A multi-log approach for horizontal privilege escalation detection: A comparative evaluation of machine learning models
Horizontal Privilege Escalation (HPE) is a challenging access control vulnerability because it is performed by authenticated users whose activities closely resemble legitimate behavior, making detection difficult for conventional security mechanisms. Most existing studies rely on single-log analysis, which limits their ability to capture behavioral patterns distributed across multiple log sources. This study presents a comparative analysis of three supervised machine learning algorithms—Support Vector Machine (SVM), Random Forest, and XGBoost—for HPE detection in web applications using a multi-log correlation framework. The proposed approach integrates authentication, access, and activity logs to construct a behavior-oriented feature representation. Experiments were conducted on the publicly available Access-Log-Anomaly-Detection-Dataset containing 5,000 labeled records. The models were trained using stratified five-fold cross-validation and evaluated using Accuracy, Precision, Recall, F1-score, and ROC-AUC. Experimental results show that all models achieved comparable performance, with accuracies ranging from 84.0% to 85.1% and ROC-AUC values above 0.92. Random Forest achieved the highest Accuracy (85.1%) and F1-score (0.8216), while SVM obtained the highest Recall (0.8378) and XGBoost the highest Precision (0.8203). These findings demonstrate that multi-log correlation combined with behavior-oriented feature engineering provides an effective foundation for machine learning-based HPE detection in web applications.