English (United Kingdom)

https://curated-unify.zendy.io/wp-json/zendy-region/v1/featured_content/oa?rat=en

https://curated-unify.zendy.io/wp-json/zendy-region/v1/highlighted_journal/

Global: Zendy Plus annual

Presents the access of premium content as premium feature

Premium Content

Presents the keyphrase highlighting as premium feature

Keyphrase Highlighting

Presents the summarisation as premium feature

Summarisation

Insights

Presents the pdf analysis as premium feature

PDF Analysis

Presents the zaia usage as premium feature

ZAIA

Global: Zendy Plus monthly

Global: Zendy Tools annual

Global: Zendy Tools monthly

Global: Zendy Free Plan

In successful enterprise attacks, adversaries often need to gain access toadditional machines beyond their initial point of compromise, a set of internalmovements known as lateral movement. We present Hopper, a system for detectinglateral movement based on commonly available enterprise logs. Hopper constructsa graph of login activity among internal machines and then identifiessuspicious sequences of loginsthat correspond to lateral movement. Tounderstand the larger context of each login, Hopper employs an inferencealgorithm to identify the broader path(s) of movement that each login belongsto and the causal user responsible for performing a path's logins. Hopper thenleverages this path inference algorithm, in conjunction with a set of detectionrules and a new anomaly scoring algorithm, to surface the login paths mostlikely to reflect lateral movement. On a 15-month enterprise dataset consistingof over 780 million internal logins, Hop-per achieves a 94.5% detection rateacross over 300 realistic attack scenarios, including one red team attack,while generating an average of <9 alerts per day. In contrast, to detect thesame number of attacks, prior state-of-the-art systems would need to generatenearly 8x as many false positives.

Hopper: Modeling and Detecting Lateral Movement (Extended Report)