Exploring ML Models for Effective Zero Trust Architecture (ZTA) in Cloud-Native Environments (CNEs) for Coarse-Grained Policies

Supervised machine learning models like XGBoost, Support Vector Machine can be used when labelled datasets exists and are effective in detecting known attacks like DoS, R2L, U2R and probe based ZTA attacks. They could classify malicious pod-to-pod traffic and can detect API misuse but, they cannot detect novel attack effectively. Unsupervised learning models like K-Means clustering and isolation forest can detect anomalies in dynamic CNE traffic. They are very suitable for Zero Trust Adaptive models which can identify lateral movement, detect privilege escalation attempts and can also detect unusual service -to-service communications. Deep Autoencoders and Variational Autoencoders that are semi supervised models can be trained on normal behavior only and are suitable for Kubernetes traffic baselining. Reinforcement learning mechanism could enable ZTA [1] for better dynamic policy tuning. However, these models are very difficult to understand and lack of comprehension builds distrust hindering effective use of the system.