Multi-Axis Trust Modeling for Interpretable Account Hijacking Detection

Mohammad AL-Smadi

cs.AIFeb 20, 2026

Multi-Axis Trust Modeling for Interpretable Account Hijacking Detection

Authors: Mohammad AL-Smadi

Organizations: Qatar University, Doha, Qatar

Abstract

This paper proposes a Hadith-inspired multi-axis trust modeling framework, motivated by a structurally analogous problem in classical Hadith scholarship: assessing the trustworthiness of information sources using interpretable, multidimensional criteria rather than a single anomaly score. We translate five trust axes - long-term integrity (adalah), behavioral precision (dabt), contextual continuity (isnad), cumulative reputation, and anomaly evidence - into a compact set of 26 semantically meaningful behavioral features for user accounts. In addition, we introduce lightweight temporal features that capture short-horizon changes in these trust signals across consecutive activity windows. We evaluate the framework on the CLUE-LDS cloud activity dataset with injected account hijacking scenarios. On 23,094 sliding windows, a Random Forest trained on the trust features achieves near-perfect detection performance, substantially outperforming models based on raw event counts, minimal statistical baselines, and unsupervised anomaly detection. Temporal features provide modest but consistent gains on CLUE-LDS, confirming their compatibility with the static trust representation. To assess robustness under more challenging conditions, we further evaluate the approach on the CERT Insider Threat Test Dataset r6.2, which exhibits extreme class imbalance and sparse malicious behavior. On a 500-user CERT subset, temporal features improve ROC-AUC from 0.776 to 0.844. On a leakage-controlled 4,000-user configuration, temporal modeling yields a substantial and consistent improvement over static trust features alone (ROC-AUC 0.627 to 0.715; PR-AUC 0.072 to 0.264).

Figures & tables

Metric	Value
Total events	500,000
Number of users	77
Distinct event types	24
Time span	13 days (Jul 7–21, 2017)

Table 1: Summary of the CLUE-LDS subset used in this study

Model	ROC-AUC	PR-AUC	F 1	Prec. / Rec.
Original Hadith + RF	0.99997	0.99975	0.9948	0.993 / 0.996
Combined (Hadith+Temporal) + RF	0.99996	0.99963	0.9935	0.991 / 0.996
Temporal Only + RF	0.99989	0.99912	0.9869	0.986 / 0.988
Raw Counts + RF	0.98570	0.91691	0.8580	0.789 / 0.940
Isolation Forest	0.49358	0.10753	0.1996	0.111 / 0.990

Table 2: Detection performance on CLUE-LDS (6,929 test windows, 762 hijacked). Temporal features provide strong complementary signals and remain highly discriminative even when used in isolation.

CERT-500 (500 users; 6,666 windows)
Setting / Model	ROC-AUC	PR-AUC	F 1	Prec. / Rec.
Hadith Only + RF	0.7757	0.3479	0.3810	0.606 / 0.278
Temporal Only + RF	0.8088	0.3906	0.3972	0.406 / 0.389
Combined (Hadith+Temporal) + RF	0.8439	0.4989	0.5246	0.640 / 0.444
CERT-4000 Balanced (4,000 users; 22,622 windows)
Hadith Only + RF	0.6267	0.0720	0.1132	0.176 / 0.083

Table 3: CERT r6.2 detection performance. CERT-500 uses 2,000 test windows (72 positive); CERT-4000 uses 6,787 test windows (72 positive). Temporal features provide a consistent lift over static Hadith axes and become more important in the larger, harder setting. Raw count features collapse to near-random performance on CERT, highlighting the need for structured and temporal trust modeling.

Setting	Axis	#Feat.	ROC-AUC	PR-AUC	F 1	$\boldsymbol{\Delta}$ ROC
(A) Removing Individual Axes from Full Feature Set
Remove	ʿAdālah	37	0.6993	0.2619	0.3696	$-0.0158$
Remove	Ḍabṭ	35	0.7216	0.1924	0.3232	$+0.0065$
Remove	Isnād	36	0.7185	0.2673	0.3542	$+0.0034$
Remove	Reputation	38	0.7140	0.2647	0.3579	$-0.0012$
Remove	Anomaly	38	0.7319	0.2553	0.3409	$+0.0168$

Table 4: Detailed ablation analysis on the CERT r6.2 (4,000 users) dataset. The full combined model achieves ROC-AUC = 0.7151.

\Delta

ROC indicates the change relative to the full model.

Axis	Feature computation (derived from implementation)
Integrity / Stability (ʿAdālah)	• Active days : Number of distinct calendar dates with at least one historical event prior to the window start. • Total events : Count of all user events before the window. • Account age : Number of days between the user’s earliest historical event and the window end timestamp. • Daily variability : Standard deviation of historical per-day event counts. • Activity density : Historical total events divided by the number of historical active days.
Precision / Hygiene (Ḍabṭ)	• Login success rate : Successful login/authentication events divided by total login/authentication attempts within the window. • Failure delta : Difference between the login failure rate in the window and the historical login failure rate. • Burstiness : Maximum number of events occurring within any single minute of the window. • Out-of-hours fraction : Proportion of window events occurring outside the historical 2.5–97.5 percentile activity-hour range. • Timing entropy : Shannon entropy of log-binned inter-event time gaps within the window. • Path divergence : Fraction of unique resource paths in the window that were never observed in historical activity. • Sensitive-action ratio : Proportion of window events whose event type or resource path contains sensitive-action keywords.
Chain Continuity / Context (Isnād)	• IP consistency : Inverse of the number of distinct IP addresses observed in the window. • Primary IP match : Fraction of window events whose IP matches the user’s most frequent historical IP. • Subnet match : Fraction of window IPs belonging to the user’s dominant historical /24 subnet. • Geo-impossible IP switches : Rate of IP changes occurring within less than five minutes. • Session discontinuity : Fraction of consecutive inter-event gaps within the window that exceed one hour. • New IP rate : Proportion of window IP addresses that have never appeared in the user’s history.
Reputation (Jarḥ wa-Taʿdīl)	• History duration : Total number of days spanned by the user’s historical activity. • Trust ratio : Ratio of successful historical login/authentication events to total authentication attempts. • Penalty rate : Fraction of historical events classified as failures. • Failure trend : Difference between late-history and early-history authentication failure rates.
Anomaly Evidence (Shudhūdh / ʿIllah)	• Event-type KL divergence : Kullback–Leibler divergence between window and historical event-type distributions. • Hour-of-day KL divergence : KL divergence between window and historical hour-of-day activity distributions. • Path novelty : Fraction of unique resource paths in the window that are absent from historical activity. • Event-type L2 distance : Euclidean distance between window and historical event-type frequency vectors.
Temporal Extensions (Sequence-Aware Trust Dynamics)

Table 5: Summary of the Hadith-inspired trust axes and engineered features with explicit, code-level computation definitions.

Anomaly Detection

Anomaly detection finds rare or unexpected patterns in data, from defective products and system faults to fraud and security threats.

See all 652 papers

Explainable Adaptive Zero Trust Framework for AWS with Adversarial Robustness Evaluation
Aug 21, 2026Om Singh, Yagyaraj Pandey, Nandini PathakCybersecurity Zero-Trust Security
Department of Computer Science and Engineering, Dr. A.P.J. Abdul Kalam Technical University, Lucknow, Uttar Pradesh, India
A Hybrid Insider Threat Detection Framework Combining Multi-Agent Simulation, Layered SIEM Correlation, and Theory-of-Mind Reasoning
Jan 6, 2026Firdous Kausar, Asmah Muallem, Naw Safrin Sattar +1Cybersecurity Anomaly Detection
Department of Computer Science and Data Science SACS, Meharry Medical College Nashville, USA
Leakage Safe Graph Features for Interpretable Fraud Detection in Temporal Transaction Networks
Feb 24, 2026Hamideh Khaleghpour, Brett McKinneyFinancial Fraud Detection Temporal Data Leakage
The University of Tulsa, Tulsa, Oklahoma, USA

Aug 21, 2026J/K move · Enter open · S save

Explainable Adaptive Zero Trust Framework for AWS with Adversarial Robustness Evaluation

Om Singh, Yagyaraj Pandey, Nandini Pathak

Department of Computer Science and Engineering, Dr. A.P.J. Abdul Kalam Technical University, Lucknow, Uttar Pradesh, India

Cybersecurity Zero-Trust Security Adversarial Robustness Anomaly Detection

Open paper AskPDF arXiv

Cloud environments built on Amazon Web Services face a structural security vulnerability: once a credential passes authentication, the resulting session is often treated as trusted for its entire duration. This assumption fails when credentials are stolen. We introduce the Explainable Adaptive Zero Trust Framework (EAZTF), a cloud-native security layer that continuously reevaluates the legitimacy of API actions throughout a session. EAZTF combines Isolation Forest and XGBoost to evaluate eight CloudTrail and IAM-derived behavioral features in real time and produce a Trust Risk Score (TRS) that determines whether a session continues, requires step-up MFA, or is restricted. Each decision is accompanied by a SHAP or LIME explanation, providing human-readable audit records for security analysis and compliance. The framework is also evaluated against four adversarial evasion strategies: credential theft, behavioral mimicry, API rate evasion, and privilege escalation. Experiments on an 8,500-record synthetic CloudTrail dataset show that Isolation Forest achieves 94.4% precision, 91.2% recall, and an F1 score of 0.928. Across the four adversarial scenarios, the mean detection rate is 91.0%, with behavioral mimicry being the most difficult at 83.9%. SHAP analysis identifies IP reputation, login-time deviation, and API call velocity as the three dominant features. A structured NIST SP 800-207 self-assessment gives EAZTF a mean compliance score of 93%, compared with 38% for a traditional perimeter baseline. Mean time to detect decreases from hours to under one minute. Because the evaluation uses synthetic data, these results should be interpreted as indicative rather than validated production performance.

Abstract

Anomaly Detection

Explore similar work

Explainable Adaptive Zero Trust Framework for AWS with Adversarial Robustness Evaluation

A Hybrid Insider Threat Detection Framework Combining Multi-Agent Simulation, Layered SIEM Correlation, and Theory-of-Mind Reasoning

Leakage Safe Graph Features for Interpretable Fraud Detection in Temporal Transaction Networks