Privilege Escalation Attack Detection and Mitigation in Cloud Using Machine Learning

With the expansion of technology, the frequency and complexity of attacks are also increasing, and cybersecurity competition is also strong. While centralized cloud computing has changed for businesses, it has faced problems when using decentralized security systems [1]. Due to the large amount of inconsistent and weak data exchange between businesses and cloud service providers, this can lead to data leakage. Insider threats, especially from malicious people with significant access, pose a significant risk. To solve this problem, a machine learning-based application for detecting and classifying insider threats focuses on suspicious situations that indicate increased privilege [2].Integrated learning technology is used to improve prediction performance by combining multiple models. Although previous studies have examined the vulnerability and vulnerability in the network, most of them did not provide information about the attack and its distribution [3]. This study uses a data set from the CERT dataset and uses four machine learning algorithms: Random Forest, Adaboost, XGBoost, and LightGBM. Results show that LightGBM outperforms the other algorithms, demonstrating its efficacy in identifying and classifying insider attacks.