An Intelligent Cloud Security Framework Integrating Machine Learning-Driven Behavioral Analysis with Dynamic Role-Based Access Control and a CP-ABE-Inspired Attribute-Based Encryption Scheme

Abstract

Cloud computing has become the most popular paradigm for scalable and on-demand data storage and services provision; nonetheless, storing data in third-party servers raises various security concerns such as access control breaches, insider attacks, privilege escalation, and misuse of static policies. Classical Role-Based Access Control (RBAC) uses immutable roles that do not react to user activities, while Ciphertext-Policy Attribute-Based Encryption (CP-ABE) uses flexible but still immutable policies and is not capable of performing behavioral analysis. The current study presents a hybrid cloud computing security system where Machine Learning (ML) behavioral risks analysis is combined with RBAC and an attribute-based encryption system inspired by CP-ABE to achieve adaptive behavior-aware access control. The attribute-based encryption system is designed with the help of attribute-keyed HKDF key derivation and not the pairing-based CP-ABE cryptographic protocol: it implements CP-ABE-like access policy and revocation but it lacks security proof based on the DBDH problem. The system is continuously learning behavioral feature vectors based on login frequency, changes in IP geolocation, request rate, deviation in access times, sensitivity of the role, and entropy of files accesses and then combining outputs of RF, SVM, and IF classifiers to get a weighted behavioral risk score. This score is used to update the RBAC roles and attribute-based access policies automatically, i.e., without any need for administrator's involvement, thus reducing the detection to revocation gap characteristic of traditional systems. Files are additionally pre-scanned using the Random Forest malware classifier that learns based on the entropy and structure of files before being encrypted with Fernet (AES-128) based on the policy-defined key using SHA-256 for integrity checks. The system was prototyped on AWS S3, MongoDB, and Flask. In our evaluations, the malware detection module showed 94% accuracy (93% precision, 95% recall, 94% F1 score) compared to 82% in the case of signature-based solution, the risk engine reached 92% unauthorized-access detection, and the suggested hybrid encryption pipeline (policy layer inspired by CP-ABE + Fernet) introduced 2.1 seconds extra time for encryption and 1.8 seconds for decryption per 5MB file compared to 0.8/0.7 seconds for AES.