LLM-Assisted Zero-Trust Policy Generation: A Dynamic Approach Integrating SBOM and Runtime Telemetry for Microservices
Year: 2026
Type: article
Abstract: The rapid proliferation of cloud-native architectures has fundamentally transformed application deployment, shifting paradigms from monolithic structures to highly distributed microservices. This architectural evolution introduces significant security challenges, primarily due to the explosion of east-west network traffic and the complex web of software supply chain dependencies. Traditional perimeter-based security models are wholly inadequate in these environments, necessitating the adoption of Zero-Trust Architecture. However, manually crafting and maintaining zero-trust policies for highly dynamic microservices is operationally prohibitive and prone to human error. In this paper, we propose a novel framework that leverages Large Language Models to automatically generate and dynamically update zero-trust network and system policies. Our approach uniquely integrates static vulnerability data derived from Software Bill of Materials with real-time behavioral insights captured through eBPF-based runtime telemetry. By serializing this multimodal data into a comprehensive structural prompt, the Large Language Model acts as a cognitive policy engine, reasoning over both known software vulnerabilities and emergent anomalous runtime behaviors. We introduce a comprehensive system architecture, formalize the policy optimization problem, and deploy an open-source prototype in a simulated Kubernetes environment. Experimental evaluations against static policy baselines and heuristic intrusion detection systems demonstrate that our dynamic approach significantly enhances policy precision and recall while minimizing false positives. Furthermore, the integration of runtime telemetry reduces the latency of isolating compromised workloads during active exploitation scenarios, proving the efficacy of combining deterministic supply chain data with stochastic runtime observations for autonomous security operations.
Source: American Journal Of Big Data
DOI: 10.71465/ajbd3656
Author: Daoquan Zhou
Institution: New England College
Language: English
Subfield: Computer Networks and Communications
Field: Computer Science
Domain: Physical Sciences
Open Access status: hybrid
OpenAlex ID: W7148628079