International Symposium on Telecommunication (IST)

Home / 11th International Symposium on Telecommunication (IST'2024)

Lateral movement detection through a heteregenous GNN model of kernel-level log

Authors :

Faezeh Alizadeh¹ Mohammad Khansari² Abouzar Arabsorkhi³

1- university of tehran 2- university of tehran 3- Department of ICT security

Keywords :

Advanced Persistent Threat (APT)،Kernel-level log،Heterogenous Graph Neural Network (HGNN)،Lateral Movement

Abstract :

Lateral movement is a technique for complex attack scenarios such as Advanced Persistent Threat (APT) that the attacker moves laterally from one machine to another one and can infect all networks or systems of the organization. One of the ways to identify this threat is to check the kernel-level log for investigating the behavior or activity of a user who makes the processes and events that are suspicious. From the relationships between different processes and events and their characteristics, a malicious activity can be identified, which can indicate the presence of an attacker. Therefore, regarding this point of view, we form a Heterogenous Graph Neural Network (HGNN) by considering these relationships. We apply the proposed method on the public labeled kernel-level log of BETH dataset that gathered in 23 honeypots. We reach 99.4% accuracy and evaluate the HGNN model by precision and recall. This is a good result to detect the presence of an attacker with a lateral movement behavior.