Method of dynamic trust assessment in Zero Trust Architecture based on explainable artificial intelligence Метод динамічного оцінювання довіри в архітектурі Zero Trust на основі пояснювального штучного інтелекту

Abstract

The transformation of contemporary corporate IT infrastructures has rendered conventional cybersecurity models ineffective, prompting a shift to the Zero Trust Architecture (ZTA); however, its practical implementation is complicated by a rigid reliance on static access control rules. The purpose of this study was to develop an innovative method for dynamic trust assessment in the ZTA that effectively combines the high accuracy of automated network anomaly detection with decision-making transparency. To calculate a continuous trust score based on a simulated corporate network traffic dataset, the Extreme Gradient Boosting ensemble machine learning algorithm was applied, while the SHapley Additive exPlanations (SHAP) additive explanations method was used to explain the generated decisions. Experimental verification demonstrated the high effectiveness of the proposed Policy Engine, which achieved an F1-score of 1.00 on the test set. The model successfully distinguished legitimate anomalous requests with a zero false-positive rate, identifying cyberattacks such as privilege escalation and access atypical locations. Global feature importance analysis using the SHAP framework confirmed that the type of network connection and device security status are the most significant risk predictors, which fully aligns with the core principles of ZTA. Furthermore, local analysis proved the system’s ability to instantly generate detailed, human-readable text explanations for each access denial, indicating the specific reason for blocking. Due to this level of detail, analysts can directly understand the triggering logic of automated defence systems without the need for time-consuming manual correlation of disparate event logs. The practical significance of the study lies in the creation of a transparent and adaptive tool that can be integrated into modern Security Operations Centres to significantly reduce “alert fatigue” and minimise the Mean Time to Resolution.