Predicting Adversary Lateral Movement Patterns with Deep Learning

TL;DR

This paper presents a deep learning model that predicts the next host an adversary might compromise in an enterprise network, aiding in proactive defense strategies by leveraging simulated and real Red Team data.

Contribution

It introduces a novel deep learning approach for predicting adversary lateral movement patterns using both simulated and real-world enterprise network data.

Findings

High predictive accuracy on simulated data

Effective validation against Red Team event data

Potential for enhancing proactive cybersecurity defenses

Abstract

This paper develops a predictive model for which host, in an enterprise network, an adversary is likely to compromise next in the course of a campaign. Such a model might support dynamic monitoring or defenses. We generate data for this model using simulated networks, with hosts, users, and adversaries as first-class entities. We demonstrate the predictive accuracy of the model on out-of-sample simulated data, and validate the findings against data captured from a Red Team event on a live enterprise network