# Application of Data Collected by Endpoint Detection and Response Systems for
Implementation of a Network Security System based on Zero Trust Principles and
the EigenTrust Algorithm

Nitesh Kumar, Gaurav S. Kasbekar and D. Manjunath

###### Abstract

Traditionally, security systems for enterprises have implicit access based on
strong cryptography, authentication and key sharing, wherein access control is
based on Role Based Access Control (RBAC), in which roles such as manager,
accountant and so on provide a way of deciding a subject’s authority. However,
years of post-attack analysis on enterprise networks has shown that a majority
of times, security breaches occur intentionally or accidently due to
implicitly trusted people of an enterprise itself. Zero Trust Architecture
works on the principle of never granting trust implicitly, but rather
continuously evaluating the trust parameters for each resource access request
and has a strict, but not rigid, set of protocols for access control of a
subject to resources. Endpoint Detection and Response (EDR) systems are tools
that collect a large number of attributes in and around machines within an
enterprise network to have close visibility into sophisticated intrusion. In
our work, we seek to deploy EDR systems and build trust algorithms using
tactical provenance analysis, threshold cryptography and reputation management
to continuously record data, evaluate trust of a subject, and simultaneously
analyze them against a database of known threat vectors to provide conditional
access control. However, EDR tools generate a high volume of data that leads
to false alarms, misdetections and correspondingly a high backlog of tasks
that makes it infeasible, which is addressed using tactical provenance
analysis and information theory.

††footnotetext: N. Kumar, G. S. Kasbekar and D. Manjunath are with the
Department of Electrical Engineering, Indian Institute of Technology Bombay,
Mumbai, India. Their email addresses are<EMAIL_ADDRESS><EMAIL_ADDRESS>and<EMAIL_ADDRESS>respectively.

##  I Introduction

Years of post-attack analysis on enterprise networks has shown that a majority
of times, security breaches occur intentionally or accidently due to
implicitly trusted people of an enterprise itself [13]. The reason for this is
that most enterprises have traditionally been following Role Based Access
Control (RBAC) [9], wherein roles such as manager, accountant and so on
provide a way of deciding a subject’s authority. Due to this, a person with a
high designation and authority is, by default, allowed access to sensitive
data. Zero Trust Architecture [2] works on the principle of never granting
trust implicitly, but rather continuously evaluating the trust parameters for
each resource access request and has a strict, but not rigid, set of protocols
for access control of a subject to resources (e.g., software applications,
network access, storage, processor time) [2].

Also, Advanced Persistent Threats (APTs) [1], [6] are a type of adversaries
that lurk in an enterprise network for a long time to extend their reach
before initiating devastating attacks [1]. Endpoint Detection and Response
(EDR) [1] systems are tools that collect a large number of attributes in and
around machines within an enterprise network to have close visibility into
sophisticated intrusion [1].

Access in Zero Trust Architecture is based on Attribute Based Access Control
(ABAC) [9], wherein a decision to grant or deny a subject’s request is
strictly based on enterprise specific attributes (e.g., user-id, user-
authentication-pass, time-stamp-of-access, external-network-id, function-
calls, system-calls) of subjects. Operationally, this translates into
significantly shrinking implicit trust zones [2] and increasing granularity
[9] of access control and access to resources. An implicit trust zone
represents an area where all the entities are trusted to at least the level of
the last policy enforcement point gateway [2]. Attributes periodically
collected using EDR tools may vary as per their weight in the function of a
trust score and its trustworthiness [2], based on which access to a resource
is granted. A trust score function can also vary from network to network and
can be altered as per requirements as some weak attributes for an enterprise
can be strong attributes for another [8].

Two key issues need to be addressed while implementing EDR. The first is the
huge volume of data generated by EDR systems, which becomes difficult to
process in real-time [1]. The effect is even more when granularity of control
is increased while EDR systems are deployed at all subjects [1]. The second is
a high rate of false alarms [1]. Despite this, we cannot avoid continuous
recording of attributes as threats such as APT require a continous evaluation
to track down their increasing reach in the network [1]. Now, since trust
scores are to be continually evaluated, long term behavioral data from EDR
systems needs to be persistently maintained; thus, we need a method for
significantly reducing the size of the log records for long term evaluation
and improving the trust assignment algorithm [2], [9]. Furthermore, the threat
perception evaluated from the activity needs to have high accuracy. Later, we
can build a threat score assignment algorithm.

Tactical Provenance Analysis (TPA) [1] inspects the temporal and causal
ordering of threat alerts within the Tactical Provenance Graph (TPG) [1] to
identify sequences of APT attack actions and later does graph reduction [1] to
shrink the path of the graph that is not usable in threat detection. We seek
to build a trust algorithm by applying Tactical Provenance Analysis [1],
Threshold Cryptography [4], [12], [18], [19], [20] and the EigenTrust
Algorithm [3] to build a robust Zero Trust Architecture for enterprise
networks.

Next, recall that under threshold cryptography, a public key is used to
encrypt the message, and the associated private key is shared among the
participants [4]. E.g., when we are following an $(n,t+1)$ threshold
cryptography scheme, then it allows $n$ computers to share the ability to
perform a cryptographic operation by any $t+1$ parties jointly, but not by $t$
parties [4]. We also seek to use the EigenTrust Algorithm, which is based on
the notion of transitive trust [3], which means that if a peer $p$ trusts any
peer $q$, then it would also trust the peers trusted by peer $q$ [3]. This
also takes our work towards the possibility of decentralization of the Zero
Trust Architecture.

The rest of the paper is organized as follows. In Section II, we provide more
details about the previous works [1], [2], [3], [18], which are most relevant
to our work. We provide our system design in Section III and a discussion,
conclusions and directions for future research in Section IV.

##  II Related Work

In [1], it has been shown that tactical provenance analysis can be applied to
system logs to parse host events into provenance graphs [1] that describe the
totality of system execution and facilitate causal analysis of system
activities. Those causal dependencies are then encoded into a TPG. The work
states that attacks like APTs can be prevented if we know the tactics,
techniques and procedures [1] in which a user is executing events in an order,
and later we can match them against a knowledge base like MITRE ATT&CK [1]. A
remarkable reduction of false alarms is claimed in this work with a reduced
size of log records that also helps in context generation [1] from logs, which
is otherwise quite a laborious process and requires a lot of manual effort and
time.

The work in [2] explains policy making using ABAC and its importance in the
implementation of ZTA with a clear and unambiguous attribute based approach
[2]. It divides ZTA into two planes– control plane and data plane; all the
information needed for access control of the system is transferred through the
control plane and the resource data is transferred through the data plane. The
Policy Decision Point (PDP) [2] is the system within the control plane where
all the policies are built, deployed and updated (an attempt is made to build
algorithms adaptively as per future requirements). The inputs of PDP are
through various trust vectors and external resources [2]. Policy Enforcement
Point (PEP) [2] is the system within the control plane which actually passes
grant access signals after the access request has been validated by the PDP.

In the seminal work [18], threshold cryptography was introduced by designing a
way to divide data $D$ into $n$ pieces in such a way that $D$ is easily
reconstructable from any $z$ pieces, where $2\leq z<n$, but even complete
knowledge of $z-1$ pieces reveals absolutely no information about $D$ [18].
This technique enables the construction of robust key management schemes for
cryptographic systems.

In [3], the idea of reputation management in a decentralized system by means
of transitive trust of peers was introduced. The basic idea is that for a peer
$p$ to have trust in a third party peer $r$, we can check if peer $q$ is
trusted by peer $p$ and peer $q$ trusts the third party $r$, and if yes, then
$p$ can consider peer $r$ as trustworthy [3].

##  III System Design for a Zero Trust Architecture Based Enterprise

###  III-A Defining a Family of Attributes to Form Trust Vectors

We define a family of running trust scores for each triplet (user $i$, device
$j$, resource $k$) that can be used to control access to resources in a ZTA
based system. This triplet gives a unique identity to the access request.
Trust scores [2] in addition can be a function of various attributes [9] and
their corresponding weights. Some examples are as follows: average amount of
time for external network access, duration of flash drive usage, entry
timestamp, number of input/ output operations, number of privilege escalation
attempts, number of malicious file accesses, most frequent external network
access, number of function calls, number of system calls, exit timestamp and
so on. On EDR systems, these can be stored as database records after applying
TPG and graph reduction techniques such as Minimally Sufficient Skeleton [1]
to reduce the overall number of records, say $N_{R}$, and cardinality, say
$N_{C}$, of records. Here, by cardinality, we mean the number of attributes in
the record.

###  III-B Log Compression using Information Theory

The size of log records can be drastically reduced by using some standard
coding schemes in information theory such as Huffman coding [5]. We can choose
to uniquely code repetitive complete set or subset of attributes as given in
Section III-A, as per its probability, say $p_{i}$, of occurrence and
cardinality, say $N_{i}$. Our challenge is to give higher probability records
with a lower size of label that can be done using Huffman coding tree [5].
Overall, we need to reduce the average length, say $A_{L}$, of the records for
better storage and reducing the size of logs; note that:

$\mathbf{A_{L}}=\min\sum_{i}{\mathbf{p}_{i}\times N_{i}}.$

###  III-C Database Architecture for EDR Summary

In our framework, the tables required for database storage should correspond
to a finite number of attributes. Also, enough tables should be used to
declare a system activity, system state and trust level for each triplet (user
$i$, device $j$, resource $k$). We consider the number of attributes to be
finite for the complexity of the algorithm to be bounded. In addition, for
different purposes, we may need multiple tables in the database such as one
for EDR recording keeping with a limited pool of a week of log record, another
for compressed and reduced data set for prolonged storage and future analysis,
and one additional table for access control [8], [10], [11] and credentials.
Our database system would be having the flexibility to add or remove tables,
attributes and perform database normalization [17] as per requirements.

###  III-D Distributed Algorithm Design for the Computation of Trust Scores
and Control Access

In order to discard the overhead and single point of computation and
bottleneck with dependency, we want to keep our algorithm distributed so that
even if a few nodes fail, then the other systems keep running. In [3], a peer
to peer transitive trust mechanism called Eigentrust that is not centralized
was defined. We are studying various low complexity algorithm design
techniques reliability to provide improved security features by explicitly
assuming that at a given time instant, some of the nodes in an enterprise
network in which EDR tools are installed may be compromised and/ or failed. We
seek to mitigate the effect of delays from the time instant of infection of
nodes until they are detected by security analysts using EDR tools, by
designing and implementing a secure and distributed method to limit the damage
to the enterprise network caused by compromised nodes until their infection is
detected and patched.

###  III-E Caching and Updating of Trust Scores

In order to maintain a running trust score for each request triplet (user $i$,
device $j$, resource $k$), we use an EDR system to keep updating the trust
scores in real-time or keep a refreshing time of trust scores as small as
possible, say five minutes. There will be a dedicated centralized server in
the network that will be responsible for keeping variables like Last-Known-
Recent-Trust-Score and Cached-Score for each request triplet. Cached scores
will be available only for requests identified as frequent and will be stored
on another faster storage device like a solid state drive with a superior
clock speed. We can adopt any optimal cache memory replacement schemes like
Least Recently Used (LRU) [16], which replaces cache blocks that are not
frequently requested with one having a higher frequency of request. To
minimize the real time computation delay, we do not encourage computing the
trust score at the time of access requirements, but instead, the Last-Known-
Recent-Trust-Score should always be pre-computed and available with a MAX-
Refresh-Time of five minutes. At the time of access control demand, we can get
the trust score with a single query operation rather than computing it which
may first be a hit on Cached-Score on miss the score will be looked into
dedicated centralized server for the Last-Known-Recent-Trust-Score.

###  III-F Combining Reputation Management and Zero Trust Principles to build
Trust Algorithms

We seek to use the reputation management system EigenTrust [3] and threshold
cryptography techniques along with Zero Trust Principles to build a robust
trust algorithm and implement a combination of Eigentrust and ZTN on a
sandbox, possibly starting from a totally centralized network controlled by a
system administrator to a totally distributed network. This step will be used
after we have already recorded EDR data, applied tactical provenance analysis
and applied further reduction of log records using Huffman coding. We may
start first from an entirely centralized implementation as it will be easier
to study the functionality and response of the system and then move on to a
distributed version. EigenTrust is an algorithm that provides each peer in the
network a unique global trust value based on the peer’s history of uploads and
thus aims to reduce the number of inauthentic file transactions in a Peer to
Peer (P2P) network [3]. Recall that the EigenTrust algorithm is based on
transitive trust, which means that if a peer $p$ trusts any peer $q$, then it
would also trust the peers trusted by $q$. Each peer $p$ calculates the local
trust value $S_{pq}$ for all peers that have provided it with authentic
satisfactory or unsatisfactory transactions it had [3]. The following score is
calculated for each peer combination [3]:

$S_{pq}=\mbox{sat}(p,q)-\mbox{unsat}(p,q)$

The local value is then normalized [3], to prevent malicious peers from
assigning arbitrarily high local trust values to colluding malicious peers and
arbitrarily low local trust values to good peers. Detailed information on
reputation management can be found in [3].

Threshold Cryptography protects information by encrypting it and distributing
it among a distributed system of fault-tolerant computers [4], [12]. We
encrypt a message using a public key, and the corresponding private key is
shared among the participating computers. Any cryptography activity needs a
yes gesture from a pre-decided number of participants equivalent to threshold
as discussed in Section I. Our final algorithm will seek benefits from methods
and principles stated in this paper in order to ensure reduced implicit trust
zones and provide security following Zero Trust principles.

##  IV Discussions, Conclusions and Future Work

Data from EDR can be deployed at various levels of the design of ZTA networks;
however, keeping track of the entire EDR dataset is a complex process. Zero
Trust Architecture is the need of the hour, keeping in view threats like
Advanced Persistent Threats. For making this process simplified, reduced and
more useful, we can use methods such as Tactical Provenance Analysis and Graph
Reduction. Creation of a trust score algorithm should be flexible with the
design, but rigid to ZTA principles. A generic way of evaluating trust vectors
and computing confidence levels can be done using a combination of trust
algorithms, reputation management algorithms and threshold cryptography. In
the future, we seek to build trust algorithms using data that we record using
EDR tools that can be adapted to changes in environment variables. One can
think of more methodologies for log reduction such as using information theory
for efficient storage and faster processing and determining possibilities of
real time access control deployment. Another direction for future research
would be a complete decentralization in ZTA, while keeping it real time. A
flexibly coupled hardware and set of software can be used to build robust Zero
Trust Architecture based systems for enterprises.

## References

  * [1] Hassan, W.U., Bates, A. and Marino, D.,  2020, May. Tactical provenance analysis for endpoint detection and response systems.  In 2020 IEEE Symposium on Security and Privacy (SP) (pp. 1172-1189). IEEE.
  * [2] Rose, Scott W., Oliver Borchert, Stuart Mitchell, and Sean Connelly,  ”Zero Trust Architecture.” (2020). NIST Special Publication 800-207.
  * [3] Kamvar, S.D., Schlosser, M.T. and Garcia-Molina, H.,  2003, May.  The eigentrust algorithm for reputation management in p2p networks. In Proceedings of the 12th international conference  on World Wide Web (pp. 640-651).
  * [4] L. Zhou, Z.J. Haas,  ”Securing Ad Hoc Networks “, IEEE Network, Vol 13, No. 6, pp. 24-30, 1999.
  * [5] T.M. Cover, J.A. Thomas,  ”Elements of Information Theory”,  John Wiley & Sons, Inc., 2004.
  * [6] George Karantzas, Constantinos Patsakis,  2021,  An Empirical Assessment of Endpoint Detection and Response Systems against Advanced Persistent Threats Attack Vectors. https://doi.org/10.3390/jcp1030021.
  * [7] Joey Allen et al.,  Mnemosyne: An Effective and Efficient Postmortem Watering Hole Attack Investigation System,  CCS ’20: Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security, pp. 787–802, October 2020.
  * [8] Vincent Hu, David Ferraiolo, Richard Kuhn,  (NIST), SP 800-205,  Attribute Considerations for Access Control Systems, June 2019.
  * [9] Hu, Vincent C., David Ferraiolo, Rick Kuhn, Arthur R. Friedman, Alan J. Lang, Margaret M. Cogdell, Adam Schnitzer, Kenneth Sandlin, Robert Miller, and Karen Scarfone,  “Guide to Attribute Based Access Control (ABAC) Definition and Considerations.” (2020), NIST special publication, 800 (162), pp.1-54.
  * [10] William Fisher (NIST), Norm Brickman (MITRE) et al,  SP 1800-3 (Draft), Attribute Based Access Control (2nd Draft).
  * [11] Romans Vanickis et al.,  Access Control Policy Enforcement for Zero-Trust-Networking, 2018 29th Irish Signals and Systems Conference (ISSC).
  * [12] A. D. Santis, Y. Desmedt, Y. Frankel, M. Yung,  ”How to Share a Function Securely”, STOC 1994: pp. 522 - 533.
  * [13] J. Kindervag,  ”No more chewy centres: The zero trust model of information security”, Forrester Research, Mar 2016,  https://www.forrester.com/report/no-more-chewy-centers-the-zero-trust-model-of-information-security/RES56682
  * [14] Omar Alrawi, Moses Ike, Matthew Pruett, Ranjita Pai Kasturi, Srimanta Barua, Taleb Hirani, Brennan Hill, Brendan Saltaformaggio:  Forecasting Malware Capabilities from Cyber Attack Memory Images. USENIX Security Symposium 2021: 3523-3540.
  * [15] Nahid Juma et al.,  Forensic Analysis in Access Control: Foundations and a Case-Study from Practice,  CCS ’20: ACM SIGSAC Conference on Computer and Communications Security, October 2020 pp. 1533–1550.
  * [16] Carl Hamacher, Zvonko Vranesic, Safwat Zaky,  “Computer Organization”, Fifth Edition, Mc Graw Hill Education, 2002.
  * [17] Abraham Silberschatz, Henry F. Korth, S. Sudarshan,  Database System Concepts, 6th Edition, 2013, McGraw Hill Publication.
  * [18] Shamir, Adi,  ”How to share a secret” Communications of the ACM 22, no. 11 (1979): 612-613.
  * [19] Desmedt, Yvo, and Yair Frankel,  ”Shared generation of authenticators and signatures.” In Annual International Cryptology Conference, pp. 457-469. Springer, Berlin, Heidelberg, 1991.
  * [20] Li, Chuan-Ming, Tzonelih Hwang, and Narn-Yih Lee,  ”Remark on the threshold RSA signature scheme.” In Annual International Cryptology Conference, pp. 413-419. Springer, Berlin, Heidelberg, 1993.