Detection of Lateral Movement Across Valid Accounts by Using Human Behavior in the Physical Environment

No ratings

Presented at DFRWSUSA 2019 by

Tomohiko Yano

It becomes difficult to detect attackers intruding in the enterprise network.Attackers often perform lateral movement using stolen valid credentials so as to notleave evidence in the targeted network.We can leverage log on events, which show clues of log on to the computer, to identifythese attacks. However, from log on events, we can only get information about computernames and account names. Therefore, we cannot detect these attacks because we cannotactually determine whether an attacker or valid user logged in. Even for securityexperts, these attacks are difficult to detect because it is necessary to analyzea large amount of logs in light of information about the operation status of computersand accounts.In this research, we propose a method to detect lateral movement across valid accountsby using not only log on events, but also information on human behavior in the physicalenvironment obtained from sensors and input devices.Using physical environment information, it is possible to discover this lateralmovement rapidly if the log on event occurs even though the employee is not in thephysical environment. Furthermore, we can detect attacks independent of knowing thenormal operation status.We built two systems to demonstrate the effectiveness of our methods. One utilizeslog on events and distance sensors in front of the computer. The other employs logon and keystroke events.In this presentation, we will introduce results from evaluations of the detectionrate using simulated common lateral movement methods. We make sure that we can detectattacker log on events which could not be distinguished from normal log on events.