Tenko: A Zero Trust Inspired Framework for Real-Time Network Defense via Intelligent Thresholding and Node-Level Anomaly Scoring

As our digital world becomes more connected, detecting unusual or harmful behavior on networks is more important than ever. Traditional systems that monitor for cyber threats often rely on fixed rules or need labeled examples of attacks, which makes them less effective in real-world, fast-changing environments. This thesis introduces Tenko, a smarter and more adaptable system that identifies suspicious activity on networks in real time—without needing prior knowledge of what an attack looks like. Built as an improvement to an earlier system called Kitsune, Tenko keeps track of how devices behave over time, rather than treating each activity as an isolated event. This means it can better recognize when a device gradually starts acting suspicious, while avoiding false alarms from short-lived or harmless changes. What sets Tenko apart is its ability to learn and adjust dynamically. It uses a lightweight memory system to remember past behaviors and prioritize more recent ones, helping it make more accurate decisions. It also includes a secure blockchain-based method to store and share trust information about devices, which allows the system to work across different parts of a network while staying secure and tamper-proof. To test its performance, Tenko was evaluated on a set of real-world network attacks and showed clear improvements over existing methods—detecting more threats while creating fewer false alarms and missing fewer attacks. This research offers a practical and scalable way to improve cybersecurity, especially in systems where threats evolve constantly and fast, such as smart homes, IoT networks, and critical infrastructure.

Name thesis:degree_name

Master of Science

Level thesis:degree_level

masters

Discipline thesis:degree_discipline

Computer Science & Applications

Department dc:contributor.department

Computer Science and Applications

Grantor dc:publisher

Virginia Tech

Year dc:date.issued

2025

Author dc:creator

• Bhola, Sahil

Chairs dc:contributor.committeechair

• Burger, Eric William
• Cameron, Melissa

Committee member dc:contributor.committeemember

• Ji, Bo

• Intrusion Detection System
• Zero Trust Architecture

Statement dc:rights

• In Copyright

Licence dc:rights.uri

• http://rightsstatements.org/vocab/InC/1.0/

Language dc:language.iso

en

Dc Identifier Other

vt_gsexam:44185

OAI identifier oai:identifier

oai:vtechworks.lib.vt.edu:10919/135515