RDP-based Lateral Movement detection using Machine Learning

摘要: Abstract Detecting cyber threats has been an on-going research endeavor. In this era, Advanced Persistent Threats (APTs) can incur significant costs for organizations and businesses. The ultimate goal of cybersecurity is to thwart attackers from achieving their malicious intent, whether it credential stealing, infrastructure takeover, or program sabotage. Every attack goes through several stages before its termination. Lateral Movement (LM) one those that particular importance. Remote Desktop Protocol (RDP) a method used in LM successfully authenticate unauthorized host leaves footprints on both network logs. paper, we propose detect evidence using Machine Learning (ML) Windows RDP event We explore different feature sets extracted these logs evaluate various supervised ML techniques classifying sessions with high precision recall. also compare the performance our proposed approach state-of-the-art demonstrate model outperforms addition, show robust against certain types adversarial attacks.