Behavior-Based Access Control for Network Admission: A Continuous Adaptive Trust Framework

Contemporary Network Access Control (NAC) systems grant or deny network access based on static attributes evaluated at the point of admission: user credentials, device posture, certificate validity, and endpoint group membership. Once admitted, endpoints retain their authorization level regardless of subsequent behavioral changes — a "trust-at-entry" model that fails to detect compromised accounts, insider threats, lateral movement, and anomalous device behavior. This paper presents BBAC-NAC (Behavior-Based Access Control for Network Admission Control), a framework that extends traditional NAC systems with continuous behavioral monitoring and adaptive policy enforcement. BBAC-NAC constructs real-time behavioral profiles from six categories of observable signals — temporal patterns, spatial consistency, traffic behavior, resource access entropy, device fingerprint stability, and identity consistency — and computes a dynamic Trust Score using weighted Bayesian inference that continuously modulates network access privileges through RADIUS Change of Authorization (CoA). The framework incorporates specialized anomaly detection engines for MAC address spoofing via behavioral consistency analysis, impossible travel detection, credential sharing detection, data exfiltration indicators, and lateral movement detection. BBAC-NAC enables NAC systems to transition from binary admit/deny decisions to a continuous spectrum of adaptive trust, closing the critical gap between behavioral analytics platforms (UEBA/SIEM) and network access enforcement. The framework integrates with existing RADIUS/802.1X infrastructure and requires no modifications to network access devices. This work complements the author's Persistent Device Identity framework (arXiv:2603.16745) and IETF Internet-Draft (draft-seralathan-radext-persistent-devid-01), which address the device identification challenge in MAC-randomized environments. Together, they provide both persistent identity ("who is this device?") and continuous behavioral trust ("is this device behaving normally?") for next-generation Zero Trust network access control.