Detecting Privilege Escalation with Temporal Braid Groups

TL;DR

This paper introduces a novel method using the Burau Lyapunov exponent to identify and classify risk regimes in cloud permission graphs, enabling automated detection and remediation of privilege escalation risks.

Contribution

It presents a new algebraic approach leveraging the Lyapunov exponent to distinguish risk regimes in temporal cloud permission graphs, surpassing traditional Abelian statistics.

Findings

Lyapunov exponent effectively separates dispersed and focused risk regimes

Abelian statistics cannot determine the Lyapunov exponent

Method enables automated classification and remediation of risky permission flows

Abstract

Within the Strongly Connected Components (SCCs) formed during the temporal evolution of a Cloud permission graph, we use the Burau Lyapunov exponent LE as an algebraic probe to locate the boundary between two risks regimes. We prove that no Abelian statistic (edge counts, net privilege flow, gate-firing rates) can determine LE. The non-commutation advantage is small, but actionable: we show how to leverage it to discriminate the two outstanding risk regimes, that we call dispersed and focused, for automating classification and governing remediation of risky Cloud permission flows.