RoleSentry: A Multi-Stage Framework for Explainable Detection of AWS Role Chaining Attacks

Godwin Attigah, Austin Gansz
Proceedings of the 2025 Conference on Applied Machine Learning for Information Security, PMLR 299:239-264, 2025.

Abstract

AWS AssumeRole enables essential automation but also provides attackers with a primary mechanism for privilege escalation and lateral movement. Security teams face two critical challenges: identifying suspicious individual AssumeRole events within overwhelming legitimate activity and detecting when sequences of seemingly benign events form malicious role-chaining attacks. RoleSentry addresses both challenges through a novel three-stage framework combining behavioral filtering, ensemble anomaly detection, and graph neural networks. The system first applies a lightweight behavioral trait filter that automatically suppresses routine service-to-service automation, resulting in a 12.3% volume reduction with zero conflicting classifications. Filtered events undergo parallel analysis: an ensemble model scores individual events using contextual features, while a graph neural network analyzes temporal graphs to detect multi-step chaining patterns. The system provides SHAP-based explanations for analyst interpretation. We evaluated RoleSentry on a large corpus of AssumeRole events collected from over 30 days. Compared to Amazon GuardDuty, RoleSentry reduced false positive alerts by 98% and identified 25 sophisticated attacks that the commercial service missed entirely, includ-ing complex role-chaining scenarios. The results demonstrate that combining behavioral filtering with graph-based analysis provides operationally viable detection of both isolated and chained AssumeRole abuse.

Cite this Paper

BibTeX
@InProceedings{pmlr-v299-attigah25a, title = {RoleSentry: A Multi-Stage Framework for Explainable Detection of AWS Role Chaining Attacks}, author = {Attigah, Godwin and Gansz, Austin}, booktitle = {Proceedings of the 2025 Conference on Applied Machine Learning for Information Security}, pages = {239--264}, year = {2025}, editor = {Raff, Edward and Rudd, Ethan M.}, volume = {299}, series = {Proceedings of Machine Learning Research}, month = {22--24 Oct}, publisher = {PMLR}, pdf = {https://raw.githubusercontent.com/mlresearch/v299/main/assets/attigah25a/attigah25a.pdf}, url = {https://proceedings.mlr.press/v299/attigah25a.html}, abstract = {AWS AssumeRole enables essential automation but also provides attackers with a primary mechanism for privilege escalation and lateral movement. Security teams face two critical challenges: identifying suspicious individual AssumeRole events within overwhelming legitimate activity and detecting when sequences of seemingly benign events form malicious role-chaining attacks. RoleSentry addresses both challenges through a novel three-stage framework combining behavioral filtering, ensemble anomaly detection, and graph neural networks. The system first applies a lightweight behavioral trait filter that automatically suppresses routine service-to-service automation, resulting in a 12.3% volume reduction with zero conflicting classifications. Filtered events undergo parallel analysis: an ensemble model scores individual events using contextual features, while a graph neural network analyzes temporal graphs to detect multi-step chaining patterns. The system provides SHAP-based explanations for analyst interpretation. We evaluated RoleSentry on a large corpus of AssumeRole events collected from over 30 days. Compared to Amazon GuardDuty, RoleSentry reduced false positive alerts by 98% and identified 25 sophisticated attacks that the commercial service missed entirely, includ-ing complex role-chaining scenarios. The results demonstrate that combining behavioral filtering with graph-based analysis provides operationally viable detection of both isolated and chained AssumeRole abuse.} }
Endnote
%0 Conference Paper %T RoleSentry: A Multi-Stage Framework for Explainable Detection of AWS Role Chaining Attacks %A Godwin Attigah %A Austin Gansz %B Proceedings of the 2025 Conference on Applied Machine Learning for Information Security %C Proceedings of Machine Learning Research %D 2025 %E Edward Raff %E Ethan M. Rudd %F pmlr-v299-attigah25a %I PMLR %P 239--264 %U https://proceedings.mlr.press/v299/attigah25a.html %V 299 %X AWS AssumeRole enables essential automation but also provides attackers with a primary mechanism for privilege escalation and lateral movement. Security teams face two critical challenges: identifying suspicious individual AssumeRole events within overwhelming legitimate activity and detecting when sequences of seemingly benign events form malicious role-chaining attacks. RoleSentry addresses both challenges through a novel three-stage framework combining behavioral filtering, ensemble anomaly detection, and graph neural networks. The system first applies a lightweight behavioral trait filter that automatically suppresses routine service-to-service automation, resulting in a 12.3% volume reduction with zero conflicting classifications. Filtered events undergo parallel analysis: an ensemble model scores individual events using contextual features, while a graph neural network analyzes temporal graphs to detect multi-step chaining patterns. The system provides SHAP-based explanations for analyst interpretation. We evaluated RoleSentry on a large corpus of AssumeRole events collected from over 30 days. Compared to Amazon GuardDuty, RoleSentry reduced false positive alerts by 98% and identified 25 sophisticated attacks that the commercial service missed entirely, includ-ing complex role-chaining scenarios. The results demonstrate that combining behavioral filtering with graph-based analysis provides operationally viable detection of both isolated and chained AssumeRole abuse.
APA
Attigah, G. & Gansz, A.. (2025). RoleSentry: A Multi-Stage Framework for Explainable Detection of AWS Role Chaining Attacks. Proceedings of the 2025 Conference on Applied Machine Learning for Information Security, in Proceedings of Machine Learning Research 299:239-264 Available from https://proceedings.mlr.press/v299/attigah25a.html.

Related Material