Toward Zero Trust in Higher Education: A Hierarchical Machine Learning Framework for Academic Firewall Insights

The academic environment in which educational institutions provide services has many differences compared to commercial/enterprise/cloud environments; particularly in regards to how security is governed across different colleges/departments within the institution, types of users who access the network (e.g., students/staff, open libraries/residential networks), and patterns of use throughout semesters. While there are commercially available rule optimization tools based upon machine learning (i.e. Google Cloud Firewall Insights), such tools were developed using generalized enterprise/cloud provider hierarchical models and therefore have no understanding of the multistakeholder, federated governance model of educational institutions. In response to these needs, this paper presents the Academic Hierarchical Firewall Insight (AHFI) Framework. The AHFI Framework is designed to map Random Forest-based rule classification and Adaptive Future Usage Prediction onto the Four Tier Governance Model common among all Educational Institutions: University, School/Faculty, Department and Laboratory/Research Virtual Private Cloud (VPC); it also includes new, academia specific Anomaly Classes including Semester-Cyclic Stale Rules, Guest/BYOD Overly Permissive Rules and Unsupervised Laboratory/VPC Shadow Rules that are currently ignored by Enterprise-Oriented Tools. Additionally, a Structured Comparison of Seven Candidate Machine Learning Algorithms is included to support the decision to use Random Forest in this particular setting. Lastly, the paper will include an Illustrative Synthetic Evaluation Scenario to demonstrate the intended Classification/Evaluation Pipeline. Note that the numbers provided are explicitly illustrative and were not generated from actual campus-wide network traffic.