  Lateral Movement refers to methods by which threat actors gain initial access
to a network and then progressively move through said network collecting key
data about assets until they reach the ultimate target of their attack. Lateral
Movement intrusions have become more intricate with the increasing complexity
and interconnected nature of enterprise networks, and require equally
sophisticated detection mechanisms to proactively detect such threats in near
real-time at enterprise scale. In this paper, the authors propose a novel,
lightweight method for Lateral Movement detection using user behavioral
analysis and machine learning. Specifically, this paper introduces a novel
methodology for cyber domain-specific feature engineering that identifies
Lateral Movement behavior on a per-user basis. Furthermore, the engineered
features have also been used to develop two supervised machine learning models
for Lateral Movement identification that have demonstrably outperformed models
previously seen in literature while maintaining robust performance on datasets
with high class imbalance. The models and methodology introduced in this paper
have also been designed in collaboration with security operators to be relevant
and interpretable in order to maximize impact and minimize time to value as a
cyber threat detection toolkit. The underlying goal of the paper is to provide
a computationally efficient, domain-specific approach to near real-time Lateral
Movement detection that is interpretable and robust to enterprise-scale data
volumes and class imbalance.
