{"id":"https://openalex.org/W4375928287","doi":"https://doi.org/10.1109/access.2023.3273895","title":"Privilege Escalation Attack Detection and Mitigation in Cloud Using Machine Learning","display_name":"Privilege Escalation Attack Detection and Mitigation in Cloud Using Machine Learning","publication_year":2023,"publication_date":"2023-01-01","ids":{"openalex":"https://openalex.org/W4375928287","doi":"https://doi.org/10.1109/access.2023.3273895"},"language":"en","primary_location":{"id":"doi:10.1109/access.2023.3273895","is_oa":true,"landing_page_url":"https://doi.org/10.1109/access.2023.3273895","pdf_url":"https://ieeexplore.ieee.org/ielx7/6287639/10005208/10121031.pdf","source":{"id":"https://openalex.org/S2485537415","display_name":"IEEE Access","issn_l":"2169-3536","issn":["2169-3536"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Access","raw_type":"journal-article"},"type":"article","indexed_in":["crossref","doaj"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://ieeexplore.ieee.org/ielx7/6287639/10005208/10121031.pdf","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5108829833","display_name":"Muhammad Mehmood","orcid":null},"institutions":[{"id":"https://openalex.org/I173207729","display_name":"University of Engineering and Technology Taxila","ror":"https://ror.org/03v00ka07","country_code":"PK","type":"education","lineage":["https://openalex.org/I173207729"]}],"countries":["PK"],"is_corresponding":false,"raw_author_name":"Muhammad Mehmood","raw_affiliation_strings":["Department of Computer Science, University of Engineering and Technology at Taxila, Taxila, Pakistan"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Computer Science, University of Engineering and Technology at Taxila, Taxila, Pakistan","institution_ids":["https://openalex.org/I173207729"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5007077685","display_name":"Rashid Amin","orcid":"https://orcid.org/0000-0002-3143-689X"},"institutions":[{"id":"https://openalex.org/I173207729","display_name":"University of Engineering and Technology Taxila","ror":"https://ror.org/03v00ka07","country_code":"PK","type":"education","lineage":["https://openalex.org/I173207729"]}],"countries":["PK"],"is_corresponding":false,"raw_author_name":"Rashid Amin","raw_affiliation_strings":["Department of Computer Science, University of Engineering and Technology at Taxila, Taxila, Pakistan","Department of Computer Science, University of Chakwal, Chakwal, Pakistan"],"raw_orcid":"https://orcid.org/0000-0002-3143-689X","affiliations":[{"raw_affiliation_string":"Department of Computer Science, University of Engineering and Technology at Taxila, Taxila, Pakistan","institution_ids":["https://openalex.org/I173207729"]},{"raw_affiliation_string":"Department of Computer Science, University of Chakwal, Chakwal, Pakistan","institution_ids":[]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5081976403","display_name":"Muhana Magboul Ali Muslam","orcid":"https://orcid.org/0000-0002-0238-4162"},"institutions":[{"id":"https://openalex.org/I240666556","display_name":"Imam Mohammad ibn Saud Islamic University","ror":"https://ror.org/05gxjyb39","country_code":"SA","type":"education","lineage":["https://openalex.org/I240666556"]}],"countries":["SA"],"is_corresponding":false,"raw_author_name":"Muhana Magboul Ali Muslam","raw_affiliation_strings":["Department of Information Technology, Imam Mohammad Ibn Saud Islamic University, Riyadh, Saudi Arabia"],"raw_orcid":"https://orcid.org/0000-0002-0238-4162","affiliations":[{"raw_affiliation_string":"Department of Information Technology, Imam Mohammad Ibn Saud Islamic University, Riyadh, Saudi Arabia","institution_ids":["https://openalex.org/I240666556"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5019147177","display_name":"Jiang Xie","orcid":"https://orcid.org/0000-0003-0683-4308"},"institutions":[{"id":"https://openalex.org/I102149020","display_name":"University of North Carolina at Charlotte","ror":"https://ror.org/04dawnj30","country_code":"US","type":"education","lineage":["https://openalex.org/I102149020"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Jiang Xie","raw_affiliation_strings":["Department of Electrical and Computer Engineering, The University of North Carolina at Charlotte (UNC-Charlotte), Charlotte, NC, USA"],"raw_orcid":"https://orcid.org/0000-0003-0683-4308","affiliations":[{"raw_affiliation_string":"Department of Electrical and Computer Engineering, The University of North Carolina at Charlotte (UNC-Charlotte), Charlotte, NC, USA","institution_ids":["https://openalex.org/I102149020"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5029317503","display_name":"Hamza Aldabbas","orcid":"https://orcid.org/0000-0002-4141-0079"},"institutions":[{"id":"https://openalex.org/I33926330","display_name":"Al-Balqa Applied University","ror":"https://ror.org/00qedmt22","country_code":"JO","type":"education","lineage":["https://openalex.org/I33926330"]}],"countries":["JO"],"is_corresponding":false,"raw_author_name":"Hamza Aldabbas","raw_affiliation_strings":["Prince Abdullah bin Ghazi Faculty of Information and Communication Technology, Al-Balqa Applied University, Al-Salt, Jordan"],"raw_orcid":"https://orcid.org/0000-0002-4141-0079","affiliations":[{"raw_affiliation_string":"Prince Abdullah bin Ghazi Faculty of Information and Communication Technology, Al-Balqa Applied University, Al-Salt, Jordan","institution_ids":["https://openalex.org/I33926330"]}]}],"institutions":[],"countries_distinct_count":4,"institutions_distinct_count":4,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":{"value":1850,"currency":"USD","value_usd":1850},"apc_paid":{"value":1850,"currency":"USD","value_usd":1850},"fwci":8.1164,"has_fulltext":true,"cited_by_count":61,"citation_normalized_percentile":{"value":0.98163606,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":97,"max":100},"biblio":{"volume":"11","issue":null,"first_page":"46561","last_page":"46576"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.9993000030517578,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11512","display_name":"Anomaly Detection Techniques and Applications","score":0.9983999729156494,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.8327059745788574},{"id":"https://openalex.org/keywords/machine-learning","display_name":"Machine learning","score":0.7309295535087585},{"id":"https://openalex.org/keywords/cloud-computing","display_name":"Cloud computing","score":0.6796626448631287},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.6419751644134521},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.5736811757087708},{"id":"https://openalex.org/keywords/insider-threat","display_name":"Insider threat","score":0.5461985468864441},{"id":"https://openalex.org/keywords/insider","display_name":"Insider","score":0.5210146903991699},{"id":"https://openalex.org/keywords/context","display_name":"Context (archaeology)","score":0.5065666437149048},{"id":"https://openalex.org/keywords/adaboost","display_name":"AdaBoost","score":0.4621177017688751},{"id":"https://openalex.org/keywords/overhead","display_name":"Overhead (engineering)","score":0.4585655927658081},{"id":"https://openalex.org/keywords/ensemble-learning","display_name":"Ensemble learning","score":0.4153677523136139},{"id":"https://openalex.org/keywords/privilege","display_name":"Privilege (computing)","score":0.41527581214904785},{"id":"https://openalex.org/keywords/support-vector-machine","display_name":"Support vector machine","score":0.22205469012260437},{"id":"https://openalex.org/keywords/operating-system","display_name":"Operating system","score":0.096437007188797}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8327059745788574},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.7309295535087585},{"id":"https://openalex.org/C79974875","wikidata":"https://www.wikidata.org/wiki/Q483639","display_name":"Cloud computing","level":2,"score":0.6796626448631287},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.6419751644134521},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.5736811757087708},{"id":"https://openalex.org/C2776633304","wikidata":"https://www.wikidata.org/wiki/Q6038026","display_name":"Insider threat","level":3,"score":0.5461985468864441},{"id":"https://openalex.org/C2778971194","wikidata":"https://www.wikidata.org/wiki/Q1664551","display_name":"Insider","level":2,"score":0.5210146903991699},{"id":"https://openalex.org/C2779343474","wikidata":"https://www.wikidata.org/wiki/Q3109175","display_name":"Context (archaeology)","level":2,"score":0.5065666437149048},{"id":"https://openalex.org/C141404830","wikidata":"https://www.wikidata.org/wiki/Q2823869","display_name":"AdaBoost","level":3,"score":0.4621177017688751},{"id":"https://openalex.org/C2779960059","wikidata":"https://www.wikidata.org/wiki/Q7113681","display_name":"Overhead (engineering)","level":2,"score":0.4585655927658081},{"id":"https://openalex.org/C45942800","wikidata":"https://www.wikidata.org/wiki/Q245652","display_name":"Ensemble learning","level":2,"score":0.4153677523136139},{"id":"https://openalex.org/C2780138299","wikidata":"https://www.wikidata.org/wiki/Q3404265","display_name":"Privilege (computing)","level":2,"score":0.41527581214904785},{"id":"https://openalex.org/C12267149","wikidata":"https://www.wikidata.org/wiki/Q282453","display_name":"Support vector machine","level":2,"score":0.22205469012260437},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.096437007188797},{"id":"https://openalex.org/C86803240","wikidata":"https://www.wikidata.org/wiki/Q420","display_name":"Biology","level":0,"score":0.0},{"id":"https://openalex.org/C17744445","wikidata":"https://www.wikidata.org/wiki/Q36442","display_name":"Political science","level":0,"score":0.0},{"id":"https://openalex.org/C151730666","wikidata":"https://www.wikidata.org/wiki/Q7205","display_name":"Paleontology","level":1,"score":0.0},{"id":"https://openalex.org/C199539241","wikidata":"https://www.wikidata.org/wiki/Q7748","display_name":"Law","level":1,"score":0.0}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.1109/access.2023.3273895","is_oa":true,"landing_page_url":"https://doi.org/10.1109/access.2023.3273895","pdf_url":"https://ieeexplore.ieee.org/ielx7/6287639/10005208/10121031.pdf","source":{"id":"https://openalex.org/S2485537415","display_name":"IEEE Access","issn_l":"2169-3536","issn":["2169-3536"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Access","raw_type":"journal-article"},{"id":"pmh:oai:doaj.org/article:93bad870bd414179ae96e4a615a1fc9a","is_oa":true,"landing_page_url":"https://doaj.org/article/93bad870bd414179ae96e4a615a1fc9a","pdf_url":null,"source":{"id":"https://openalex.org/S4306401280","display_name":"DOAJ (DOAJ: Directory of Open Access Journals)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by-sa","license_id":"https://openalex.org/licenses/cc-by-sa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"IEEE Access, Vol 11, Pp 46561-46576 (2023)","raw_type":"article"}],"best_oa_location":{"id":"doi:10.1109/access.2023.3273895","is_oa":true,"landing_page_url":"https://doi.org/10.1109/access.2023.3273895","pdf_url":"https://ieeexplore.ieee.org/ielx7/6287639/10005208/10121031.pdf","source":{"id":"https://openalex.org/S2485537415","display_name":"IEEE Access","issn_l":"2169-3536","issn":["2169-3536"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Access","raw_type":"journal-article"},"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G2851479740","display_name":null,"funder_award_id":"RP-21-07-05","funder_id":"https://openalex.org/F4320321420","funder_display_name":"Imam Mohammed Ibn Saud Islamic University"}],"funders":[{"id":"https://openalex.org/F4320321420","display_name":"Imam Mohammed Ibn Saud Islamic University","ror":"https://ror.org/05gxjyb39"}],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W4375928287.pdf","grobid_xml":"https://content.openalex.org/works/W4375928287.grobid-xml"},"referenced_works_count":39,"referenced_works":["https://openalex.org/W2308730378","https://openalex.org/W2521561526","https://openalex.org/W2624122013","https://openalex.org/W2755038437","https://openalex.org/W2780890111","https://openalex.org/W2790664081","https://openalex.org/W2791756253","https://openalex.org/W2808709910","https://openalex.org/W2861867928","https://openalex.org/W2863550520","https://openalex.org/W2888160480","https://openalex.org/W2889717770","https://openalex.org/W2915213244","https://openalex.org/W2929803724","https://openalex.org/W2943427313","https://openalex.org/W2976051608","https://openalex.org/W3000429356","https://openalex.org/W3009078472","https://openalex.org/W3010384713","https://openalex.org/W3021003742","https://openalex.org/W3027815439","https://openalex.org/W3037565679","https://openalex.org/W3040266635","https://openalex.org/W3081308505","https://openalex.org/W3088547738","https://openalex.org/W3094360729","https://openalex.org/W3102089875","https://openalex.org/W3123817474","https://openalex.org/W3135550350","https://openalex.org/W3155559132","https://openalex.org/W3161919951","https://openalex.org/W3170808115","https://openalex.org/W3193761457","https://openalex.org/W4220705580","https://openalex.org/W4220821464","https://openalex.org/W4281654741","https://openalex.org/W4296350759","https://openalex.org/W6763672751","https://openalex.org/W6799594631"],"related_works":["https://openalex.org/W2766781562","https://openalex.org/W4205304595","https://openalex.org/W2979782961","https://openalex.org/W308359497","https://openalex.org/W1499596878","https://openalex.org/W3136170567","https://openalex.org/W2947769183","https://openalex.org/W2018332730","https://openalex.org/W4387194049","https://openalex.org/W2286217954"],"abstract_inverted_index":{"Because":[0],"of":[1,13,56,184,193,210,219,304],"the":[2,11,23,31,53,78,181,185,208,220,294,297,301,306],"recent":[3],"exponential":[4],"rise":[5],"in":[6,165,198,289],"attack":[7],"frequency":[8],"and":[9,62,68,85,96,101,114,118,133,150,163,190,235,242,317],"sophistication,":[10],"proliferation":[12],"smart":[14],"things":[15],"has":[16,28],"created":[17],"significant":[18,89],"cybersecurity":[19],"challenges.":[20],"Even":[21],"though":[22],"tremendous":[24],"changes":[25],"cloud":[26,63],"computing":[27],"brought":[29],"to":[30,39,52,77,87,99,123,131,168,239,284],"business":[32],"world,":[33],"its":[34],"centralization":[35],"makes":[36],"it":[37],"challenging":[38],"use":[40],"distributed":[41],"services":[42],"like":[43],"security":[44,134,170],"systems.":[45],"Valuable":[46],"data":[47,57],"breaches":[48],"might":[49],"occur":[50],"due":[51],"high":[54],"volume":[55],"that":[58,128,240],"moves":[59],"between":[60],"businesses":[61],"service":[64],"suppliers,":[65],"both":[66],"accidental":[67],"malicious.":[69],"The":[70],"malicious":[71],"insider":[72,111,211],"becomes":[73],"a":[74,106,120,286],"crucial":[75],"threat":[76,112],"organization":[79],"since":[80],"they":[81],"have":[82,157],"more":[83,278],"access":[84,98],"opportunity":[86],"produce":[88],"damage.":[90],"Unlike":[91],"outsiders,":[92],"insiders":[93],"possess":[94],"privileged":[95],"proper":[97,182],"information":[100],"resources.":[102],"In":[103],"this":[104,199],"work,":[105],"machine":[107,147,204,226,281],"learning-based":[108],"system":[109],"for":[110,207,276],"detection":[113],"classification":[115,209,288],"is":[116,223,274],"proposed":[117,295],"developed":[119],"systematic":[121],"approach":[122],"identify":[124],"various":[125],"anomalous":[126],"occurrences":[127],"may":[129,258],"point":[130],"anomalies":[132],"problems":[135],"associated":[136],"with":[137],"privilege":[138,175],"escalation.":[139,176],"By":[140],"combining":[141],"many":[142],"models,":[143],"ensemble":[144],"learning":[145,148,195,205,227,282],"enhances":[146],"outcomes":[149],"enables":[151],"greater":[152],"prediction":[153],"performance.":[154],"Multiple":[155],"studies":[156,179],"been":[158],"presented":[159],"regarding":[160],"detecting":[161],"irregularities":[162],"vulnerabilities":[164],"network":[166],"systems":[167],"find":[169],"flaws":[171],"or":[172,256,268],"threats":[173],"involving":[174],"But":[177],"these":[178],"lack":[180],"identification":[183],"attacks.":[186,212,271,292],"This":[187,201],"study":[188],"proposes":[189],"evaluates":[191],"ensembles":[192],"Machine":[194],"(ML)":[196],"techniques":[197],"context.":[200],"paper":[202],"implements":[203],"algorithms":[206],"A":[213],"customized":[214],"dataset":[215,222,241],"from":[216],"multiple":[217,290],"files":[218],"CERT":[221],"used.":[224],"Four":[225],"algorithms,":[228,252,296],"i.e.,":[229],"Random":[230],"Forest":[231],"(RF),":[232],"Adaboost,":[233],"XGBoost,":[234],"LightGBM,":[236],"are":[237,310],"applied":[238],"analyzed":[243],"results.":[244],"Overall,":[245],"LightGBM":[246,298],"performed":[247],"best.":[248],"However,":[249],"some":[250,262],"other":[251,269,307],"such":[253],"as":[254],"RF":[255,311],"AdaBoost,":[257],"perform":[259],"better":[260],"on":[261],"internal":[263,270,291],"attacks":[264],"(Behavioral":[265],"Biometrics":[266],"attacks)":[267],"Therefore,":[272],"there":[273],"room":[275],"incorporating":[277],"than":[279],"one":[280],"algorithm":[283,299],"obtain":[285],"stronger":[287],"Among":[293],"provides":[300],"highest":[302],"accuracy":[303,308],"97%;":[305],"values":[309],"at":[312,315,319],"86%,":[313],"AdaBoost":[314],"88%,":[316],"XGBoost":[318],"88.27%.":[320]},"counts_by_year":[{"year":2026,"cited_by_count":11},{"year":2025,"cited_by_count":27},{"year":2024,"cited_by_count":18},{"year":2023,"cited_by_count":5}],"updated_date":"2026-07-25T15:57:00.446498","created_date":"2025-10-10T00:00:00"}