Privilege_Escalation_Attack_Detection_and_Mitigation_in_Cloud_Using_Machine_Learning. Shakas Technologies ( Galaxy of Knowledge) #11/A 2nd East Main Road, Gandhi Nagar, Vellore - 632006. Mobile : +91-9500218218 / 8220150373| land line- 0416- 3552723 Shakas Training & Development | Shakas Sales & Services | Shakas Educational Trust|IEEE projects | Research & Development | Journal Publication | Email : info@shakastech.com | shakastech@gmail.com | website: www.shakastech.com​ Facebook: https://www.facebook.com/pages/Shakas-Technologies

1. Base paper Title: Privilege Escalation Attack Detection and Mitigation in Cloud Using
Machine Learning
Modified Title: Machine Learning-Based Identification and Mitigation of Privilege Escalation
Attacks in the Cloud
Abstract
Because of the recent exponential rise in attack frequency and sophistication, the
proliferation of smart things has created significant cybersecurity challenges. Even though the
tremendous changes cloud computing has brought to the business world, its centralization
makes it challenging to use distributed services like security systems. Valuable data breaches
might occur due to the high volume of data that moves between businesses and cloud service
suppliers, both accidental and malicious. The malicious insider becomes a crucial threat to the
organization since they have more access and opportunity to produce significant damage.
Unlike outsiders, insiders possess privileged and proper access to information and resources.
In this work, a machine learning-based system for insider threat detection and classification is
proposed and developed a systematic approach to identify various anomalous occurrences that
may point to anomalies and security problems associated with privilege escalation. By
combining many models, ensemble learning enhances machine learning outcomes and enables
greater prediction performance. Multiple studies have been presented regarding detecting
irregularities and vulnerabilities in network systems to find security flaws or threats involving
privilege escalation. But these studies lack the proper identification of the attacks. This study
proposes and evaluates ensembles of Machine learning (ML) techniques in this context. This
paper implements machine learning algorithms for the classification of insider attacks. A
customized dataset from multiple files of the CERT dataset is used. Four machine learning
algorithms, i.e., Random Forest (RF), Adaboost, XGBoost, and LightGBM, are applied to that
dataset and analyzed results. Overall, LightGBM performed best. However, some other
algorithms, such as RF or AdaBoost, may perform better on some internal attacks (Behavioral
Biometrics attacks) or other internal attacks. Therefore, there is room for incorporating more
than one machine learning algorithm to obtain a stronger classification in multiple internal
attacks. Among the proposed algorithms, the LightGBM algorithm provides the highest
accuracy of 97%; the other accuracy values are RF at 86%, AdaBoost at 88%, and XGBoost at
88.27%.

2. Existing System
Cloud computing is a new way of thinking about how to facilitate and provide services
through the Internet. The current financial crisis, as well as the expanding computing demands,
have necessitated significant changes to the current Cloud Model in terms of data storage,
processing, and display [1]. Cloud computing prevents people from spending a lot on
equipment maintenance and purchases by utilizing cloud infrastructure. Cloud storage
providers adopt fundamental security measures for their systems and the data they handle,
including encryption, access control, and authentication. Depending on the accessibility, speed,
and frequency of data access, the cloud has an almost infinite capacity for storing any type of
data in different cloud data storage structures. Sensitive data breaches might occur due to the
volume of data that moves between businesses and cloud service providers, both inadvertent
and malicious. The characteristics that make online services easy to use for workers and IT
systems also make it harder for businesses to prevent unwanted access [2]. Authentication and
open Interfaces are new security vulnerabilities that Cloud services subject enterprises face.
Hackers with advanced skills utilize their knowledge to access Cloud systems Machine
learning employs a variety of approaches and algorithms to address the security challenge and
better manage data. Many datasets are private and cannot be released owing to privacy
concerns, or they may be missing crucial statistical properties [3], [4]. The fast rise of the Cloud
industry creates privacy and security risks governed by regulations. Employee access privileges
may not necessarily change when they change roles or positions within the Cloud Company.
Drawback in Existing System
 Imbalanced Data: In cybersecurity, instances of attacks are typically much fewer than
normal activities, leading to imbalanced datasets. This imbalance can cause the model
to bias toward the majority class, potentially missing out on detecting real attacks.
 Complexity and Interpretability: Deep learning models, while powerful, can be
complex and less interpretable. Understanding why a model flagged a particular action
as a potential attack might be challenging, reducing trust and making it harder to refine
the model.
 Privacy Concerns: Analyzing user behaviors and activities to detect privilege
escalation might raise privacy concerns among users. Monitoring and analyzing user
actions could conflict with user privacy expectations or regulatory compliance.

3.  Resource Intensive: Training and deploying sophisticated machine learning models
for real-time detection in cloud environments might require significant computational
resources and can lead to increased operational costs.
Proposed System
 The proposed work achieved an accuracy of 85% and a false positive rate of only
0.78%.
 The proposed ILSTM identify internal attackers, but it also minimizes false alert rates
by distinguishing broken and new user nodes from malfunctioning nodes
 The proposed methodology consists of well-known supervised machine learning
algorithms, i.e., Random Forest, AdaBoost, XGBoost, and LightGBM.
 The proposed model consists of four algorithms that were applied to CERT dataset.
Algorithm
 Isolation Forest: It identifies anomalies by isolating them into small partitions in a
dataset, effectively detecting unusual access patterns that might indicate privilege
escalation attempts.
 K-means or DBSCAN: Clustering methods group similar user behaviors and can
detect outliers or unusual clusters that might indicate unauthorized access attempts.
 Combining Multiple Algorithms: Employing a combination of different algorithms
to leverage their strengths and compensate for individual weaknesses can improve
overall detection accuracy.
Advantages
 Early Detection: Machine learning models can detect subtle anomalies or patterns in
user behavior that might indicate potential privilege escalation attempts before they
cause significant damage.
 Efficiency in Resource Allocation: ML-based detection systems can optimize
resource allocation by prioritizing alerts based on the severity and likelihood of
privilege escalation attempts, enabling more efficient incident response.
 Adaptability: ML models can adapt and learn from new data, allowing them to evolve
and detect novel attack patterns or variations of privilege escalation techniques that may
arise in the cloud environment.

4.  Insights and Analytics: Analysis of historical data and identified patterns can provide
insights into potential weaknesses or vulnerabilities in the cloud infrastructure, aiding
in strengthening security measures.
Software Specification
 Processor : I3 core processor
 Ram : 4 GB
 Hard disk : 500 GB
Software Specification
 Operating System : Windows 10 /11
 Frond End : Python
 Back End : Mysql Server
 IDE Tools : Pycharm