# Role-based lateral movement detection with unsupervised learning

arXiv: https://arxiv.org/abs/2108.02713 · HTML: https://mlsanity.com/paper/2108.02713/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 8 of its 123 references that are in the map.
- First posted on arXiv 5 Aug 2021.

## Builds on (most cited first, 8 of 8)

- [HOLMES: Real-time APT Detection through Correlation of Suspicious Information Flows](https://mlsanity.com/paper/1810.01594/) (2018)
- [The Minimum Description Length Principle for Pattern Mining: A Survey](https://mlsanity.com/paper/2007.14009/) (2020)
- [The Long and the Short of It: Summarising Event Sequences with Serial Episodes](https://mlsanity.com/paper/1902.02834/) (2019)
- [Efficiently Summarising Event Sequences with Rich Interleaving Patterns](https://mlsanity.com/paper/1701.08096/) (2017)
- [A comparative evaluation of novelty detection algorithms for discrete sequences](https://mlsanity.com/paper/1902.10940/) (2019)
- [A Subsequence Interleaving Model for Sequential Pattern Mining](https://mlsanity.com/paper/1602.05012/) (2016)
- [Detecting malicious logins as graph anomalies](https://mlsanity.com/paper/1909.09047/) (2019)
- [Insider Threat Detection Through Attributed Graph Clustering](https://mlsanity.com/paper/1809.00231/) (2018)

## Abstract (arXiv)

Adversarial lateral movement via compromised accounts remains difficult to discover via traditional rule-based defenses because it generally lacks explicit indicators of compromise. We propose a behavior-based, unsupervised framework comprising two methods of lateral movement detection on enterprise networks: one aimed at generic lateral movement via either exploit or authenticated connections, and one targeting the specific techniques of process injection and hijacking. The first method is based on the premise that the role of a system---the functions it performs on the network---determines the roles of the systems it should make connections with. The adversary meanwhile might move between any systems whatever, possibly seeking out systems with unusual roles that facilitate certain accesses. We use unsupervised learning to cluster systems according to role and identify connections to systems with novel roles as potentially malicious. The second method is based on the premise that the temporal patterns of inter-system processes that facilitate these connections depend on the roles of the systems involved. If a process is compromised by an attacker, these normal patterns might be disrupted in discernible ways. We apply frequent-itemset mining to process sequences to establish regular patterns of communication between systems based on role, and identify rare process sequences as signalling potentially malicious connections.