TrustGraph: A Heterogeneous GNN for Dynamic Zero-Trust Policy Enforcement in Microservices

Securing cloud microservices requires a unified understanding of how services behave, authenticate, and interact in real time. Unlike existing methods that analyze telemetry signals in isolation, this work presents a heterogeneous graph-based Zero-Trust framework that represents microservices using multi-modal telemetry—logs, metrics, traces, and authentication flows—embedded directly into graph nodes and edges. A Graph Neural Network architecture with attention captures risk propagation across service dependencies, while a joint anomaly detection and trust computation mechanism generates dynamic trust scores with temporal decay to support continuous verification. These trust signals drive real-time dynamic policy enforcement capable of denying or restricting suspicious interactions with minimal operational overhead. Experiments on the TrainTicket, Sock Shop, and DeathStarBench benchmarks show strong performance, achieving 97.2% accuracy, 98.1% recall, and 0.987 AUC on TrainTicket, with consistent results across the other datasets and latency overhead below 3.2 ms. Robustness tests demonstrate accuracy above 95.8% under noisy logs, delayed traces, and authentication failures. Ablation and SHAP analyses confirm that leveraging multiple telemetry modalities—especially authentication data—is critical for accurate detection and trust scoring. These findings show that multi-modal heterogeneous graph modeling, coupled with integrated anomaly-to-policy decision pipelines, provides an effective foundation for Zero-Trust security in cloud-native microservices.

@article{Amanmadov2025,
  title     = {TrustGraph: A Heterogeneous GNN for Dynamic Zero-Trust Policy Enforcement in Microservices},
  journal   = {International Journal of Advanced Computer Science and Applications},
  volume    = {16},
  number    = {12},
  year      = {2025},
  publisher = {The Science and Information Organization},
  author    = {Nurmyrat Amanmadov and Jemshit Iskanderov and Tarlan Abdullayev},
  doi       = {10.14569/IJACSA.2025.0161205},
  url       = {https://doi.org/10.14569/IJACSA.2025.0161205}
}