Unsupervised Learning for Lateral-Movement-Based Threat Mitigation in Active Directory Attack Graphs

Cybersecurity threats, particularly those involving lateral movement within networks, pose significant risks to critical infrastructures such as Microsoft Active Directory. This study addresses the need for effective defense mechanisms that minimize network disruption while preventing attackers from...

Full description

Saved in:
Bibliographic Details
Published in:Electronics (Basel) 2024-10, Vol.13 (19), p.3944
Main Authors: Herranz-Oliveros, David, Tejedor-Romero, Marino, Gimenez-Guzman, Jose Manuel, Cruz-Piris, Luis
Format: Article
Language:English
Subjects:
Algorithms
Clustering
Critical infrastructure
Cybersecurity
Cyberterrorism
Epidemiology
Graph theory
Graphs
Immunization
Infrastructure
Machine learning
Nodes
Performance evaluation
Propagation
Ransomware
Security software
Social networks
Threat evaluation
Threats
Unsupervised learning
Citations: Items that this one cites
Online Access:Get full text
Tags: Add Tag
No Tags, Be the first to tag this record!
Description
Summary:Cybersecurity threats, particularly those involving lateral movement within networks, pose significant risks to critical infrastructures such as Microsoft Active Directory. This study addresses the need for effective defense mechanisms that minimize network disruption while preventing attackers from reaching key assets. Modeling Active Directory networks as a graph in which the nodes represent the network components and the edges represent the logical interactions between them, we use centrality metrics to derive the impact of hardening nodes in terms of constraining the progression of attacks. We propose using Unsupervised Learning techniques, specifically density-based clustering algorithms, to identify those nodes given the information provided by their metrics. Our approach includes simulating attack paths using a snowball model, enabling us to analytically evaluate the impact of hardening on delaying Domain Administration compromise. We tested our methodology on both real and synthetic Active Directory graphs, demonstrating that it can significantly slow down the propagation of threats from reaching the Domain Administration across the studied scenarios. Additionally, we explore the potential of these techniques to enable flexible selection of the number of nodes to secure. Our findings suggest that the proposed methods significantly enhance the resilience of Active Directory environments against targeted cyber-attacks.
ISSN:2079-9292
2079-9292
DOI:10.3390/electronics13193944