Integrating UEBA-Driven Risk Scoring for Adaptive Attribute Based Decryption

Insider threats, originating from privileged but compromised users, exploit the inherent limitations of CiphertextPolicy Attribute-Based Encryption (CP-ABE), which enforces policies based solely on static attributes. This rigidity prevents the security system from adapting to a user exhibiting high-risk behavior in real time. To address this critical gap, we introduce the Adaptive Attribute-Based Encryption (A-ABE) framework, a novel security architecture that integrates predictive intelligence with cryptographic enforcement. A-ABE utilizes a User and Entity Behavior Analytics (UEBA) module powered by advanced Machine Learning algorithms. This module continuously analyzes real-time user activity logs to generate an Insider Risk Score (IRS). The IRS is then employed by a Dynamic Policy Engine to instantly modify the decryption policy, automatically demanding stricter, dynamic attributes, such as Multi-Factor Authentication status, before key release. Moreover, the foundational security is ensured by binding the decryption policy to the network gateway MAC address, cryptographically preventing external decryption of exfiltrated files. Extensive experimental validation using the CERT dataset confirms the high-risk classification accuracy of the model. We also quantify the low operational overhead, proving A-ABE provides a viable, proactive defense that transforms reactive threat monitoring into preventative cryptographic denial.