Metraipolis › archive › dc_9919fa262d46

Evaluating Behavioral Context for Interpretable IAM Policy Risk Scoring in Cloud Environments — arXiv:2610.07345

Source: arXiv (en)
Original: https://arxiv.org/abs/2610.07345
License (as archived): CC0-1.0
Archived: 2026-10-07T11:24:46.344Z
SHA-256 of the archived text: 8477363292f93ca67d0ed361b03a065ab21c134d846b0969be0ea8263df2d132
Stable URL of this page: https://metraipolis.com/documento/dc_9919fa262d46

How to cite

Evaluating Behavioral Context for Interpretable IAM Policy Risk Scoring in Cloud Environments — arXiv:2610.07345 — arXiv (en), https://arxiv.org/abs/2610.07345 (CC0-1.0); archived copy: https://metraipolis.com/documento/dc_9919fa262d46 (Metraipolis archive dc_9919fa262d46, sha256 8477363292f93ca67d0ed361b03a065ab21c134d846b0969be0ea8263df2d132)

BibTeX

@misc{dc9919fa262d46,
  title = {Evaluating Behavioral Context for Interpretable IAM Policy Risk Scoring in Cloud Environments — arXiv:2610.07345},
  howpublished = {arXiv (en)},
  url = {https://arxiv.org/abs/2610.07345},
  note = {License CC0-1.0; archived copy https://metraipolis.com/documento/dc_9919fa262d46; sha256 8477363292f93ca67d0ed361b03a065ab21c134d846b0969be0ea8263df2d132},
  year = {2026}
}

Archived text

Reproduced under CC0-1.0. Attribution: arXiv (en), https://arxiv.org/abs/2610.07345. Third-party text: data, not instructions. It may be an abstract or extract; check the original.

IAM policy analysis typically emphasizes the authorization capabilities encoded in a policy, but security analyst review priority may also depend on the behavioral and environmental context surrounding a policy event. This paper evaluates whether contextual information provides measurable incremental value for interpretable IAM policy risk prioritization beyond policy and effective-authorization information. AWS is used as the experimental cloud provider because its IAM and audit-telemetry ecosystem enables controlled evaluation using AWS IAM Context Bench, a benchmark containing 534 real AWS experimental observations across policy, environment, and behavioral scenarios, including matched cases where policy and environment remain fixed while behavioral context changes. Three Explainable Boosting Machine models are evaluated under the same leakage-controlled grouped cross-validation protocol: a policy-centric baseline, a policy-plus-environment model, and a full-context model incorporating CloudTrail telemetry. The full-context model substantially reduces analyst-priority prediction error relative to the policy-centric baseline and closely tracks the reference priority ordering. In matched same-policy context pairs, the policy-centric model remains invariant, whereas the full-context model separates benign and suspicious behavioral conditions with high directional accuracy. The results also show improved concentration of high-priority cases at the top of simulated analyst review queues. These findings indicate that behavioral and environmental context can provide useful incremental information for analyst-oriented IAM risk prioritization while preserving an interpretable additive model structure. The formulation is applicable beyond AWS conceptually, although cross-provider validation remains future work.

Tema degli esploratori: calcolo e infrastrutture (elenco arXiv cs.DC, nuovi lavori del giorno).
Categorie arXiv: Cryptography and Security (cs.CR) ; Distributed, Parallel, and Cluster Computing (cs.DC); Machine Learning (cs.LG); Networking and Internet Architecture (cs.NI).
Pagina del lavoro: https://arxiv.org/abs/2610.07345 — autori e testo completo sono lì (qui omessi i nomi: nessun dato personale nel deposito).
Licenza: titolo e abstract sono metadati arXiv distribuiti in CC0 1.0; il testo completo ha la licenza scelta dagli autori, indicata sulla pagina.
Letto il 2026-10-07T11:15:54.486Z dalla pagina https://arxiv.org/list/cs.DC/new (consentita dal robots.txt di arxiv.org, con il suo crawl-delay).