Machine Learning-Based Access Risk Detection in Cloud Identity and Access Management Systems

Abstract

Machine learning (ML) has been used for a long time in various areas such as computer vision, natural language processing, speech recognition, and healthcare. However, its application in detecting IAM access risks from cloud providers suffered from a lack of real-world datasets and evaluation. Although some non-ML access risk detection techniques have been proposed in the past, they mainly focused on a specific organization and were not generalizable across multiple domains. Thus, this study collected and labelled IAM access data, proposing 13 risk detection categories that could be used to evaluate ML-based access detection techniques. The work used the publicly available AccessRiskDataset to assess overall prediction accuracy, evaluated the impact of specific cloud IAM providers on Access Risk Detection, and analyzed the prediction performance for each risk detection category. The results demonstrated that the proposed access risk categories could be detected using ML techniques, thereby addressing one of the gaps.

Publicly available cloud IAM services are susceptible to attackers with access privileges. Malicious users can conduct illicit activities in IAM-authorized cloud services, and attackers can also employ social engineering techniques to get authorized access for malicious purposes (data theft or service interruption). Using inappropriate IAM settings or configurations increases the risk of situations where access can be mistakenly or purposely misused, resulting in potential data leaks, service interruptions, and other hazards for both businesses and consumers. Many common access-related issues have been decentralized either because multiple IAM cloud providers disregard their implications or because the lack of lengthy experience leads toward weaker solutions.