Proactive Detection of Privilege Escalation Attacks in Cloud Platforms

With the rapid growth in both the frequency and complexity of cyber-attacks, the widespread adoption of smart devices has introduced serious security concerns. Although cloud computing has significantly transformed the business landscape, its centralized architecture poses challenges for implementing distributed services, especially in areas like security management. Among these risks, insider threats are particularly critical, as insiders have legitimate access to sensitive systems and data, giving them the potential to cause substantial harm compared to external attackers. This project focuses on detecting privilege escalation attacks in cloud platforms using machine learning. A detection pipeline is implemented to analyze user activities and classify them as either normal or malicious. For validation, the KDD Cup ’99 intrusion dataset from Kaggle, which contains diverse attack scenarios, is utilized. Multiple classifiers including SVM, Random Forest, MLP, AdaBoost, Decision Tree, GNB,Gradient Boosting, and Logistic Regression are trained and evaluated. Experimental results indicate that MLP and SVM achieve the best performance with a weighted F1-score of approximately 0.93, while GNB performs the least effectively. The system is integrated with a Flask application that enforces access control by automatically blocking or granting key delivery based on the predictions.