Developing a dynamic trust mechanism to protect web sessions in the ZeroTrust architecture

Abstract

This paper proposes a dynamic trust mechanism for web session protection, combining cryptographic and behavioral loops. The cryptographic loop ensures token validity, freshness, and non-portability, while the behavioral loop evaluates the current trajectory's compliance with a typical user scenario. The formal model of the mechanism includes requirements for token non-portability, reuse resistance, and trust continuity. The practical part is implemented as a prototype consisting of an authentication service, a risk assessment service, and a resource service. The behavioral loop utilizes an LSTM model trained on normal action sequences reconstructed from the CSIC 2010 dataset. Experimental validation is performed on two scenarios of session abuse: an automated bot attack and business logic bypass. The primary metric used is ROC-AUC, which reflects the model's ability to rank abnormal examples above normal ones without a fixed threshold. The experimental results show that the decisive factor for the proposed mechanism is the amount of context available to the model at the time of evaluation. In both scenarios, quality increases with increasing history length, but the depth of context required to reliably distinguish anomalies from norms differs: a shorter sequence is sufficient for automated behavior, while a longer history is required for bypassing business logic. Moreover, the impact of the hidden state size is significantly weaker. Therefore, the operation of the admission mechanism must rely on the accumulated session history as a mandatory part of the state, since evaluating an isolated request does not provide comparable reliability. Consequently, when implementing the proposed scheme, the length of the analyzed sequence becomes a critical operational parameter, and session trust must be recalculated as new actions accumulate.