# What is graph-based detection of lateral movement?

Graph-based detection treats your network as a map of who talks to whom: each host is a point, each connection a line, and the map is compared with its usual shape over time. Lateral movement shows up as new lines that do not fit, such as a workstation suddenly connected to several servers, a chain of hops from one machine to the next, or a group of hosts all reaching the same new outside address. The advantage is context: a single new connection may be harmless, while a new path from a user's laptop through a file server to the backup server is not. The approach has been studied in academic research for years. From the Pro plan, NetSenX correlates hosts into such a graph, so that a scan followed by new remote sessions, or several hosts beaconing to one destination, appears as one story instead of scattered alerts.

FAQ: [Attack techniques explained](https://netsenx.com/en/faq/attacks) · https://netsenx.com/en/faq/what-is-graph-based-lateral-movement-detection

## Read next

- https://netsenx.com/en/detect-lateral-movement-c2-beaconing
- https://netsenx.com/en/is-someone-inside-your-network

## Related questions

- [Do rule-based security tools miss new attack paths?](https://netsenx.com/en/faq/do-rule-based-tools-miss-new-attack-paths)
- [Why would a printer scan our network, and can printers be used to attack other computers?](https://netsenx.com/en/faq/why-would-a-printer-scan-our-network)
- [How do we stop an attacker who is already in our network?](https://netsenx.com/en/faq/how-to-stop-an-attacker-already-in-our-network)
- [How fast do attackers move once they are inside?](https://netsenx.com/en/faq/how-fast-do-attackers-move-once-inside)
- [How do we know if the PC we use for online banking is infected?](https://netsenx.com/en/faq/is-the-pc-we-use-for-online-banking-infected)