Cyber criminals attack governmental and corporate computer networks. Once they infect one computer, they are likely to explore the network by accessing additional computers. The process by which attackers move from one computer to the next in a compromised network is referred to as lateral movement, and exaggerates the difficulties of preventing data exfiltration.
Attacks that are directed towards organizations often begin with a spearphishing campaign aimed at targeted individuals which attempts to coerce the potential victims into installing malware on their computers by opening an attachment or clicking a malicious link. Once executed, the malware typically drops a backdoor providing the attacker with remote control over the infected computer. Next, the attacker begins to use lateral movement techniques to explore the network, i.e., the process an attacker uses to move from one computer to the next in a compromised network. This is usually done by logging onto additional computers using the user's compromised credentials, exploring or creating network shares to these computers in the network, or using known tools to execute programs on remote computers. Once the attacker successfully connects to additional computers in the network, they may install redundant backdoors to provide parallel communication channels in case the originally infected computer is discovered and disabled, e.g., by the organization's information technology (IT) staff.
Lateral movement can be viewed as a set of malicious paths corresponding to the attacker's activity within a large graph of benign connections created by the daily operation of the organization's users.
There are a number of challenges posed in trying to detect lateral movement. The computer connection history can be large in scale, with hundreds of thousands computers in datasets each generating an average of 200-300 connection events in a typical day. This large-scale data creates difficulties for both accurately detecting “infected” computers, as well as designing efficient algorithms that can execute in a reasonable amount of time. Another challenge is that there are different types of computers on typical networks, including stand-alone desktops, mobile laptops, and a wide variety of servers exhibiting large numbers of network connections. The varying behaviors exhibited by each class of computers introduce additional noise into the connection data.