Surgical immunization strategies against lateral movement in Active Directory environments

Herranz-Oliveros, David; Marsa-Maestre, Ivan; Gimenez-Guzman, Jose Manuel; Tejedor-Romero, Marino; de la Hoz, Enrique

doi:10.1016/j.jnca.2023.103810

Journal of Network and Computer Applications

2024

DOI: 10.1016/j.jnca.2023.103810

|View full text |Cite

Surgical immunization strategies against lateral movement in Active Directory environments

David Herranz-Oliveros,

Ivan Marsa-Maestre,

Jose Manuel Gimenez-Guzman

et al.

Help me understand this report

Search citation statements

Order By: Relevance

Paper Sections

Select...

Citation Types

Supporting

Mentioning

Contrasting

Year Published

2024

Publication Types

Select...

Article1

Relationship

Self Cite0

Independent1

Authors

Journals

Cited by 1 publication

References 29 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

Unsupervised Learning for Lateral-Movement-Based Threat Mitigation in Active Directory Attack Graphs

Herranz-Oliveros,

Tejedor-Romero,

Gimenez-Guzman

et al. 2024

Electronics

View full text Add to dashboard Cite

Cybersecurity threats, particularly those involving lateral movement within networks, pose significant risks to critical infrastructures such as Microsoft Active Directory. This study addresses the need for effective defense mechanisms that minimize network disruption while preventing attackers from reaching key assets. Modeling Active Directory networks as a graph in which the nodes represent the network components and the edges represent the logical interactions between them, we use centrality metrics to derive the impact of hardening nodes in terms of constraining the progression of attacks. We propose using Unsupervised Learning techniques, specifically density-based clustering algorithms, to identify those nodes given the information provided by their metrics. Our approach includes simulating attack paths using a snowball model, enabling us to analytically evaluate the impact of hardening on delaying Domain Administration compromise. We tested our methodology on both real and synthetic Active Directory graphs, demonstrating that it can significantly slow down the propagation of threats from reaching the Domain Administration across the studied scenarios. Additionally, we explore the potential of these techniques to enable flexible selection of the number of nodes to secure. Our findings suggest that the proposed methods significantly enhance the resilience of Active Directory environments against targeted cyber-attacks.

show abstract

Unsupervised Learning for Lateral-Movement-Based Threat Mitigation in Active Directory Attack Graphs

Herranz-Oliveros,

Tejedor-Romero,

Gimenez-Guzman

et al. 2024

Electronics

View full text Add to dashboard Cite

show abstract

scite is a Brooklyn-based organization that helps researchers better discover and understand research articles through Smart Citations–citations that display the context of the citation and describe whether the article provides supporting or contrasting evidence. scite is used by students and researchers from around the world and is funded in part by the National Science Foundation and the National Institute on Drug Abuse of the National Institutes of Health.

Contact Info

customersupport@researchsolutions.com

10624 S. Eastern Ave., Ste. A-614

Henderson, NV 89052, USA

Blog Terms and Conditions API Terms Privacy Policy Contact Cookie Preferences Do Not Sell or Share My Personal Information

Made with 💙 for researchers

Part of the Research Solutions Family.

Surgical immunization strategies against lateral movement in Active Directory environments

Cited by 1 publication

References 29 publications

Unsupervised Learning for Lateral-Movement-Based Threat Mitigation in Active Directory Attack Graphs

Unsupervised Learning for Lateral-Movement-Based Threat Mitigation in Active Directory Attack Graphs

Contact Info

Product

Resources

About