Adaptive zero-trust cyber defence using Graph Neural Networks and Multi-Agent Reinforcement Learning
|
Full Text |
Pdf
|
|
Author |
Ediyannagari Manohar and Kakarla Balachandra Reddy
|
|
e-ISSN |
1819-6608 |
|
On Pages
|
465-475
|
|
Volume No. |
21
|
|
Issue No. |
7
|
|
Issue Date |
June 10, 2026
|
|
DOI |
https://doi.org/10.59018/042655
|
|
Keywords |
zero trust architecture (ZTA), graph neural networks (GNN), multi-agent reinforcement learning (MARL), intrusion detection system (IDS), DDoS detection.
|
Abstract
The rapid evolution of cyberattacks in corporate networks requires intelligent and adaptive defence systems that do not rely solely on conventional rule-based intrusion-detection frameworks. This work presents ZT-GNN-MARL, a comprehensive zero-trust cyber-defence framework that combines threat detection using Graph Neural Networks (GNNs) with Multi-Agent Reinforcement Learning (MARL) for dynamic policy enforcement. Network traffic is represented as a temporal interaction graph, enabling the GNN to learn latent structural behaviours and detect malicious DDoS activity with high fidelity. The MARL engine autonomously makes dynamic zero-trust access-control decisions, including micro-segmentation, host quarantine, and step-up authentication, using risk scores derived from GNN predictions. The proposed system is evaluated on the CIC-IDS-2017 dataset and achieves an overall accuracy of 0.998, perfect recall for malicious flows, and superior performance compared with the Random Forest and MLP baselines. Additional analyses using ROC curves, confusion matrices, latent-space projections, and reinforcement-learning reward convergence demonstrate the robustness, adaptability, and generalization capability of the framework. The findings indicate that ZT-GNN-MARL is an effective and scalable solution for implementing zero-trust architectures in practical network environments.
Back