On the detection of lateral movement through supervised machine learning and an open-source tool to create turnkey datasets from Sysmon logs

Abstract

Lateral movement (LM) is a principal, increasingly common, tactic in the arsenal of advanced persistent threat (APT) groups and other less or more powerful threat actors. It concerns techniques that enable a cyberattacker, after establishing foothold, to maintain ongoing access and penetrate further into a network in quest of prized booty. This is done by moving through the infiltrated network and gaining elevated privileges using an assortment of tools. Concentrating on the MS Windows platform, this work provides the first to our knowledge holistic methodology supported by an abundance of experimental results towards the identification of LM via machine learning (ML) techniques. We not only assess this potential by means of both traditional and deep learning models, but also contribute a publicly available, open-source tool, which can convert Windows system monitor logs to turnkey datasets, ready to be fed into ML models. Vis-`a-vis the relevant literature, and by considering a highly unblalanced dataset and a multiclass classification problem, we report superior scores in terms of the F1 and AUC metrics, 99.41% and 99.84%, respectively.