What is graph-based detection of lateral movement?
Graph-based detection treats your network as a map of who talks to whom: each host is a point, each connection a line, and the map is compared with its usual shape over time. Lateral movement shows up as new lines that do not fit, such as a workstation suddenly connected to several servers, a chain of hops from one machine to the next, or a group of hosts all reaching the same new outside address. The advantage is context: a single new connection may be harmless, while a new path from a user's laptop through a file server to the backup server is not. The approach has been studied in academic research for years. From the Pro plan, NetSenX correlates hosts into such a graph, so that a scan followed by new remote sessions, or several hosts beaconing to one destination, appears as one story instead of scattered alerts.
Read next
Related questions
- Do rule-based security tools miss new attack paths?
- Why would a printer scan our network, and can printers be used to attack other computers?
- How do we stop an attacker who is already in our network?
- How fast do attackers move once they are inside?
- How do we know if the PC we use for online banking is infected?