Neural Risk-Aware Access Control: A Behavior-Context Hybrid Framework for Adaptive Authorization in Dynamic Environments
محورهای موضوعی : Communication Systems & Devices
Donya Piriaei
1
,
Afshin Rezakhani
2
,
حمید حاج سید جوادی
3
,
Leila Rikhtechi
4
1 - Department of Computer Engineering, Bo.C., Islamic Azad University, Borujerd, Iran
2 - Ayatollah Boroujerdi University
3 - دانشگاه شاهد
4 - Department of Computer Engineering, Bo.C., Islamic Azad University, Borujerd, Iran
کلید واژه: Risk-Adaptive Access Control, Attribute-Based Access Control (ABAC), Temporal Behavior Modeling, Attention-based Temporal Unit (ATU), Contextual Scoring Module (CSM), Real-time Risk Assessment,
چکیده مقاله :
We present a risk-adaptive access control framework that integrates dynamic behavioral modeling with Attribute-Based Access Control (ABAC) to enable real-time decision-making in volatile and high-risk environments. The proposed system introduces two novel components: the Attention-based Temporal Unit (ATU) for capturing sequential access behaviors, and the Contextual Scoring Module (CSM) for quantifying contextual and environmental signals. Risk is estimated via a multi-dimensional function that combines behavioral patterns, device and location attributes, and real-time threat indicators. An adaptive decision threshold, continuously refined based on false-accept and false-reject outcomes, ensures a calibrated balance between security and operational usability. Computed risk scores are seamlessly embedded into ABAC policies to support fine-grained enforcement. Evaluation on four domain-relevant datasets—Login Data Set for Risk-Based Authentication (RBA), CERT Insider Threat Test Dataset, CIC-IDS2017, and RT-IoT2022—used to emulate access control scenarios, shows F1-scores up to 0.95 and precision up to 0.94, outperforming strong baselines by up to 12%. The results demonstrate robustness across authentication, insider threat, intrusion, and IoT domains, supporting the framework’s applicability in real-time, risk-aware access systems for wireless communication and IoT environments, particularly in emerging 5G/6G contexts.
[1] V. C. Hu, D. Ferraiolo, R. Kuhn, A. R. Friedman, A. J. Lang, M. M. Cogdell, and K. Scarfone, Guide to Attribute-Based Access Control (ABAC): Definition and Considerations, NIST Special Publication 800-162, Jan. 2014. [Online]. Available: https://doi.org/10.6028/NIST.SP.800-162
[2] C. Greer, A. Ahuja, J. Boynes, and D. Steinberg, Cybersecurity Framework for Access Control Systems, NISTIR 7316, National Institute of Standards and Technology, Feb. 2019. [Online]. Available: https://csrc.nist.gov/publications/detail/nistir/7316/final
[3] R. Sandhu, “Risk-Adaptive Access Control (RAdAC) Overview,” presented at NIST Privilege Management Workshop, Jul. 2009. [Online]. Available: https://csrc.nist.gov/csrc/media/events/privilege-management-workshop/documents/radac-paper0001.pdf
[4] A. Shewalkar, “Performance evaluation of deep neural networks applied to speech recognition: RNN, LSTM, and GRU,” J. Artif. Intell. Soft Comput. Res., vol. 9, 2019.
[5] F. M. Shiri, T. Perumal, N. Mustapha, and R. Mohamed, “A comprehensive overview and comparative analysis on deep learning models: CNN, RNN, LSTM, GRU,” arXiv preprint, arXiv:2305.17473, 2023.
[6] S. Nosouhian, F. Nosouhian, and A. K. Khoshouei, “A review of recurrent neural network architecture for sequence learning: Comparison between LSTM and GRU,” arXiv preprint, arXiv:2109.12939, 2021.
[7] S. Savinov, “A dynamic risk-based access control approach: model and implementation,” M.Sc. thesis, Norwegian Univ. of Sci. and Technol. (NTNU), Trondheim, Norway, 2017.
[8] Y. Zhang, “A novel extreme adaptive GRU for multivariate time series forecasting,” Sci. Rep., vol. 14, no. 1, p. 2991, 2024, doi: 10.1038/s41598-024-19298-z.
[9] M. E. Islam, “User authentication and access control to blockchain-based forensic log data,” EURASIP J. Inf. Secur., vol. 2023, no. 1, p. 7, 2023.
[10] B. Ilyas, “Blockchain-enabled IoT access control model for sharing electronic healthcare data,” Multimed. Tools Appl., pp. 1–22, Apr. 2024, doi: 10.1007/s11042-024-18021-7.
[11] S. Ranga and M. N. Guptha, “Log anomaly detection using sequential convolution neural networks and Dual-LSTM model,” SN Comput. Sci., vol. 4, no. 3, p. 256, 2023.
[12] Y. Ensafi, “Time-series forecasting of seasonal items sales using machine learning–A comparative analysis,” Int. J. Inf. Manage. Data Insights, vol. 2, no. 1, p. 100058, 2022.
[13] S. Bhatt and R. Sandhu, “ABAC-CC: Attribute-based access control and communication control for Internet of Things,” in Proc. 25th ACM Symp. Access Control Models Technol., 2020, pp. 175–186.
[14] N. Ayman, “Policy-based role and access modeling,” in Proc. 2023 IEEE 12th Int. Conf. Intell. Data Acquis. Adv. Comput. Syst., vol. 1, pp. 210–215, 2023.
[15] C. Mazzocca, “FRAMH: A Federated Learning Risk-Based Authorization Middleware for Healthcare,” IEEE Trans. Comput. Soc. Syst., early access, 2022.
[16] K. Ma, G. Yang, and Y. Xiang, “RCBAC: A risk-aware content-based access control model for large-scale text data,” J. Netw. Comput. Appl., vol. 167, p. 102733, 2020.
[17] R. Jiang, “Risk and UCON-based access control model for healthcare big data,” J. Big Data, vol. 10, no. 1, p. 104, 2023.
[18] S. Ksibi, F. Jaidi, and A. Bouhoula, “A comprehensive study of security and cyber-security risk management within e-Health systems,” Mobile Netw. Appl., vol. 28, no. 1, pp. 107–127, 2023.
[19] D. Sheng, J. Cao, C. Li, K. Fan, and H. Li, “A novel attribute-based access control scheme using blockchain for IoT,” IEEE Access, vol. 7, pp. 38431–38441, 2019.
[20] G. D. Putra, “Trust-based blockchain authorization for IoT,” IEEE Trans. Netw. Serv. Manag., vol. 18, no. 2, pp. 1646–1658, 2021.
[21] N. AlRT-IoT2022be, “An access control model based on system security risk for dynamic sensitive data storage in the cloud,” Appl. Sci., vol. 13, no. 5, p. 3187, 2023.
[22] Y. Zhang, “An attribute-based collaborative access control scheme using blockchain for IoT devices,” Electronics, vol. 9, no. 2, p. 285, 2020.
[23] X. Ma, C. Wang, and X. Chen, “Trusted data sharing with flexible access control based on blockchain,” Comput. Stand. Interfaces, vol. 78, p. 103543, 2021.
[24] S. O. Ganiyu and R. G. Jimoh, “Extended risk-based context-aware model for dynamic access control in BYOD strategy,” in Machine Learning and Data Mining for Emerging Trend in Cyber Dynamics, pp. 295–315, 2021.
[25] H. F. Atlam and G. B. Wills, “An efficient security risk estimation technique for risk-based access control model for IoT,” Internet Things, vol. 6, p. 100049, 2019.
[26] M. B. Aliyu, “Dynamic access control at the network edge using an adaptive risk-based access control system (ad-RACs),” J. Theor. Appl. Inf. Technol., vol. 102, no. 3, pp. 366–376, 2024.
[27] K. Ma and G. Yang, “RTBAC: A Risk-Aware Topic-Based Access Control Model for Text Data with Paragraph-Level Authorization,” Secur. Commun. Netw., vol. 2022, Art. no. 2233210, 2022.
[28] R. Trabelsi, G. Fersi, and M. Jmaiel, “Access control in Internet of Things: A survey,” Comput. Secur., vol. 135, p. 103472, 2023.
[29] S. A. Mansouri, “A risk-based bi-level bidding system to manage day-ahead electricity market,” in Proc. 2022 IEEE Conf. Environ. Electr. Eng., pp. 1–6, 2022.
[30] H. F. Atlam and G. B. Wills, “ANFIS for risk estimation in risk-based access control model for smart homes,” Internet Things, under review, 2022.
[31] P. L. Seabe, C. R. B. Moutsinga, and E. Pindza, “Forecasting cryptocurrency prices using LSTM, GRU, and bi-directional LSTM,” Fractal Fract., vol. 7, no. 2, p. 203, 2023.
[32] N. Malkin, “Optimistic access control for the smart home,” in Proc. 2023 IEEE Symp. Secur. Priv., 2023.
[33] N. Mohammadi, “A new risk-based decentralized model for peer-to-peer energy trading,” Int. J. Ind. Electron. Control Optim., vol. 5, no. 3, pp. 231–240, 2022.
[34] A. J. Akbarfam et al., “DLACB: Deep learning-based access control using blockchain,” arXiv preprint, arXiv:2303.14758, 2023.
[35] M. R. Raza, W. Hussain, and M. Rajaeian, “Analysing trust, security and cost of cloud consumer’s reviews using RNN, LSTM, and GRU,” in Advances in Complex Decision Making, pp. 52–65, 2023.
[36] R. Jiang, “A medical big data access control model based on fuzzy trust prediction and regression analysis,” Appl. Soft Comput., vol. 117, p. 108423, 2022.
[37] K. Srivastava and N. Shekokar, “Machine learning-based risk-adaptive access control,” in Modern Approaches in Machine Learning and Cognitive Science, pp. 129–143, 2020.
[38] H. F. Atlam, “Risk-based access control model: A systematic literature review,” Future Internet, vol. 12, no. 6, p. 103, 2020.
[39] S. Athanere and R. Thakur, “Adaptive access control model using risk-based technique,” in AI and Sustainable Computing – ICSISCET, pp. 253–267, 2022.
[40] H. F. Atlam, “Fuzzy logic with expert judgment for adaptive risk-based access control in IoT,” Mob. Netw. Appl., vol. 27, pp. 1246–1258, 2022.
[41] K. Ragothaman, “Access control for IoT: A survey,” Sensors, vol. 23, no. 4, p. 1805, 2023.
[42] H. F. Atlam, M. A. Azad, and N. F. Fadhel, “Efficient NFS model for risk estimation in a risk-based access control model,” Sensors, vol. 22, no. 5, p. 2005, 2022.
[43] H. F. Atlam, “Validation of an adaptive risk-based access control model for IoT,” Int. J. Comput. Netw. Inf. Secur., vol. 12, no. 1, pp. 26–32, 2018.
[44] I. Lee, “Internet of Things (IoT) cybersecurity: Literature review and cyber risk management,” Future Internet, vol. 12, no. 9, p. 157, 2020.
[45] H. F. Atlam et al., “Developing an adaptive risk-based access control model for IoT,” in Proc. IEEE Conf. IoT, GreenCom, CPSCom, SmartData, pp. 733–740, 2017.
[46] M. A. Morid, O. R. L. Sheng, and J. Dunbar, “Time series prediction using deep learning methods in healthcare,” ACM Trans. Manag. Inf. Syst., vol. 14, no. 1, pp. 1–29, 2023.
[47] K. Thilagam et al., “Secure IoT healthcare architecture with deep learning-based access control system,” J. Nanomater., vol. 2022, Art. no. 2638613, 2022.
[48] A. Noury and M. Amini, “An access and inference control model for time series databases,” Future Gener. Comput. Syst., vol. 92, pp. 93–108, 2019.
[49] A. Outchakoucht, H. E. Samaali, and J. P. Leroy, “Dynamic access control policy based on blockchain and ML for IoT,” Int. J. Adv. Comput. Sci. Appl., vol. 8, no. 7, pp. 417–424, 2017.
[50] [50] N. B. Akhuseyinoglu and J. Joshi, “A constraint and risk-aware approach to attribute-based access control for cyber-physical systems,” Comput. Secur., vol. 96, p. 101802, 2020.
[51] R. Rathna, L. M. Gladence, J. S. Cynthia, and V. M. Anu, “Energy efficient cross layer MAC protocol for wireless sensor networks in remote area monitoring applications,” J. Inf. Syst. Telecommun., vol. 3, no. 35, pp. 207–215, 2021.
[52] L. Rikhtechi, V. Rafe, and A. Rezakhani, “Secured access control in security information and event management systems,” J. Inf. Syst. Telecommun., vol. 9, no. 33, pp. 67–78, 2021.
[53] L. Karimi, M. Aldairi, J. Joshi, and M. Abdelhakim, “An automatic attribute-based access control policy extraction from access logs,” IEEE Trans. Dependable Secure Comput., early access, 2021, doi: 10.1109/TDSC.2021.3054331.
[54] N. Mohammadi, A. Rezakhani, and H. Haj Seyyed Javadi, “FLHB-AC: Federated learning history-based access control using deep neural networks in healthcare system,” J. Inf. Syst. Telecommun., vol. 2, no. 46, pp. 90–100, 2024.
[55] H. Niu et al., “EHR-BERT: A BERT-based model for effective anomaly detection in electronic health records,” J. Biomed. Inform., vol. 150, p. 104605, 2024.
[56] A. J. Akbarfam et al., “Deep learning meets blockchain for automated and secure access control,” arXiv preprint, arXiv:2311.06236, 2023.
[57] D. Group, “Login Data Set for Risk-Based Authentication,” Kaggle, 2022. [Online]. Available: https://www.kaggle.com/datasets/dasgroup/rba-dataset
[58] CERT Division, Carnegie Mellon University, “Insider Threat Test Dataset,” 2016. DOI: 10.1184/R1/12841247.v1
[59] I. Sharafaldin et al., “Toward Generating a New Intrusion Detection Dataset and Intrusion Traffic CRT-IoT2022acterization,” ICISSp, 2018.
[60] B. S. & R. Nagapadma, “RT-IoT2022,” UCI Machine Learning Repository, 2023. DOI: 10.24432/C5P338
[61] Piriaei, D., Rezakhani, A., Haj Seyyed Javadi, H., & Rikhtechi, L. (2025). Real‐Time Risk‐Adaptive Access Control With DRCFM: A Scalable BERT‐LSTM‐GRU Framework for Secure Systems. Security and Privacy, 8(6), e70114.
