Neural Risk-Adaptive Access Control: A Behavior-Context Hybrid Framework for Adaptive Authorization in Dynamic Environments
Subject Areas : Communication Systems & Devices
Donya Piriaei
1
,
Afshin Rezakhani
2
*
,
Hamid Haj Seyyed Javadi
3
,
Leila Rikhtechi
4
1 - Department of Computer Engineering, Bo. C., Islamic Azad University, Borujerd, Iran
2 - Department of Computer Engineering, Faculty of Engineering, Ayatollah Boroujerdi University, Borujerd, Iran
3 - Department of Computer Engineering, Shahed University, Tehran, Iran
4 - Department of Computer Engineering, Bo. C., Islamic Azad University, Borujerd, Iran
Keywords: Risk-Adaptive Access Control, Attribute-Based Access Control (ABAC), Temporal Behavior Modeling, Attention-based Temporal Unit (ATU), Contextual Scoring Module (CSM), Real-Time Risk Assessment, Intrusion Detection Datasets,
Abstract :
We present a risk-adaptive access control framework that integrates dynamic behavioral modeling with Attribute-Based Access Control (ABAC) to enable real-time decision-making in volatile and high-risk environments. The proposed system introduces two novel components: the Attention-based Temporal Unit (ATU) for capturing sequential access behaviors, and the Contextual Scoring Module (CSM) for quantifying contextual and environmental signals. Risk is estimated via a multi-dimensional function that combines behavioral patterns, device and location attributes, and real-time threat indicators. An adaptive decision threshold, continuously refined based on false-accept and false-reject outcomes, ensures a calibrated balance between security and operational usability. Computed risk scores are seamlessly embedded into ABAC policies to support fine-grained enforcement. Evaluation on four domain-relevant datasets—Login Data Set for Risk-Based Authentication (RBA), CERT Insider Threat Test Dataset, CIC-IDS2017, and RT-IoT2022—used to emulate access control scenarios, shows F1-scores up to 0.95 and precision up to 0.94, outperforming strong baselines by up to 12%. The results demonstrate robustness across authentication, insider threat, intrusion, and IoT domains, supporting the framework’s applicability in real-time, Risk-Adaptive access systems for wireless communication and IoT environments, particularly in emerging 5G/6G contexts. The modular architecture also separates behavioral, contextual, and environmental evidence so that each source can contribute to the final authorization decision without requiring a single static risk signal.
[1] V. C. Hu, D. Ferraiolo, D. R. Kuhn, A. Schnitzer, K. Sandlin, R. Miller, and K. Scarfone, "Guide to Attribute Based Access Control (ABAC): Definition and Considerations," NIST Special Publication 800-162, 2014, doi: 10.6028/NIST.SP.800-162.
[2] V. Hu, D. Ferraiolo, and D. Kuhn, "Assessment of Access Control Systems," NISTIR 7316, National Institute of Standards and Technology, 2006, doi: 10.6028/NIST.IR.7316.
[3] R. Sandhu, "Risk-Adaptive Access Control (RAdAC) Overview," presented at NIST Privilege Management Workshop, Jul. 2009. [Online]. Available: https://csrc.nist.gov/csrc/media/events/privilege-management-workshop/documents/radac-paper0001.pdf.
[4] A. Shewalkar, D. Nyavanandi, and S. A. Ludwig, "Performance evaluation of deep neural networks applied to speech recognition: RNN, LSTM and GRU," J. Artif. Intell. Soft Comput. Res., vol. 9, no. 4, pp. 235–245, 2019, doi: 10.2478/jaiscr-2019-0006.
[5] F. M. Shiri, T. Perumal, N. Mustapha, and R. Mohamed, "A comprehensive overview and comparative analysis on deep learning models: CNN, RNN, LSTM, GRU," arXiv preprint, arXiv:2305.17473, 2023.
[6] S. Nosouhian, F. Nosouhian, and A. K. Khoshouei, "A review of recurrent neural network architecture for sequence learning: Comparison between LSTM and GRU," arXiv preprint, arXiv:2109.12939, 2021.
[7] S. Savinov, "A dynamic risk-based access control approach: model and implementation," M.Sc. thesis, Norwegian Univ. of Sci. and Technol. (NTNU), Trondheim, Norway, 2017.
[8] Y. Zhang, "A novel extreme adaptive GRU for multivariate time series forecasting," Sci. Rep., vol. 14, no. 1, p. 2991, 2024, doi: 10.1038/s41598-024-19298-z.
[9] M. E. Islam, "User authentication and access control to blockchain-based forensic log data," EURASIP J. Inf. Secur., vol. 2023, no. 1, p. 7, 2023.
[10] B. Ilyas, A. Kumar, M. A. Setitra, and H. Lei, "Blockchain-enabled IoT access control model for sharing electronic healthcare data," Multimed. Tools Appl., vol. 84, no. 10, pp. 8127–8148, 2025, doi: 10.1007/s11042-024-19232-6.
[11] S. Ranga and M. N. Guptha, "Log anomaly detection using sequential convolution neural networks and Dual-LSTM model," SN Comput. Sci., vol. 4, no. 3, p. 256, 2023.
[12] Y. Ensafi, "Time-series forecasting of seasonal items sales using machine learning–A comparative analysis," Int. J. Inf. Manage. Data Insights, vol. 2, no. 1, p. 100058, 2022.
[13] S. Bhatt and R. Sandhu, "ABAC-CC: Attribute-based access control and communication control for Internet of Things," in Proc. 25th ACM Symp. Access Control Models Technol., 2020, pp. 175–186.
[14] N. Ayman, M. Kiryakos, C. N. Sabty, A. el Bolock, and S. Abdennadher, "Policy-based role and access modeling," in Proc. 2023 IEEE 12th Int. Conf. Intell. Data Acquis. Adv. Comput. Syst. (IDAACS), 2023, doi: 10.1109/IDAACS58523.2023.10348635.
[15] C. Mazzocca, N. Romandini, M. Colajanni, and R. Montanari, "FRAMH: A Federated Learning Risk-Based Authorization Middleware for Healthcare," IEEE Trans. Comput. Soc. Syst., vol. 10, no. 4, pp. 1679–1690, 2023, doi: 10.1109/TCSS.2022.3210372.
[16] K. Ma, G. Yang, and Y. Xiang, "RCBAC: A risk-aware content-based access control model for large-scale text data," J. Netw. Comput. Appl., vol. 167, p. 102733, 2020. [17] R. Jiang, "Risk and UCON-based access control model for healthcare big data," J. Big Data, vol. 10, no. 1, p. 104, 2023. [18] S. Ksibi, F. Jaidi, and A. Bouhoula, "A comprehensive study of security and cyber-security risk management within e-Health systems," Mobile Netw. Appl., vol. 28, no. 1, pp. 107–127, 2023.
[19] D. Sheng, J. Cao, C. Li, K. Fan, and H. Li, "A novel attribute-based access control scheme using blockchain for IoT," IEEE Access, vol. 7, pp. 38431–38441, 2019.
[20] G. D. Putra, "Trust-based blockchain authorization for IoT," IEEE Trans. Netw. Serv. Manag., vol. 18, no. 2, pp. 1646–1658, 2021.
[21] N. Alharbe, A. Aljohani, M. A. Rakrouki, and M. Khayyat, "An access control model based on system security risk for dynamic sensitive data storage in the cloud," Appl. Sci., vol. 13, no. 5, p. 3187, 2023, doi: 10.3390/app13053187.
[22] Y. Zhang, "An attribute-based collaborative access control scheme using blockchain for IoT devices," Electronics, vol. 9, no. 2, p. 285, 2020.
[23] X. Ma, C. Wang, and X. Chen, "Trusted data sharing with flexible access control based on blockchain," Comput. Stand. Interfaces, vol. 78, p. 103543, 2021.
[24] S. O. Ganiyu and R. G. Jimoh, "Extended risk-based context-aware model for dynamic access control in Bring Your Own Device strategy," in Machine Learning and Data Mining for Emerging Trend in Cyber Dynamics, pp. 295–315, 2021, doi: 10.1007/978-3-030-66288-2_12.
[25] H. F. Atlam and G. B. Wills, "An efficient security risk estimation technique for risk-based access control model for IoT," Internet Things, vol. 6, p. 100049, 2019.
[26] Aliyu, M. B., et al. "Dynamic access control at the network edge using an adaptive risk-based access control system (ad-RACs)." Journal of Theoretical and Applied Information Technology 102.3 (2024): 422-433.
[27] K. Ma and G. Yang, "RTBAC: A Risk-Aware Topic-Based Access Control Model for Text Data with Paragraph-Level Authorization," Secur. Commun. Netw., vol. 2022, Art. no. 2233210, 2022.
[28] R. Trabelsi, G. Fersi, and M. Jmaiel, "Access control in Internet of Things: A survey," Comput. Secur., vol. 135, p. 103472, 2023.
[29] S. A. Mansouri, E. Nematbakhsh, A. Rezaee Jordehi, M. Tostado-Véliz, F. Jurado, and Z. Leonowicz, "A risk-based bi-level bidding system to manage day-ahead electricity market and scheduling of interconnected microgrids in the presence of smart homes," in Proc. 2022 IEEE Int. Conf. Environ. Electr. Eng. and IEEE Ind. Commercial Power Syst. Europe (EEEIC/I&CPS Europe), 2022, doi: 10.1109/EEEIC/ICPSEurope54979.2022.9854685.
[30] H. F. Atlam and G. B. Wills, "ANFIS for risk estimation in risk-based access control model for smart homes," Multimed. Tools Appl., vol. 82, pp. 18269–18298, 2023, doi: 10.1007/s11042-022-14010-8.
[31] P. L. Seabe, C. R. B. Moutsinga, and E. Pindza, "Forecasting cryptocurrency prices using LSTM, GRU, and bi-directional LSTM," Fractal Fract., vol. 7, no. 2, p. 203, 2023.
[32] N. Malkin, "Optimistic access control for the smart home," in Proc. 2023 IEEE Symp. Secur. Priv., 2023.
[33] N. Mohammadi, M. Rashidinejad, A. Abdollahi, and P. Afzali, "A new risk-based decentralized model for peer-to-peer energy trading among smart homes," Int. J. Ind. Electron. Control Optim., vol. 5, no. 3, pp. 231–240, 2022.
[34] A. J. Akbarfam et al., "DLACB: Deep learning-based access control using blockchain," arXiv preprint, arXiv:2303.14758, 2023.
[35] M. R. Raza, W. Hussain, and M. Rajaeian, "Analysing trust, security and cost of cloud consumer’s reviews using RNN, LSTM, and GRU," in Advances in Complex Decision Making: Using Machine Learning and Tools for Service-Oriented Computing, pp. 52–65, 2023, doi: 10.1201/9781003340621-4.
[36] R. Jiang, "A medical big data access control model based on fuzzy trust prediction and regression analysis," Appl. Soft Comput., vol. 117, p. 108423, 2022.
[37] K. Srivastava and N. Shekokar, "Machine learning based risk-adaptive access control system to identify genuineness of the requester," in Modern Approaches in Machine Learning and Cognitive Science: A Walkthrough, pp. 129–143, Springer, 2020.
[38] H. F. Atlam, "Risk-based access control model: A systematic literature review," Future Internet, vol. 12, no. 6, p. 103, 2020.
[39] S. Athanere and R. Thakur, "Adaptive access control model using risk-based technique in dynamic environment," in Artificial Intelligence and Sustainable Computing, pp. 253–267, Springer, 2022, doi: 10.1007/978-981-19-1653-3_20.
[40] H. F. Atlam, R. J. Walters, G. B. Wills, and J. Daniel, "Fuzzy logic with expert judgment to implement an adaptive risk-based access control model for IoT," Mob. Netw. Appl., vol. 26, pp. 2545–2557, 2021, doi: 10.1007/s11036-019-01214-w.
[41] K. Ragothaman, "Access control for IoT: A survey," Sensors, vol. 23, no. 4, p. 1805, 2023.
[42] H. F. Atlam, M. A. Azad, and N. F. Fadhel, "Efficient NFS model for risk estimation in a risk-based access control model," Sensors, vol. 22, no. 5, p. 2005, 2022.
[43] H. F. Atlam, A. Alenezi, R. K. Hussein, and G. B. Wills, "Validation of an adaptive risk-based access control model for the Internet of Things," Int. J. Comput. Netw. Inf. Secur., vol. 10, no. 1, pp. 26–35, 2018, doi: 10.5815/ijcnis.2018.01.04.
[44] I. Lee, "Internet of Things (IoT) cybersecurity: Literature review and cyber risk management," Future Internet, vol. 12, no. 9, p. 157, 2020.
[45] H. F. Atlam, A. Alenezi, R. J. Walters, G. B. Wills, and J. Daniel, "Developing an adaptive risk-based access control model for the Internet of Things," in Proc. 2017 IEEE Int. Conf. Internet of Things (iThings) and IEEE Green Computing and Communications (GreenCom) and IEEE Cyber, Physical and Social Computing (CPSCom) and IEEE Smart Data (SmartData), pp. 655–661, 2017, doi: 10.1109/iThings-GreenCom-CPSCom-SmartData.2017.103.
[46] M. A. Morid, O. R. L. Sheng, and J. Dunbar, "Time Series Prediction Using Deep Learning Methods in Healthcare," ACM Trans. Manag. Inf. Syst., vol. 14, no. 1, pp. 1–29, 2023, doi: 10.1145/3531326.
[47] K. Thilagam et al., "Secure IoT healthcare architecture with deep learning-based access control system," J. Nanomater., vol. 2022, Art. no. 2638613, 2022.
[48] A. Noury and M. Amini, "An access and inference control model for time series databases," Future Gener. Comput. Syst., vol. 92, pp. 93–108, 2019.
[49] A. Outchakoucht, H. E. Samaali, and J. P. Leroy, "Dynamic access control policy based on blockchain and ML for IoT," Int. J. Adv. Comput. Sci. Appl., vol. 8, no. 7, pp. 417–424, 2017.
[50] N. B. Akhuseyinoglu and J. Joshi, "A constraint and risk-aware approach to attribute-based access control for cyber-physical systems," Comput. Secur., vol. 96, p. 101802, 2020.
[51] R. Rathna, L. M. Gladence, J. S. Cynthia, and V. M. Anu, "Energy efficient cross layer MAC protocol for wireless sensor networks in remote area monitoring applications," J. Inf. Syst. Telecommun., vol. 9, no. 35, pp. 207–217, 2021, doi: 10.52547/jist.9.35.207.
[52] L. Rikhtechi, V. Rafe, and A. Rezakhani, "Secured access control in security information and event management systems," J. Inf. Syst. Telecommun., vol. 9, no. 33, pp. 67–78, 2021.
[53] L. Karimi, M. Aldairi, J. Joshi, and M. Abdelhakim, "An automatic attribute-based access control policy extraction from access logs," IEEE Trans. Dependable Secure Comput., vol. 19, no. 4, pp. 2304–2317, 2022, doi: 10.1109/TDSC.2021.3054331.
[54] N. Mohammadi, A. Rezakhani, H. Haj Seyyed Javadi, and P. Asghari, "FLHB-AC: Federated Learning History-Based Access Control Using Deep Neural Networks in Healthcare System," J. Socio-Cultural Stud. Khorasan, vol. 12, no. 46, pp. 90–104, 2024, doi: 10.61186/jist.44500.12.46.90.
[55] H. Niu et al., "EHR-BERT: A BERT-based model for effective anomaly detection in electronic health records," J. Biomed. Inform., vol. 150, p. 104605, 2024.
[56] A. J. Akbarfam et al., "Deep learning meets blockchain for automated and secure access control," arXiv preprint, arXiv:2311.06236, 2023.
[57] D. Group, "Login Data Set for Risk-Based Authentication," Kaggle, 2022. [Online]. Available: https://www.kaggle.com/datasets/dasgroup/rba-dataset.
[58] CERT Division, Carnegie Mellon University, "Insider Threat Test Dataset," 2016. DOI: 10.1184/R1/12841247.v1.
[59] I. Sharafaldin, A. Habibi Lashkari, and A. A. Ghorbani, "Toward Generating a New Intrusion Detection Dataset and Intrusion Traffic Characterization," in Proc. 4th Int. Conf. Inf. Syst. Secur. Priv. (ICISSP), pp. 108–116, 2018, doi: 10.5220/0006639801080116.
[60] B. S. and R. Nagapadma, "RT-IoT2022," UCI Machine Learning Repository, 2023, doi: 10.24432/C5P338.
[61] D. Piriaei, A. Rezakhani, H. Haj Seyyed Javadi, and L. Rikhtechi, "Real-Time Risk-Adaptive Access Control With DRCFM: A Scalable BERT-LSTM-GRU Framework for Secure Systems," Security and Privacy, vol. 8, no. 6, e70114, 2025, doi: 10.1002/spy2.70114.