Predictive Analytics in Cloud-Native Privilege-Escalation Detection: Enhancing Accuracy Through Temporal Graph Attention and Reinforcement Learning

Abstract

Due to the explosive growth in cloud-native infrastructures, the attack surface has dramatically increased in modern enterprise identity systems, where privilege escalation has become a major security risk. Conventional rule-based intrusion detection systems fall short in identifying multi-hop privilege inheritance paths and lateral movements over heterogeneous and dynamic identity graphs. This study introduces PEGraphSec-Net, a graph-theoretical framework for detecting privilege-escalation-relevant identity behavior, modeling cloud identity interactions as dynamic heterogeneous graphs of users, services, roles, tokens, and workloads. The core contribution of this framework is a graph-based detection pipeline—an Identity Relationship Graph Constructor, a Privilege-Escalation Path Encoder, and a Temporal Graph Attention Detection layer—evaluated on privilege-escalation-relevant attack categories using a documented proxy identity-graph construction derived from the UNSW-NB15 network-traffic benchmark, and benchmarked against six non-graph tabular classifiers (CNN, LightGBM, XGBoost, Random Forest, SVM, and MLP) trained under identical preprocessing; this pipeline achieves 98.78% accuracy, a weighted F1-score of 0.98692 (macro F1-score of 0.91828), and an AUC of 1.000 on the held-out test partition. PEGraphSec-Net is further benchmarked against three graph neural network baselines (GCN, GAT, and GraphSAGE) trained on the identical identity-graph topology and node attributes; all three substantially underperform PEGraphSec-Net (best case, GraphSAGE: 63.66% accuracy, 0.239 macro F1-score), indicating that a large share of PEGraphSec-Net’s performance derives from its explicit privilege-path encoding and temporal attention mechanisms rather than from the graph topology alone. An Adaptive Containment and Isolation Engine and a Mitigation Policy Reinforcement Optimizer are further proposed as risk-scoring and reward-driven policy-learning components, whose contribution is validated through module-wise ablation on classification performance; live containment action and reinforcement-learning-specific evaluation are left for future validation. The term “privilege escalation” is used throughout to denote the evaluated proxy attack categories (Exploits, Backdoor/Backdoors, and Reconnaissance) under a documented, decade-old (2015) network-intrusion benchmark, rather than production cloud-native IAM behavior, for which native-dataset validation remains an open direction. SHAP-based interpretability analysis links the model’s top-ranked traffic-level features back to the identity-graph risk, role, and trust-transition attributes they populate, evidencing that the learned representation captures semantically meaningful identity-behavior patterns within this proxy setting.