A Multi-Source Event Correlation Framework for IAM Security Using Machine Learning and Zero Trust Principles
Year: 2026
Type: conference-paper
Abstract: Identity and Access Management (IAM) systems struggle to counter insider threats. With the increased use of the cloud and the difficulties posed by remote working, managing enterprise system activity logs is more complex. This makes it difficult to monitor behaviors within the system. This paper proposes a novel insider threat detection method that integrates sliding window behavior analytics, Extreme Gradient Boosting (XGBoost) detection, and Zero Trust risk Assessment (ZTA), all contained within a single system. This method frames time-based behavior with the application of risk-based access control. This is achieved by using the CERT dataset and covers user authentication, file access, e-mail, and web activity. The results demonstrate a notable level of accuracy of over 98.89%, with a precision of 99%, a recall of 96.5%, and a Receiver Operating Characteristic Area Under the Curve (ROC-AUC) of 0.9815, from a considerably large sample of close to 5 million records. Additionally, the method demonstrated an impressive level of generalization on the Los Alamos National Laboratory (LANL) Windows Logging Service dataset with an accuracy of 99.76% and an ROC-AUC of 99.82%. The experimental results substantiate the efficacy of the proposed framework for insider threat detection and Zero Trust-based IAM security enforcement in enterprise environments.
Language: English
Subfield: Computer Networks and Communications
Field: Computer Science
Domain: Physical Sciences
Open Access status: hybrid
OpenAlex ID: W7203633988