Privilege Escalation Attack Detection and Mitigation in Cloud Using Machine Learning

Abstract

The rapid increase in attack sophistication along with the expansion of smart connected devices has created serious cybersecurity concerns, especially in cloud environments. Although cloud computing offers major advantages to organizations, its centralized nature makes deploying distributed security systems difficult, and the continuous flow of sensitive information increases the chances of both accidental and intentional data breaches. Malicious insiders pose an even greater risk because they already possess legitimate privileges and can misuse them to cause extensive harm. This work introduces a machine-learning-based system designed to detect insider threats and classify suspicious behaviors related to privilege escalation. The framework analyzes cloud log activities to identify irregular patterns that may indicate security issues. Ensemble learning is used to improve prediction accuracy by combining multiple models. While earlier research has examined network anomalies, many methods do not effectively detect privilege-escalation attacks.To address this gap, a customized subset of the CERT insider threat dataset is used, and four ML models Random Forest, AdaBoost, XG Boost, and Light GBM are evaluated. Among these, Light GBM achieves the good accuracy, whereas While Light GBM offers the best overall performance, certain algorithms excel at detecting specific insider behaviors.