Abstract: Zero trust is a solution to the problem of fuzzy network boundaries and has been widely used in many access control methods. Most zerotrust access control methods only use statistical methods to calculate trust values, which has poor ability to prevent unknown risks and lacks adaptability to different users. A zerotrust access control method that applies behavior anomaly detection was proposed to solve those problems. The proposed method designed a trust engine that included a behavior anomaly detection strategy, which can use autoencoders and bidirectional long shortterm memory neural networks to characterize user behavior patterns. The proposed method used the mean square error loss function to describe the degree of abnormality in user behavior, and calculated the trust value together with other elements. The proposed method used abnormal behavior representation values to set trust thresholds and adaptively adjust access policies. The experimental results show that the proposed method is sensitive to the correlation between user behaviors. The proposed method can detect the abnormal behaviors and stop the authorization, which achieve  continuous trust evaluation and finegrained access control.

Key words: zero trust, access control, trust evaluation, bidirectional long shortterm memory neural network, anomaly detection

摘要： 零信任有效解决了网络边界模糊的问题，在多种访问控制方法中得到广泛应用.针对大部分零信任访问控制方法仅使用简单统计方法计算信任评分、防范未知风险能力较差、缺乏对不同用户的自适应能力的问题，提出了一种引入行为异常检测的零信任访问控制方法.该方法设计了一种结合行为异常检测策略的信任引擎，通过自编码器和双向长短期记忆神经网络的建模能力，表征用户的行为模式，利用均方误差损失函数计算异常行为表征值，同时融合其他要素计算信任评分.该方法利用异常行为表征值设定信任阈值，以自适应调整用户访问策略.实验结果表明，所提方法对用户行为间的关联敏感，能够识别用户的异常行为并阻止授权，实现持续评估、细粒度的访问控制.

关键词: 零信任, 访问控制, 信任评估, 长短期记忆神经网络, 异常检测