Machine Learning for Cloud-Based Privilege Escalation Attack Detection and Mitigation with CATBOOST

The exponential growth in attack frequency and complexity in the past few years has made cybersecurity a major concern with the advent of smart devices. Cloud computing has changed the way businesses operate, but users may find it more challenging to use dispersed services, such as security systems, due to their centralization. Organizations and cloud service suppliers exchange massive amounts of data, which poses a significant risk of accidental or intentional disclosure of sensitive information. Because of their increased access and potential to do substantial harm, an antagonistic insider poses a serious threat to the company. Only approved individuals within the organization have access to sensitive data and assets. This research details a machine learning-based strategy for classifying insider threats and finding out-of-the-ordinary events that can indicate privilege escalation security issues. The system uses a systematic approach to detect these irregularities. Machine learning and prediction accuracy are both enhanced by ensemble learning, which considers several models simultaneously. Using anomaly and weakness detection, some studies have attempted to identify security issues or hazards associated with privilege delegation in network systems. However, the assaults cannot be definitely identified from this research. Ensembles for machine learning (ML) are suggested and assessed in this research. The objective of this endeavor is to classify insider assaults using machine learning approaches. The dataset it uses has been modified from many files beneath the CERT dataset. The dataset is subjected to four machine learning techniques: Light GBM, XG Boost, Ada Boost, and three Random Forest (RF) methods. In terms of overall performance, light was superior. In contrast, RF and AdaBoost are two algorithms that may be better at preventing assaults from inside, such as attacks using behavioral biometrics. Consequently, it is possible that various internal threats may be better classified by combining various machine learning algorithms. With a 97% dependability rate, the Light GBM method outperforms the other suggested techniques; RF, AdaBoost, and XG Boost all have 88% accuracy rates.