Researchers develop tool to detect lateral movement attacks

guest · Jul 30, 2021

Dropbox researchers develop tool to detect lateral movement attacks against enterprise networks
‘Hopper’ delivered better detection and much reduced false alarms in early tests
July 30, 2021
https://portswigger.net/daily-swig/...-movement-attacks-against-enterprise-networks

Hopper, a tool developed by researchers at Dropbox, UC Berkeley, and other organizations, offers a different approach to finding malicious activity in enterprise networks.

Introduced in a paper that will be presented at the Usenix Security Symposium next month, Hopper uses machine learning to detect lateral movement attacks while reducing the number of false security alarms, the latter of which remains a key downside to existing approaches.
Click to expand...

Lateral movement
Many data breaches and security incidents at enterprises start with a simple device or low-privileged user account getting compromised. Attackers then move beyond their initial point of entry to other machines and administrator-level user accounts, gaining access to more valuable servers and resources as they progress.

This process is known as “lateral movement” and is a telltale sign of an impending security disaster.
Spotting the difference between normal user activity and malicious lateral movement is challenging.
Click to expand...

Paper: Hopper: Modeling and Detecting Lateral Movement (Extended Report)
(PDF): https://arxiv.org/pdf/2105.13442

On a 15-month enterprise dataset consisting of over 780 million internal logins, Hop-per achieves a 94.5% detection rate across over 300 realistic attack scenarios, including one red team attack, while generating an average of <9 alerts per day. In contrast, to detect the same number of attacks, prior state-of-the-art systems would need to generate nearly 8x as many false positives.
Click to expand...

Log in or Sign up

Researchers develop tool to detect lateral movement attacks

guest Guest

Log in or Sign up

Researchers develop tool to detect lateral movement attacks

guest Guest

Useful Searches