused by dynamic user behaviors or environmental shifts [2]. For instance, an employee accessing sensitive data from a remote location or an account exhibiting unusual access requests can bypass traditional static controls, leading to potential breaches. Insider threats further complicate these risks, as they originate from legitimate users operating within authorized frameworks.

To address these challenges, a more advanced approach—dynamic identity-based segmentation—has emerged. By integrating real-time behavioral analytics and context-aware intelligence, ZTA systems can evolve into self-adjusting, resilient architectures capable of localized threat containment without disrupting legitimate user activity. Activities.

Dynamic risk assessment can be formalized using a risk-scoring model, as outlined in Equation (1):

$$R = \sum_{i=1}^{n} w_i \cdot f_i(x) \qquad (1)$$

Where:

* R: Risk score assigned to a user or device.

* $w_i$: Weight assigned to each behavioral or contextual factor (e.g., login time, geolocation).

<footnote>☆ Peer review under the responsibility of KeAi Communications Co., Ltd.</footnote>

<footnote>E-mail address: sina0@acm.org</footnote>
## Zero-Trust Architecture

<figure><img src="image_5.png" /><figcaption>Fig. 1. Overview of the trust-based access control model.</figcaption></figure>

* $f_i(x)$: Normalized function representing the observed metric for factor iii.

* n: Total number of factors considered.

Thresholds (T) can then be set to trigger responses: If $R>T$, then isolate or restrict identity.

### 1.3. Research focus and objectives

This research aims to enhance Zero Trust Architecture through AI-driven, autonomous identity-based threat segmentation. Specifically, it focuses on three major objectives. First, it leverages behavioral analytics to continuously monitor user activity patterns such as logins and resource utilization, thereby generating real-time risk scores for early threat identification. Second, it integrates Machine Learning (ML) models to dynamically adjust access permissions based on contextual parameters, including device type, geolocation, and time of access, thereby strengthening adaptive security responses.

Third, it develops automated threat segmentation techniques that quarantine suspicious identities in real-time and address lateral movement across networks. These focus areas propose proactive solutions in contrast to the static and reactive nature of traditional security frameworks. Consequently, this research addresses critical shortcomings of existing ZTA implementations, particularly emphasizing improvements in scalability, privacy compliance, and dynamic access governance.

### 1.4. Real-world relevance and use cases

The proposed system offers immediate practical applications in mitigating insider threats within corporate environments. Another key use case involves organizations with distributed branches, where tracking and analyzing user actions in real-time can enhance threat detection. For instance, if an employee attempts to access restricted data during off-hours from an unfamiliar device or location, the system assigns a high-risk score to the event. Based on this score, the system can automatically trigger preventive measures, such as suspending the user's session and notifying the security team for investigation. This approach reduces incident response time and minimizes false alarms, allowing security teams to concentrate on genuine threats. Moreover, by filtering out anomalous patterns and focusing exclusively on confirmed threat behaviors, critical resources are preserved for genuine security incidents. Thus, the system's real-world relevance lies in improving organizational resilience through dynamic risk assessment and timely intervention.

In practical deployments, the proposed system can support Zero Trust enforcement across various sectors such as finance, healthcare, and government. It is especially effective in scenarios involving secure remote access, insider threat detection, and regulatory compliance where dynamic policy enforcement is crucial. Example use cases include access control in distributed workforce environments, protection of sensitive medical records, and real-time session risk scoring in corporate VPNs.

### 1.5. Constraints and challenges

Despite its potential, implementing the proposed approach introduces several challenges. Behavioral modeling based on user data collection raises significant privacy concerns, necessitating stringent anonymization protocols and strict compliance with regulations such as GDPR and CCPA. Additionally, dynamic systems may occasionally misclassify legitimate activities as threats, leading to operational disruptions [3]. Another substantial hurdle is scalability: large and complex networks require robust computational infrastructures to support real-time segmentation, posing additional technical and financial demands on organizations.

### 1.6. The impact of autonomous threat segmentation

By integrating Artificial Intelligence and Machine Learning techniques into ZTA frameworks, this research aims to reshape organizational approaches to cybersecurity. The proposed system addresses the critical limitations of static access controls by introducing dynamic, context-aware, and behavior-driven mechanisms. In doing so, it strengthens enterprises' defenses against insider threats, lateral movements, and next-generation cyberattacks, setting a foundation for more agile and secure digital infrastructures.

### 1.7. Notation and symbols used

The following symbols are referenced throughout this paper:

* **R** – Risk score assigned to a user or device

* **w**<sub>i</sub> – Weight assigned to behavioral contextual factor i

* **f**<sub>i</sub>(x) – Normalized function for observed metric

* **n** – Total number of contributing factors

* **A** – Anomaly score

* **C** – Contextual score

* **w**<sub>1</sub>, **w**<sub>2</sub> – Weighting factors for anomaly and context, respectively

* **T** – Threshold value used for triggering policy actions

The remainder of this paper is organized as follows: Section 2 presents relevant background and related literature. Section 3 defines the problem motivating this research. Section 4 outlines the proposed research agenda. Section 5 describes the methods and implementation strategies. Section 6 provides experimental validation. Section 7 discusses future directions, and Section 8 concludes the paper.

## 2. Literature review and background

This section provides a foundation for understanding key components of Zero Trust Architecture (ZTA) and related cybersecurity methods. It covers core concepts, challenges, and supporting technologies such as behavioral analytics and automated segmentation.

### 2.1. Zero trust architecture: concepts and challenges

Zero Trust Architecture (ZTA) has emerged as a transformative model in cybersecurity, centered on the foundational principle of “never trust, always verify” [4]. Unlike traditional models that assume internal networks are inherently safe, ZTA requires continuous identification, authentication, and authorization for every access request to minimize external interference and unauthorized access. It emphasizes the principle of least privilege and leverages micro-segmentation to divide networks into isolated zones, effectively containing potential threats. Key enabling technologies in ZTA include Multi-Factor Authentication (MFA), Endpoint Detection and Response (EDR), and Software Defined Perimeters (SDP). MFA strengthens identity validation by requiring multiple verification factors; EDR enables real-time monitoring and detection across endpoints; and SDPs establish secure, policy-driven perimeters. These concepts are illustrated in Fig. 2.
<table><caption>**Table 1**
Key technologies in zero trust architecture.</caption><thead><tr><td>Key Technologies in ZTA</td><td>Role</td><td>Challenges</td></tr></thead><tbody><tr><td>Multi-Factor Authentication (MFA)</td><td>Strengthens identity validation</td><td>Increased complexity for users</td></tr><tr><td>Endpoint Detection and Response</td><td>Ensures robust monitoring of endpoints</td><td>High resource consumption</td></tr><tr><td>Software-Defined Perimeters (SDPs)</td><td>Establishes secure, policy-driven perimeters</td><td>Requires significant implementation effort</td></tr></tbody></table>

<table><caption>**Table 2**
Comparison of traditional and AI-Driven systems.</caption><thead><tr><td>Comparison of Behavioral Analytics</td><td>Traditional Systems</td><td>AI-Driven Systems</td></tr></thead><tbody><tr><td>False Positives</td><td>High</td><td>Lower with advanced ML algorithms</td></tr><tr><td>Context Awareness</td><td>Minimal</td><td>Comprehensive with real-time data</td></tr><tr><td>Adaptability</td><td>Static thresholds</td><td>Dynamic models</td></tr></tbody></table>

<figure><img src="image_6.png" /><figcaption>**Fig. 2.** Risk score components for user authentication.</figcaption></figure>

Despite its strengths, ZTA also faces significant challenges. A major limitation lies in its reliance on static access control models, which cannot adequately adapt to fast-evolving threats such as phishing and malware propagation. Additionally, ZTA demands substantial resource allocation, including infrastructural upgrades and highly skilled human resources. Syed et al. [5] argue that static policies must evolve into dynamic strategies to fully realize ZTA's benefits. Table 1 summarizes key technologies associated with ZTA, their roles, and corresponding challenges.

## 2.2. Behavioral analytics in cybersecurity

Behavioral analytics has become an essential tool in modern cybersecurity, relying on Artificial Intelligence (AI) and Machine Learning (ML) to detect deviations in user behavior patterns. This approach focuses on understanding common behaviors, such as login history, access requests, and resource usage, to identify anomalies that could signal malicious activity. For example, an employee accessing files that are unusual for their role at an atypical time or from an unfamiliar device would trigger an alert.

Existing systems like User and Entity Behavior Analytics (UEBA) offer foundational capabilities in this area [6]. These tools analyze logs, network traffic, and other data sources to highlight unusual behaviors. However, one of the enduring challenges with UEBA systems is their high false positive rates, which can overwhelm security teams with benign alerts. Furthermore, these systems sometimes fail to differentiate between minor anomalies and serious threats. For instance, an employee on a business trip may exhibit unusual geolocation data, unintentionally triggering alerts.

To address these shortcomings, advancements are being made to improve ML models and to incorporate richer contextual information into behavioral analytics systems. Table 2 presents a comparative view of traditional and AI-driven behavioral analytics systems.

## 2.3. Context-aware access control

Context-aware access control represents a major advancement in cybersecurity, as it dynamically evaluates various factors such as user geolocation, device characteristics, network conditions, and access timing before granting permissions. Unlike conventional systems that depend on static rules, context-aware systems perform real-time assessments. For example, even if correct credentials are provided, access might be denied if the login attempt is made from an unfamiliar device or suspicious location [7].

Machine learning plays a central role in enabling these dynamic access adjustments. By continuously analyzing historical data and real-time inputs, ML algorithms can detect nuanced patterns and dynamically update access policies. Research by Haque, Bhushan, and Dhiman [8] emphasized that context-aware (CA) systems improve both security and user experience by offering flexible responses tailored to different scenarios.

However, context-aware systems introduce new challenges. Excessive restrictions based on real-time analysis can create user frustration or inadvertently block legitimate activities. Furthermore, the requirement for real-time evaluation increases computational demands, necessitating careful system optimization. Table 3 highlights the major advantages and challenges associated with context-aware access control.

## 2.4. Automated threat segmentation

Automated threat segmentation focuses on the dynamic isolation of compromised users within a network to limit threat spread [9]. It employs clustering techniques, supervised learning models, and anomaly detection algorithms to dynamically segment networks based on emerging threat patterns. For instance, a device exhibiting anomalous behavior can be moved immediately into a quarantine zone for further inspection.

Research has validated the effectiveness of clustering techniques in detecting compromised entities, particularly in high-traffic networks with many endpoints. By grouping similar behaviors into clusters, deviations that suggest malicious activity can be more easily identified [10]. Supervised learning models further enhance detection accuracy by training on labeled datasets to distinguish benign from malicious behaviors.

Nevertheless, real-time threat segmentation poses challenges. Large-scale data processing demands substantial computational resources, and reliance on AI systems may overlook subtler forms of threats that do not fit learned patterns. Table 4 compares the characteristics of traditional versus AI-driven segmentation systems.

## 2.5. Zero trust architecture and behavioral analytics integration

Recent research by Sharma [11] has explored the potential integration of Zero Trust Architecture with behavioral analytics to improve cybersecurity resilience. Combining the fine-grained access control of
<table><caption>**Table 3**
Key features of context-aware systems.</caption><thead><tr><td>Key Features of Context-Aware Systems</td><td>Advantages</td><td>Challenges</td></tr></thead><tbody><tr><td>Dynamic Access Policies</td><td>Tailored responses to diverse scenarios</td><td>Computationally intensive</td></tr><tr><td>Real-Time Adjustments</td><td>Enhanced security and usability</td><td>Risk of introducing latency</td></tr><tr><td>Variable Evaluation (geolocation, device)</td><td>Comprehensive access control</td><td>Potential for excessive restrictions</td></tr></tbody></table>

<table><caption>**Table 4**
Comparison of traditional and AI-Driven systems.</caption><thead><tr><td>Aspect</td><td>Traditional Systems</td><td>Proposed AI-Driven Systems</td></tr></thead><tbody><tr><td>Policy Type</td><td>Static</td><td>Dynamic</td></tr><tr><td>Behavioral Analytics</td><td>Limited</td><td>Advanced with ML models</td></tr><tr><td>Context Awareness</td><td>Minimal</td><td>Comprehensive (geolocation, etc.)</td></tr><tr><td>Scalability</td><td>Moderate</td><td>High with optimizations</td></tr><tr><td>False Positives</td><td>High</td><td>Lower with refined algorithms</td></tr></tbody></table>

ZTA with the anomaly detection capabilities of behavioral analytics offers a powerful defense mechanism. For instance, behavioral analytics engines embedded within ZTA frameworks can monitor user activities and dynamically adjust access permissions based on detected anomalies.

Successful integration requires comprehensive contextual data collection [12]. Access decisions must consider user roles, device trust levels, and real-time threat intelligence. Achieving this level of integration demands highly sophisticated ML models capable of processing diverse and voluminous data streams without introducing latency or excessive computational burden.

Furthermore, the integration enables a shift towards proactive threat prevention. Systems can predict and contain threats early, for example by detecting geographically inconsistent login patterns and immediately restricting risky transactions while requesting additional authentication. Thus, the synergy between behavioral analytics and ZTA enhances an organization's ability to contain threats before major damage occurs.

## 2.6. Emerging trends and future directions

Recent trends in cybersecurity technology point toward promising improvements in Zero Trust Architecture, behavioral analytics, and automated threat segmentation. Notably, federated learning has gained attention for enhancing data privacy by allowing ML models to be trained across decentralized data sources without exposing raw data. Blockchain technology offers a decentralized, tamper-proof framework for managing access credentials and auditing activities [13]. Reinforcement learning presents an opportunity for dynamic, real-time policy optimization by allowing systems to adapt through continuous learning.

Despite these advances, significant computational challenges remain. Edge computing and hardware accelerators are being explored as solutions to distribute computational loads and enhance real-time responsiveness. Furthermore, successful adoption of these technologies requires close collaboration among cybersecurity professionals, data analysts, and organizational leaders to balance security needs with business and compliance requirements [14].

Table 5 summarizes key emerging trends and their associated advantages and challenges.

## 2.7. Comparison with related works

While Zero Trust Architecture (ZTA) have been widely studied, most existing implementations primarily rely on static access controls and traditional monitoring tools that lack dynamic adaptability. Systems such as basic User and Entity Behavior Analytics (UEBA) platforms focus on anomaly detection through historical data analysis but often suffer from high false positive rates and delayed responses.

In contrast, the proposed framework advances ZTA implementation by integrating AI-driven behavioral analytics, real-time context-aware

access control, and automated identity-based threat segmentation. Unlike conventional models that treat access permissions as static post-authentication, the proposed system continuously reassesses user behavior and environmental context to dynamically adjust permissions. Furthermore, the use of graph-based modeling for real-time identity isolation introduces a proactive mechanism to contain insider threats and lateral movements, a feature largely absent from previous works. Thus, by combining advanced Machine Learning techniques, context sensitivity, and automated segmentation strategies, the proposed framework offers a significant evolution beyond traditional ZTA and UEBA models, addressing critical gaps in responsiveness, scalability, and accuracy.

Recent advancements in ZTA for dynamic environments are highlighted in [15] and [16], where the authors propose machine learning-based segmentation and access control in mobile and vehicular systems. While effective in specialized domains, those frameworks focus on mobility contexts. In contrast, our proposed method generalizes to enterprise networks and emphasizes autonomous segmentation and adaptive risk evaluation.

# 3. Problem definition

Zero Trust Architecture (ZTA) face a critical weakness due to their heavy reliance on static access policies for managing dynamic and evolving cyber threats [17]. These predefined policies lack the adaptability necessary to respond to real-time variations in user behavior or emerging threat patterns. As a result, organizations frequently struggle to assess risks accurately and implement appropriate countermeasures, particularly in addressing insider threats, which continue to account for a significant portion of modern cybersecurity incidents.

A major limitation of current ZTA systems is the inability to analyze dynamic user behavior and generate corresponding risk scores. Without the capability to assess behavioral anomalies in real-time, organizations are unable to detect evolving threats at an early stage. Furthermore, the absence of adaptive frameworks prevents systems from factoring in contextual information—such as device trustworthiness, geographical access points, or active threat intelligence—thereby exposing critical assets to exploitation by malicious actors [18].

Another significant shortcoming lies in the lack of automated containment mechanisms for compromised identities. In complex, large-scale networks, once an adversary gains access, the inability to restrict lateral movement across the network greatly increases the likelihood of catastrophic breaches [19]. This allows malicious actors to escalate privileges, exfiltrate data, or disrupt operations before detection occurs.

To address these gaps, this study proposes an autonomous, identity-based threat segmentation framework that integrates AI-driven behavioral analytics with context-aware access control mechanisms. The goal is to dynamically assess risks, adjust permissions in real time, and automate the containment of potential threats. By overcoming the rigidity of static policies, this framework seeks to substantially enhance the resilience of ZTA deployments against sophisticated and innovative attack vectors, thus better securing organizational assets in an increasingly hostile cyber environment.

# 4. Research agenda

This research aims to develop a novel AI-driven system that strengthens Zero Trust Architecture by incorporating dynamic behavioral risk assessment and automated threat segmentation mechanisms. The central
<table><caption>**Table 5**
Emerging trends in ZTA.</caption><thead><tr><td>Emerging Trends</td><td>Advantages</td><td>Challenges</td></tr></thead><tbody><tr><td>Federated Learning</td><td>Enhances data privacy</td><td>Requires sophisticated infrastructure</td></tr><tr><td>Blockchain</td><td>Decentralized, tamper-proof management</td><td>Scalability issues</td></tr><tr><td>Reinforcement Learning</td><td>Dynamic, real-time optimization</td><td>Computationally intensive</td></tr></tbody></table>

objective is to build Machine Learning (ML) models capable of supporting context-aware access control, enabling real-time permission adjustments based on factors such as device trust levels, geolocation, time-based risk profiles, and ongoing threat intelligence.

A secondary but equally important objective focuses on enhancing network resilience by automating threat segmentation. By rapidly identifying and isolating compromised identities, the proposed system seeks to minimize lateral movement within the network, thereby reducing the risk of widespread breaches.

To realize these objectives, the methodology will involve collecting login and access behavior data from enterprise environments. Both supervised and unsupervised ML algorithms will be employed to train models capable of detecting anomalous behaviors and inferring contextual risk profiles. Model performance will be assessed based on key metrics, including detection accuracy, false positive rate, and response time, under simulated real-world conditions. These capabilities align with the operational needs of critical industries that require fine-grained, context-aware access control — including banking, defense, and cloud-native enterprise platforms.

A practical application scenario for the system is envisioned within global office environments. In this context, user activities will be continuously monitored, with access permissions dynamically adjusted based on risk assessments. Should any anomalous activity indicative of identity compromise be detected, the system will immediately quarantine the affected account to prevent threat propagation. In doing so, the proposed solution is expected to substantially enhance the resilience of ZTA frameworks against sophisticated insider threats and emerging cyber attack strategies.

# 5. Methods and discussion

This section details the system's design and operational components. It introduces the autonomous identity risk modeling, contextual scoring techniques, and dynamic segmentation processes that underpin the proposed framework.

## 5.1. Behavioral analytics and risk scoring

One of the core innovations proposed in this research is the use of Artificial Intelligence (AI) for behavioral analytics. The system analyzes historical login and access data, stripped of personally identifiable information, to detect irregularities in user patterns that could indicate security threats. AI models are trained on extensive datasets to capture normal behavioral baselines, allowing for the real-time detection of deviations.

### 5.1.1. AI algorithms for behavioral analytics

This research utilizes Random Forest and Gradient Boosting algorithms to detect anomalous activities based on past behavior patterns [20]. Random Forest operates by aggregating predictions from an ensemble of decision trees, making it particularly adept at modeling complex, non-linear relationships in behavioral data. Gradient Boosting, on the other hand, builds decision trees sequentially, each iteration focusing on minimizing the errors of its predecessor, thereby achieving higher accuracy in detecting subtle anomalies.

In addition to supervised models, unsupervised clustering techniques such as K-means are incorporated to group users exhibiting similar behavior. Users deviating significantly from their cluster norms are flagged

as potential anomalies, highlighting both external attacks and insider threats.

Training of these models involves the extraction of key features from user activity logs, including login time, login frequency, device type, geolocation, IP reputation scores, and resource access patterns. Feature selection is performed using Recursive Feature Elimination (RFE), and hyperparameters are tuned using cross-validation to optimize detection performance while minimizing false positives.

### 5.1.2. Risk scoring formula

To quantify the risk associated with each access attempt, a risk scoring model is proposed. The overall risk score $R$ is calculated using Eq. 2:

$$ \text{Risk Score} = w_1 \times A + w_2 \times C \quad (2) $$

Where:

* A represents the anomaly score, quantifying deviations from normal activity, such as unexpected login times or locations.

* C represents the contextual score, which evaluates the contextual factors of the access, such as the location, device trust level, and whether the login attempt is from a recognized IP address.

* $w_1$ and $w_2$ are weighting factors determining the relative importance of anomaly and contextual scores in the overall risk assessment.

The anomaly score $A$ is computed using the Mahalanobis distance, a multivariate metric that assesses how far a point lies from a reference distribution of normal behavior. The contextual score $C$ is aggregated from normalized metrics based on device type risk, location reputation, and access time anomalies.

The weighting factors $w_1$ and $w_2$ are calibrated through a combination of expert domain knowledge and empirical tuning using grid search on validation datasets. This ensures that the risk model appropriately prioritizes behavioral anomalies or contextual indicators depending on the operational environment. Thresholds $T$ are then established such that if $R > T$, automated mitigation actions such as identity isolation are triggered.

## 5.2. Context-aware access control

Context-aware access control mechanisms are integrated into the proposed system to dynamically adjust access permissions in real time. Access decisions are no longer solely based on user credentials but are influenced by multiple contextual parameters, such as device health, geolocation, connection time, and current threat intelligence.

For instance, a user attempting access from a trusted corporate device during standard working hours from an approved network will face minimal friction. Conversely, access attempts from unknown devices, suspicious locations, or during anomalous hours will be subjected to enhanced verification steps or partial access restrictions, ensuring timely responses without hampering legitimate activities.

## 5.3. Dynamic permission adjustments

Traditional ZTA implementations treat user authorization as static after initial login. The proposed system addresses this limitation by enabling continuous dynamic permission adjustments based on real-time threat assessments.
<table><caption>**Table 6**

Comparative evaluation of static rules versus proposed dynamic system.</caption><thead><tr><td>Metric</td><td>Baseline Static Rules</td><td>Proposed Dynamic System</td></tr></thead><tbody><tr><td>Response Time</td><td>~15 min (manual)</td><td>Real-Time (&lt;1 s)</td></tr><tr><td>Detection Accuracy</td><td>79.4 %</td><td>92.7 %</td></tr><tr><td>False Positive Rate</td><td>14.8 %</td><td>6.3 %</td></tr></tbody></table>

When a user's risk score surpasses a predefined threshold, additional security controls, such as requiring Multi-Factor Authentication (MFA) or limiting access to sensitive data, are dynamically activated. For example, if threat intelligence indicates that a particular IP range is under attack, the system can restrict access attempts originating from that region [18]. Such dynamic adaptations prevent threat actors from exploiting previously authenticated sessions.

## 5.4. Automated threat segmentation

The system's automated threat segmentation capability isolates compromised identities based on detected anomalous behaviors. This approach prevents lateral movement across networks, a common tactic used by attackers post-infiltration

### 5.4.1. Graph-based models for threat segmentation

The segmentation mechanism employs graph-based models where users are represented as nodes and access relationships (to resources, systems, or other users) as edges [21]. When anomalous behavior is detected, the affected node is flagged and disconnected from critical network segments by severing its edges. This rapid isolation minimizes the attacker's ability to escalate privileges or spread laterally.

For example, if a user simultaneously initiates sessions from geographically disparate regions an anomaly indicating potential credential theft, the system immediately quarantines the user's account and triggers containment workflows. Persistent suspicious activity can escalate responses, including full network segmentation or device isolation.

## 5.5. Performance comparison

To evaluate the effectiveness of the proposed dynamic system, its performance was validated through experimental simulation against a traditional static rules-based system. The comparison considered three critical metrics: detection accuracy, false positive rate, and response time. The results are summarized in Table 6.

Static policy frameworks generally rely on manually coded rules or delayed log reviews, leading to slower threat response and lower detection accuracy. The proposed AI-driven system, in contrast, processes behavioral and contextual signals in real time, achieving superior responsiveness and threat detection efficiency.

**Response Time:** Static policies require manual analysis that typically delays reaction by several minutes or longer. The dynamic system mitigates threats automatically within seconds based on real-time scoring.

**Detection Accuracy:** Traditional systems fail to detect complex or evolving threats efficiently, resulting in moderate detection rates. The proposed solution improves detection accuracy to over 92%, enabling earlier and more reliable threat identification.

**False Positives:** Static systems exhibit high false positive rates due to lack of contextual awareness. By integrating behavioral analytics and contextual data, the proposed system reduces false positives by more than half.

## 5.6. Constraints and challenges

While the proposed approach offers substantial improvements over traditional ZTA systems, several challenges must be addressed for successful implementation.

### 5.6.1. Privacy concerns

The collection and analysis of user behavioral data raise potential privacy concerns, as sensitive or personally identifiable information could inadvertently be processed [22]. To mitigate these risks, the system applies data anonymization techniques to strip personal identifiers from datasets before analysis. Compliance with major data protection regulations such as GDPR and CCPA is strictly enforced, and users are notified about data collection policies as part of system governance.

Additionally, the future integration of federated learning techniques is considered to further enhance data privacy by enabling decentralized model training without transferring raw data across nodes.

### 5.6.2. Scalability

Ensuring scalability to accommodate the needs of large and distributed enterprises remains a critical concern. Real-time behavioral analysis at scale requires significant computational resources and efficient data handling. The proposed system addresses this by leveraging cloud-based elastic infrastructure, distributed Machine Learning frameworks, and data streaming platforms that enable horizontal scaling based on user load and data volume fluctuations.

### 5.6.3. False positives

Despite model optimization efforts, occasional false positives are an unavoidable aspect of any anomaly detection system. Legitimate user activities may sometimes be flagged as suspicious. To address this, the system employs continuous model retraining based on feedback loops from incident reviews and user reports. Iterative learning helps fine-tune model thresholds and feature weights, thereby progressively improving precision without compromising recall.

## 6. Experiments and validation

To validate the proposed system, a simulated enterprise environment was constructed, reflecting typical user behaviors and insider threat scenarios. Approximately 10,000 user sessions were generated, covering both standard activities and anomalous access patterns, such as irregular login times, untrusted devices, and unfamiliar geolocations. Supervised Machine Learning models, including Random Forest and Gradient Boosting, as well as unsupervised clustering (K-means), were trained and tested using a 70/30 train-test split. Feature selection was performed using Recursive Feature Elimination (RFE), and hyperparameters were optimized through grid search.

The evaluation focused on three key performance metrics: detection accuracy, false positive rate (FPR), and response time. As summarized in Table 6, the dynamic system demonstrated superior performance compared to traditional static rule-based systems. Detection accuracy exceeded 92%, while the false positive rate was reduced to 6.3%. Furthermore, the system achieved real-time response capabilities, significantly outperforming the baseline system's delayed manual interventions.

These results confirm that the proposed AI-augmented dynamic framework can effectively enhance the responsiveness, accuracy, and reliability of Zero Trust Architecture, while also mitigating some of the limitations associated with traditional security policies.

### 6.1. Future trends

This section explores emerging technologies and directions that may enhance the proposed framework. The following subsections examine the roles of federated learning, quantum computing, and blockchain in future Zero Trust implementations.

Zero Trust Architecture (ZTA) continues to evolve rapidly, driven by the escalating sophistication of cyber threats and the advent of transformative technologies [23]. Future innovations are expected to enhance ZTA's security, adaptability, and effectiveness by addressing current limitations in scalability, privacy, and real-time responsiveness.
<figure><img src="image_7.png" /><figcaption>Fig. 3. Zero Trust Principles Integrated with Blockchain.</figcaption></figure>

## 6.2. Federated learning

Federated learning represents a paradigm shift in Machine Learning by enabling decentralized model training across multiple data sources without requiring the transfer of raw data to a central repository. Within the ZTA framework, federated learning can significantly improve behavioral analytics and risk-scoring models while safeguarding user privacy [24]. By ensuring that sensitive data remains localized, federated learning supports compliance with data protection regulations such as GDPR and CCPA. Moreover, this distributed learning approach minimizes the exposure risk associated with centralized data aggregation and enhances the practical applicability of dynamic access control systems in ZTA environments.

## 6.3. Quantum computing

Quantum computing is poised to revolutionize cybersecurity by exponentially increasing computational power and accelerating problem-solving capabilities [25]. In the context of ZTA, quantum computing can enable the real-time analysis of complex behavioral patterns and threat vectors that classical computing struggles to process efficiently. Furthermore, quantum algorithms could significantly strengthen cryptographic mechanisms underpinning identity verification and access control. As quantum computing technology matures, its integration into ZTA frameworks could substantially reduce the response time to sophisticated cyber attacks and reinforce the overall security infrastructure.

## 6.4. Blockchain

Blockchain technology offers promising enhancements for identity verification and access management in Zero Trust Architecture [26]. By providing a decentralized and immutable ledger, blockchain ensures that identity transactions and access requests are transparent, tamper-proof, and resilient against forgery. Integration of smart contracts can further automate access control policies, ensuring that permissions are enforced dynamically based on pre-defined security conditions. Through the implementation of blockchain mechanisms, organizations can strengthen authentication processes, reduce the risk of credential compromise, and increase the auditability of access activities. Fig. 3 illustrates the integration of ZTA principles with blockchain frameworks.

# 7. Conclusion

This research addresses the inherent limitations of traditional Zero Trust Architecture (ZTA) frameworks and proposes an AI-enhanced approach that incorporates dynamic identity segmentation, behavioral analytics, and context-aware access control to strengthen cybersecurity defenses. Conventional ZTA systems often rely on static access policies that

do not adequately respond to dynamic user behaviors or the emergence of sophisticated threats. Such static architectures are particularly vulnerable to insider threats and advanced persistent attacks that can exploit rigid access mechanisms.

The proposed framework integrates behavioral analysis with real-time context evaluation, enabling dynamic risk scoring and automated threat containment. By adjusting permissions adaptively and isolating compromised identities, the system improves organizational resilience while minimizing disruptions to legitimate user activities. Experimental validation demonstrates that the system enhances detection accuracy, reduces false positive rates, and achieves real-time threat mitigation, confirming its potential to augment traditional ZTA deployments effectively.

Nevertheless, challenges remain in implementing this framework at scale, particularly concerning privacy risks and computational demands. Analyzing behavioral data inherently raises privacy concerns, necessitating strong anonymization, compliance with regulations such as GDPR, and possible adoption of privacy-preserving technologies like federated learning. Scalability also requires strategic solutions, such as leveraging elastic cloud resources and distributed computing infrastructures to handle growing data volumes efficiently.

Looking ahead, future research should focus on the integration of emerging technologies such as federated learning and blockchain into ZTA frameworks. Federated learning can enable decentralized model training, preserving data privacy while improving model robustness. Blockchain technology offers an immutable and decentralized foundation for identity verification and access management. Together, these technologies hold the potential to advance the adaptability, resilience, and trustworthiness of Zero Trust Architecture, equipping organizations to counter increasingly complex and dynamic cyber threats.

# Declaration of competing interest

The authors declare that they have no known competing financial interests or personal relationships that could have appeared to influence the work reported in this paper.

# CRediT authorship contribution statement

**Sina Ahmadi:** Writing – review & editing, Writing – original draft, Visualization, Validation, Project administration, Methodology, Formal analysis, Conceptualization.

# References

[1] W.S. Admass, Y.Y. Munaye, A.A. Diro, Cyber security: State of the art, challenges and future directions, Cyber Secur. Appl. 2 (2024) 100031.

[2] R. Heartfield, G. Loukas, A. Bezemskij, E. Panaousis, Self-configurable cyber-physical intrusion detection for smart homes using reinforcement learning, IEEE Trans. Inf. Forensics Secur. 16 (2020) 1720-1735.

[3] A. Ahmad, J. Webb, K.C. Desouza, J. Boorman, Strategically-motivated advanced persistent threat: definition, process, tactics and a disinformation model of counter-attack, Comput. Secur. 86 (2019) 402-418.

[4] N.I. Roslan, N.T. Mazman, N.F.A. Johari, Zero trust architecture: a paradigm shift in network security, Authorea Prepr. (2024) 56.

[5] N.F. Syed, S.W. Shah, A. Shaghaghi, A. Anwar, Z. Baig, R. Doss, Zero trust architecture (ZTA): A comprehensive survey, IEEE Access 10 (2022) 57143-57179.

[6] R.K. Mohanty, A.P. Kumar, R. Padmaja, V. Prashanthi, Deep Learning for analyzing user and entity behaviors: techniques and applications, Consum. Organ. Behav. Age AI (2024) 219-250.

[7] D.S. David, M. Anam, C. Kaliappan, S. Selvi, D.K. Sharma, P. Dadheech, S. Sengan, Cloud security service for identifying unauthorized user behaviour, Comput. Mater. Contin. 70 (2) (2022) 82.

[8] A.B. Haque, B. Bhushan, G. Dhiman, Conceptualizing smart city applications: requirements, architecture, security issues, and emerging trends, Expert Syst. 39 (5) (2022) e12753.

[9] Venne, S.; Clarkson, T.; Bennett, E.; Fischer, G.; Bakker, O.; Callaghan, R. Automated ransomware detection using pattern-entropy segmentation analysis: A novel approach to network security. 2024.

[10] S. Amendola, V. Spensieri, G.S. Biuso, R. Cerutti, The relationship between maladaptive personality functioning and problematic technology use in adolescence: A cluster analysis approach, Scand. J. Psychol. 61 (6) (2020) 809-818.
[11] H. Sharma, Behavioral analytics and zero trust, Int. J. Comput. Eng. Technol. 12 (1) (2021) 63–84.

[12] M.A. Salamkar, K. Allam, Data integration techniques: exploring tools and methodologies for harmonizing data across diverse systems and sources, Distrib. Learn. Broad Appl. Sci. Res. (2020) 87.

[13] Y. Wang, J. Li, Y. Yan, X. Chen, F. Yu, S. Zhao, K. Feng, A semi-centralized blockchain system with multi-chain for auditing communications of Wide Area Protection System, PLOS ONE 16 (1) (2021) e0245560.

[14] G. Culot, F. Fattori, M. Podrecca, M. Sartor, Addressing industry 4.0 cybersecurity challenges, IEEE Eng. Manag. Rev. 47 (3) (2019) 79–86.

[15] H. Zhang et al., "Adaptive access control in connected vehicles using federated zero trust architecture," *IEEE Transactions on Intelligent Transportation Systems*, doi: 10.1109/TITS.2024.3443171.

[16] M. Liu and X. Chen, "Machine learning-driven zero trust for vehicular networks," *IEEE Transactions on Intelligent Transportation Systems*, doi: 10.1109/TITS.2023.3271110.

[17] N. Nahar, K. Andersson, O. Schelén, S. Saguna, A survey on zero trust architecture: applications and challenges of 6G networks, IEEE Access (2024) 88.

[18] R. Kalaria, A.S.M. Kayes, W. Rahayu, E. Pardede, A. Salehi Shahraki, Adaptive context-aware access control for IoT environments leveraging fog computing, Int. J. Inf. Secur. 23 (4) (2024) 3089–3107.

[19] A. Alshamrani, S. Myneni, A. Chowdhary, D. Huang, A survey on Advanced Persistent Threats: techniques, solutions, challenges, and research opportunities, IEEE Commun. Surv. Tutor. 21 (2) (2019) 1851–1877.

[20] M. Douiba, S. Benkirane, A. Guezzaz, M. Azrour, Anomaly detection model based on gradient boosting and decision tree for IoT environments security, J. Reliab. Intell. Environ. 9 (4) (2023) 421–432.

[21] W. Cui, X. He, M. Yao, Z. Wang, Y. Hao, J. Li, W. Cui, Knowledge and spatial pyramid distance-based gated graph attention network for remote sensing semantic segmentation, Remote Sens. 13 (7) (2021) 1312.

[22] H. Nissenbaum, Protecting privacy in an information age: the problem of privacy in public, Ethics Inf. Technol. (2020) 141–178.

[23] L. Alevizos, V.T. Ta, M. Hashem Eiza, Augmenting zero trust architecture to endpoints using blockchain: a state-of-the-art review, Secur. Priv. 5 (1) (2022) e191.

[24] M. Hussain, S. Pal, Z. Jadidi, E. Foo, S. Kanhere, Federated Zero Trust Architecture using artificial Intelligence, IEEE Wirel. Commun. 31 (2) (2024) 30–35.

[25] M. Alauthman, A. Almomani, A. Al-Qerem, M.A. Al Khaldy, A. Aldweesh, A.Y. Al Maqousi, M. Alkasassbeh, Quantum computing for cybersecurity: A comparative study of classical and quantum techniques, Innov. Mod. Cryptogr. (2024) 75–99.

[26] A. Gupta, H.U. Khan, S. Nazir, M. Shafiq, M. Shabaz, Metaverse security: issues, challenges and a viable ZTA model, Electronics 12 (2) (2023) 391.