SubZero: An Adaptive Cross-Domain Threat Intelligence Framework with Dynamic Zero Trust Enforcement

Abstract

In cyber-physical settings, security teams are typically monitoring many disparate systems at the same time—ATM transaction logs, CCTV infrastructure status, telecom signals, transit records, weather feeds, suspect-tracking output, and economic indicators are the seven this project handles. Individually none of these streams says much on its own, an odd withdrawal here, a camera outage there, rarely gets connected to the bigger picture until much later if at all. SubZero is our attempt to bridge that gap: a prototype that brings all seven domains together into one pipeline, detects anomalies using simple per-domain rules, clusters the flagged events geographically with K-Means, and aggregates everything into one weighted risk score. That score is then passed to a Zero Trust layer built around short-lived HMAC-SHA256 tokens. That score then feeds into a Zero Trust layer built around short-lived HMAC-SHA256 tokens that refresh every two seconds. This is a working prototype, not a finished product. We reviewed our source code and data before writing this paper and checked, line-by-line, what actually runs vs. what was left in as placeholder dashboard content from earlier development. That nuance matters. We keep it throughout the paper. We show the anomaly counts, the resulting fusion score, and clustering output as computed by the code, along with counts pulled from the SQLite audit log. We use the telemetry we generated for testing—about 200 to 240 records per domain for six of the seven, plus fifty economic records. We do not report accuracy, precision, recall or F1, because our rule-based detectors have no labeled ground truth to be scored against; where numbers of that kind show up in the running application, we say plainly that they are placeholder UI values rather than measured results. We also claim that our contribution is the integration itself, i.e., the fact that heterogeneous telemetry, rule-based fusion and adaptive Zero Trust can work in a single working system. We treat the bugs and gaps our audit revealed as limitations to be fixed, not hidden.

Introduction

SubZero is a proposed cyber-physical security framework designed to integrate data from seven domains: ATM transactions, CCTV status, telecom signals, transportation activity, weather conditions, suspect tracking, and economic indicators. Traditional security systems monitor these sources separately, making it difficult to identify relationships between cyber threats and physical-world events. SubZero aims to address this limitation by combining multi-domain telemetry, anomaly detection, spatial clustering, risk scoring, and Zero Trust security mechanisms into a unified system.

The framework processes data from CSV files, validates and extracts relevant information, and applies rule-based detection techniques to identify anomalies in each domain. It then uses the K-Means clustering algorithm to identify geographical concentrations of suspicious events. A weighted risk-fusion mechanism combines anomaly counts from different domains into a single risk score ranging from 0 to 99. This score is intended to support context-aware security decisions.

SubZero incorporates a Zero Trust Architecture based on short-lived HMAC-SHA256 authentication tokens, with a configured token rotation interval of two seconds. It also includes role-based endpoint policies, threat-response rules, and rate limiting. These components are intended to improve authentication, restrict unauthorized access, and reduce the risk associated with compromised credentials.

The system is implemented using Python and Streamlit, with a dashboard that presents telemetry status, risk indicators, alerts, and analytical results. However, a detailed source-code and data audit identified important differences between the intended design and the actual implementation.

The audit found that some dashboard elements, including the reported 96.4% detection accuracy, incident graphs, explainability attributions, and crime-forecasting results, contain static placeholder values rather than results generated by actual models. The prototype does not currently implement SHAP-based explainability, and its incident graph is illustrative rather than dynamically generated. Additionally, only ATM and suspect-tracking anomalies are used as geolocated points for clustering, while CCTV and economic data are excluded from that stage. The risk-based policy decision function is also not consistently integrated throughout the system.

The main contribution of SubZero is the practical integration of multiple established technologies into one cross-domain security pipeline. Its novelty lies in combining rule-based anomaly detection, weighted risk fusion, geographical clustering, and Zero Trust authentication rather than introducing a new algorithm. The paper emphasizes reproducibility and transparency by distinguishing computed results from configuration settings and placeholder content.

Conclusion

So what we put together here is SubZero — basically, a prototype that ingests seven cyber-physical telemetry domains, runs rule based detection on each one, then it clusters the outcomes spatially with K- Means, fuses it all into one deterministic risk score, and from that it drives an ephemeral HMAC- SHA256 Zero Trust token layer. The weird thing is, the bulk of this paper is not so much about the mechanics, it’s more about the audit we ran against our own source code and data, and being pretty straight forward about what we found. Like which parts actually touch real input (telemetry ingestion, the detection rules, K-Means, the fusion formula, the adaptive TTL formula, the SQLite log), which parts are just fixed configuration (the two second rotation, the role tables, the risk band cutoffs), and which parts are static dashboard content that should not be confused with an output (the accuracy precision recall F1 numbers, the incident graph, the XAI attribution values, the crime forecast projections). We also found and documented a real bug in the Zero Trust policy layer , not the kind of thing we “ quietly” worked around. And to be clear, nowhere in this paper do we claim SubZero beats any baseline because we haven’t actually run that experiment. Looking ahead, the priorities are kind of clear, fix the check_access_policy thing, and re-verify the whole Zero Trust flow , all the way end to end; swap the static incident graph, the XAI breakdown, and the crime forecast for variants that compute something for real—like an event graph built from live anomalies, SHAP applied to the fusion weights or a trained classifier, and a trend or regression model over the zone-level data instead of guessing; turn the single global risk score into a proper per-zone score; add enough logging around token rotation and access decisions to back up the fixed versus adaptive comparisons that were sketched in Section XVI, not just mention them; and then, once we have labelled or real-world data under proper governance , run the controlled, baseline-compared evaluation, including the ablation setups in Table XI, which this paper basically delayed till later instead of fabricating.

References

[1] Rose, S., Borchert, O., Mitchell, S., Connelly, S.: Zero Trust Architecture. NIST Special Publication 800-207. National Institute of Standards and Technology, Gaithersburg, MD (2020). https://doi.org/10.6028/NIST.SP.800-207 [2] Chandramouli, R., Butcher, Z., Chetal, A.: A Zero Trust Architecture Model for Access Control in Cloud-Native Applications in Multi-Location Environments. NIST Special Publication 800-207A. National Institute of Standards and Technology, Gaithersburg, MD (2023). https://doi.org/10.6028/NIST.SP.800-207A [3] Syed, N.F., Shah, S.W., Shaghaghi, A., Anwar, A., Baig, Z., Doss, R.: Zero Trust Architecture (ZTA): A Comprehensive Survey. IEEE Access 10, 57143–57179 (2022). https://doi.org/10.1109/ACCESS.2022.3174679 [4] MacQueen, J.: Some Methods for Classification and Analysis of Multivariate Observations. In: Proceedings of the 5th Berkeley Symposium on Mathematical Statistics and Probability, vol. 1, pp. 281–297. University of California Press, Berkeley (1967). [5] Lundberg, S.M., Lee, S.-I.: A Unified Approach to Interpreting Model Predictions. In: Advances in Neural Information Processing Systems 30 (NeurIPS 2017), pp. 4765–4774. Curran Associates, Long Beach (2017). [6] Kounadi, O., Ristea, A., Araujo, A., Leitner, M.: A Systematic Review on Spatial Crime Forecasting. Crime Science 9, 1–22 (2020). https://doi.org/10.1186/s40163-020-00116-7 [7] Mushtaq, S., Mohsin, M., Mushtaq, M.M.: A Systematic Literature Review on the Implementation and Challenges of Zero Trust Architecture Across Domains. Sensors 25(19), 6118 (2025). https://doi.org/10.3390/s25196118

Copyright

Copyright © 2026 Karpagam ., P. Sanjay Harish, P. R. K. Vipinayan. This is an open access article distributed under the Creative Commons Attribution License, which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited.