Machine Learning-Based Detection of Privileged Access Anomalies in Cloud Infrastructure

  • Authors

    • Uday Allala Lead SRE Engineer, USA. Author

    DOI:

    https://doi.org/10.67228/3142788X/IJMLPA-2019PI8G5M

    Published 04-03-2019

  • Privileged Access, Cloud Security, Anomaly Detection, Machine Learning, User Behavior Analytics, Cloud Infrastructure, Cybersecurity

    Issue

    Vol. 2 No. 1 (2019)

    Section

    Articles

  • Abstract

    Cloud infrastructure adoption has made privileged account management and identification of any rogue or irregular access more complex. Cloud infrastructure adoption has made privileged account management and identification of any rogue or irregular access more complex. Privileged users have higher permission levels that can give them access to sensitive cloud resources, which makes them a desirable target for credential compromise, privilege abuse and insider attacks. Security mechanisms based on rules tend to be inefficient at detecting behaviorally obscure or new anomalies in large-scale cloud deployments. In this paper, a machine learning based framework for identifying privileged access anomalies through the analysis of access logs, user activity, authentication behavior, resource usage, and temporal behavior is proposed. The suggested approach consists of the following five steps: Data preprocessing, Feature extraction, Feature selection, Behavioral profiling, Anomaly detection using machine learning. The proposed framework is evaluated using representative cloud access data, and multiple machine learning models used to determine the effectiveness of detecting anomalous privileged activities. The accuracy, precision, recall, F1 score, receiver operating characteristic area under the curve (ROC-AUC) and false-positive rate are used to evaluate performance. The experimental analysis is targeted towards the identification of abnormal login activity, unusual resource usage, privilege escalation trends, and abnormal user activity. The effectiveness of the proposed framework is compared with the conventional and baseline machine learning methods. The outcomes illustrate the efficacy of machine learning in enhancing the detection of privileged access anomalies and enable scalable, intelligent monitoring for cloud security. The proposed framework offers a pragmatic basis to improve cloud access security and identify potentially malicious privileged activities early.

  • References

    [1] Almorsy, M., Grundy, J., & Müller, I. (2016). An analysis of the cloud computing security problem. arXiv preprint arXiv:1609.01107.

    [2] Takabi, H., Joshi, J. B., & Ahn, G. J. (2010). Security and privacy challenges in cloud computing environments. IEEE Security & Privacy, 8(6), 24-31.

    [3] Kholidy, H. A., Erradi, A., Abdelwahed, S., & Baiardi, F. (2013, June). Ha-cids: A hierarchical and autonomous ids for cloud systems. In 2013 Fifth international conference on computational intelligence, Communication Systems and Networks (pp. 179-184). IEEE.

    [4] Modi, C., Patel, D., Borisaniya, B., Patel, H., Patel, A., & Rajarajan, M. (2013). A survey of intrusion detection techniques in cloud. Journal of network and computer applications, 36(1), 42-57.

    [5] Garcia-Teodoro, P., Diaz-Verdejo, J., Maciá-Fernández, G., & Vázquez, E. (2009). Anomaly-based network intrusion detection: Techniques, systems and challenges. computers & security, 28(1-2), 18-28.

    [6] Mell, P., & Grance, T. (2011). The NIST definition of cloud computing.

    [7] Choo, K. K. R. (2011). The cyber threat landscape: Challenges and future research directions. Computers & security, 30(8), 719-731.

    [8] Buczak, A. L., & Guven, E. (2015). A survey of data mining and machine learning methods for cyber security intrusion detection. IEEE Communications surveys & tutorials, 18(2), 1153-1176.

    [9] Breiman, L. (2001). Random forests. Machine learning, 45(1), 5-32.

    [10] Cortes, C., & Vapnik, V. (1995). Support-vector networks. Machine learning, 20(3), 273-297.

    [11] Chen, T., & Guestrin, C. (2016, August). Xgboost: A scalable tree boosting system. In Proceedings of the 22nd acm sigkdd international conference on knowledge discovery and data mining (pp. 785-794).

    [12] Goldstein, M., & Uchida, S. (2016). A comparative evaluation of unsupervised anomaly detection algorithms for multivariate data. PLoS ONE, 11(4), e0152173

    [13] Hu, V. C., Ferraiolo, D. F., Kuhn, D. R., Schnitzer, A., Sandlin, K., Miller, R., & Scarfone, K. (2014). Guide to attribute based access control (ABAC) definition and considerations (NIST Special Publication 800-162). National Institute of Standards and Technology.

    [14] Habiba, U., Masood, R., Shibli, M. A., & Niazi, M. A. (2014). Cloud identity management security issues & solutions: a taxonomy. Complex Adaptive Systems Modeling, 2(1), 5.

    [15] Indu, I., Anand, P. R., & Bhaskar, V. (2018). Identity and access management in cloud environment: Mechanisms and challenges. Engineering science and technology, an international journal, 21(4), 574-588.

    [16] Raj, P., & Raman, A. (2018). Multi-cloud management: Technologies, tools, and techniques. In Software-defined cloud centers: Operational and management technologies and tools (pp. 219-240). Cham: Springer International Publishing.

    [17] Punithavathani, D. S., Sujatha, K., & Jain, J. M. (2015). Surveillance of anomaly and misuse in critical networks to counter insider threats using computational intelligence. Cluster Computing, 18(1), 435-451.

    [18] Tep, K. S., Martini, B., Hunt, R., & Choo, K. K. R. (2015, August). A taxonomy of cloud attack consequences and mitigation strategies: The role of access control and privileged access management. In 2015 IEEE Trustcom/BigDataSE/ISPA (Vol. 1, pp. 1073-1080). IEEE.

    [19] Li, J., Cheng, K., Wang, S., Morstatter, F., Trevino, R. P., Tang, J., & Liu, H. (2017). Feature selection: A data perspective. ACM computing surveys (CSUR), 50(6), 1-45.

    [20] Darwish, S. M. (2016). Machine learning approach to detect intruders in database based on hexplet data structure. Journal of Electrical Systems and Information Technology, 3(2), 261–269.

    [21] Munir, M., Siddiqui, S. A., Dengel, A., & Ahmed, S. (2018). DeepAnT: A deep learning approach for unsupervised anomaly detection in time series. IEEE access, 7, 1991-2005.

    [22] Jaafar, F., Nicolescu, G., & Richard, C. (2016, August). A systematic approach for privilege escalation prevention. In 2016 IEEE International Conference on Software Quality, Reliability and Security Companion (QRS-C) (pp. 101-108). IEEE.

    [23] Khalil, I. M., Khreishah, A., & Azeem, M. (2014). Cloud computing security: A survey. Computers, 3(1), 1-35.

  • Downloads