A Context-Aware ZTNA Framework with eBPF/XDP Policy Enforcement and Machine-Learning-Based Trust Evaluation for Campus Networks
Year: 2026
Type: article
Abstract: University networks host heterogeneous users, endpoints, access locations, and services, so access decisions cannot rely solely on identity information. This work proposes the Context-Aware Dynamic Trust Zero Trust Network Access (CADT-ZTNA) framework, integrating log-based risk classification with an eBPF/XDP-assisted policy enforcement design. We analyzed 113,964 campus security records collected over 30 days: 94,012 actor logs fed the supervised classifier, while 19,952 vendor logs were set aside for separate analysis. Using a chronological train–validation–test split, XGBoost reached a test ROC-AUC of 0.9808, AP of 0.8740 and F1 of 0.8892. Random Forest delivered marginally better ROC-AUC (0.9834) and AP (0.8887). Ablation results highlight the role of temporal behavioral features: removing the temporal feature group reduced ROC-AUC from 0.9808 to 0.9056 and AP from 0.8740 to 0.1869. Removing only user_time_gap reduced AP to 0.6849 and F1 to 0.7676. As 99.15% of positive samples are dormant-account login events, the reported classification performance reflects discrimination against these predefined operational security labels, rather than detection of independently verified real-world malicious activity.
Source: Applied Sciences
DOI: 10.3390/app162211157
Authors: Chen Liu, Ying Zhu, Xiaojuan Cai, Li Zhu
Institution: Xi'an Jiaotong University
Language: English
Subfield: Computer Networks and Communications
Field: Computer Science
Domain: Physical Sciences
Open Access status: gold
Estimated APC paid: $2,896
OpenAlex ID: W7225821215