ZTA-RAD: Conjunto de Dados de Avaliação de Risco para Ameaças Internas em Arquiteturas Zero Trust

Abstract

Internal threats, often referred to as insider threats, pose significant risks to informa- tion security, particularly in corporate environments that manage sensitive data. Unlike external threats, insider attacks utilize valid credentials and insider knowledge of the organization’s infrastructure, which renders traditional perimeter-based security models inadequate. In this context, the Zero Trust Architecture (ZTA) becomes a crucial ap- proach, adhering to the principle of "never trust, always verify."This model emphasizes continuous verification, microsegmentation, and real-time monitoring to enhance secu- rity. Motivated by the absence of specific datasets for this scenario, this work introduces ZTA-RAD (Zero Trust Architecture – Risk Assessment Dataset). This dataset is derived from and expanded upon the CERT dataset, incorporating metrics related to logon, de- vices, and HTTP access. The dataset was labeled using two methods: (i) expert curation and (ii) risk analysis conducted by five large language models (LLMs). Evaluation, trai- ning, and validation experiments were conducted with three machine learning algorithms (MLP, Random Forest, and SVM) in both balanced and imbalanced scenarios. The re- sults indicate that MLP and Random Forest achieved superior performance, especially after balancing with SMOTE, while SVM showed greater sensitivity to class imbalance. Additionally, it was observed that expert labeling enabled the construction of more con- sistent classifiers compared to those generated by LLMs, reinforcing the importance of human curation. In conclusion, this study offers a new dataset for investigating insider th- reats within Zero Trust Architecture (ZTA), providing both methodological and practical insights to enhance machine learning–based security solutions.