ZenGuard a machine learning based zero trust framework for context aware threat mitigation using SIEM SOAR and UEBA.

Area of Science:

• Cybersecurity
• Network Security
• Information Security

Background:

• Traditional perimeter-based security models are insufficient against modern cyber threats like APTs.
• Existing SIEM and SOAR platforms lack the behavioral context for full Zero Trust Architecture (ZTA) implementation.
• Operational gaps exist in real-time, adaptive enforcement for ZTA.

Purpose of the Study:

• Introduce ZenGuard, an open-source framework unifying ZTA, SIEM, SOAR, and UEBA.
• Enable context-aware, real-time, and adaptive enforcement for ZTA principles.
• Provide a vendor-independent platform for practical cybersecurity automation.

Main Methods:

• Developed ZenGuard, an integrated platform using Python for automation.
• Employed interpretable machine learning models for behavioral anomaly detection.
• Evaluated ZenGuard with real-world SOC telemetry and synthetic datasets.

Main Results:

• Achieved Mean Time to Respond (MTTR) under 10 seconds for critical threats.
• Demonstrated effective threat detection and response across identity, device, and network layers.
• Validated UEBA accuracy on diverse, emulated threat scenarios.

Conclusions:

• ZenGuard offers a practical, explainable, and scalable approach to cybersecurity automation.
• The framework effectively supports Zero Trust principles aligned with NIST and ISO standards.
• ZenGuard addresses operational gaps in implementing ZTA with existing security tools.