Leveraging Token-Based Representation to Detect Lateral Movement

Advanced Persistent Threats (APTs) attacks have caused serious threat to organization and government networks. In the APT lifecycle, lateral movement is an important step towards higher levels of authority and sensitive data. Methods for detecting lateral movement are of great interest both in science and in industry. Existing lateral movement detection methods heavily rely on feature engineering and audit data aggregation, the accuracy of the model's detection is significantly influenced by the quality of feature extraction. To address this issue, we introduce an unsupervised attention-based GRU model that leverages event tokenization method to ensure accurateness, the model removes the ad-hoc feature engineering phases and focuses on the remaining ones with improved accuracy. our design's approach is more automated and robust to record vectorization compared with other similar methods. Finally, we develop a prototype called Event2Vec and conduct comprehensive experiments using publicly available datasets. Extensive analysis show that Event2Vec can accurately and efficiently detect attacks within our evaluation.