Privilege Escalation Attack Detection Mitigation in Cloud Using Machine Learning

The proliferation of smart gadgets has led to an exponential increase in cyberattacks, which has made cybersecurity more difficult.Because of its centralized architecture and the volume of data that is shared between businesses and cloud providers, cloud computing poses hazards even as it is revolutionizing corporate processes.With legal access, malicious insiders are a serious risk since they can cause a great deal of harm by abusing their powers.In order to detect privilege escalation assaults, this paper suggests a machine learning-based insider threat detection system.To increase prediction accuracy, the system integrates several models through ensemble learning.A CERT insider threat dataset was used to test four machine learning algorithms: Random Forest (RF), AdaBoost, XGBoost, and LightGBM.With a 97% accuracy rate, LightGBM outperformed RF, AdaBoost, and XGBoost, which had respective accuracy rates of 86%, 88%, and 88.27%.LightGBM was the best overall, but in some assault scenarios, RF and AdaBoost fared better, indicating that combining algorithms is necessary for stronger, more reliable classification.The proposed system combines ensemble machine learning models-Random Forest, AdaBoost, XGBoost, and LightGBM-to detect privilege escalation attacks in cloud environments.It uses a customized CERT dataset to identify insider threats.The approach involves data preprocessing, feature selection, and classification for improved accuracy and fewer false positives.LightGBM achieves the highest accuracy of 97%, enabling detection of horizontal and vertical privilege escalations with a scalable and adaptable framework. V. LITERATURE SURVEYCloud computing has revolutionized data storage and access, yet it also brings new security risks, especially from insider threats.Among these, privilege escalation attacks-where authorized insiders exploit their access to gain higher privileges-pose significant challenges.Such attacks are difficult to detect because insiders understand system operations and can behave subtly.To tackle this problem, researchers have applied various machine learning (ML) techniques:Random Forest (RF): Widely studied for its strong detection ability, RF provides high accuracy with a low rate of false alarms.AdaBoost: This boosting method improves detection by combining multiple weak classifiers to create a more accurate model. XGBoost andLightGBM: These advanced ensemble methods are effective at handling imbalanced datasets and offer faster training speeds.Prior work by Kumar et al. utilized clustering along with feature selection techniques like Principal Component Analysis (PCA) and Random Forest to enhance malware detection, highlighting the critical role of data preprocessing.Similarly, Le and Zincir-Heywood demonstrated that supervised models such as Artificial Neural Networks (ANN) and Random Forest applied on detailed data could achieve strong detection results.