Predicting Adversary Lateral Movement Patterns with Deep Learning

2021/04/23 by Danneman, Nathan, Hyde, James
#Cryptography and Security (cs.CR) #FOS: Computer and information sciences #Machine Learning (cs.LG)

paper · doi:10.48550/arxiv.2104.13195

Abstract

This paper develops a predictive model for which host, in an enterprise network, an adversary is likely to compromise next in the course of a campaign. Such a model might support dynamic monitoring or defenses. We generate data for this model using simulated networks, with hosts, users, and adversaries as first-class entities. We demonstrate the predictive accuracy of the model on out-of-sample simulated data, and validate the findings against data captured from a Red Team event on a live enterprise network

Related

• Role-based lateral movement detection with unsupervised learning
• Lateral Movement Detection Using User Behavioral Analysis
• D2M: Dynamic Defense and Modeling of Adversarial Movement in Networks
• Hopper: Modeling and Detecting Lateral Movement (Extended Report)
• Discovering Exfiltration Paths Using Reinforcement Learning with Attack Graphs