A Study of Detection of Structurally Anomalous Logins within Enterprise Networks for Network Security of Organizations

Abstract

To detect lateral motions that target remote vulnerabilities, often network intrusion detection systems use byte sequences. In this method, attackers circumvent anti-tampering controls by acquiring legitimate keys and using them to relay data from two separate devices without triggering irregular network traffic. In Credential-based Lateral Movement, we name this method. We use the capability of our technologies to recognize the lateral activity of this kind.