Detecting lateral movement: A systematic survey

• Published in: Heliyon Vol. 10; no. 4; p. e26317
• Main Authors: Smiliotopoulos, Christos, Kambourakis, Georgios, Kolias, Constantinos
• Format: Journal Article
• Language: English
• Published: England Elsevier Ltd 29.02.2024; Elsevier
• Subjects: Advanced persistent threat; Attacks; computer security; Internet; IoT; Lateral movement; Network security; surveys; Network security; Lateral movement; Attacks; Advanced persistent threat; IoT
• ISSN: 2405-8440; 2405-8440
• DOI: 10.1016/j.heliyon.2024.e26317

Within both the cyber kill chain and MITRE ATT&CK frameworks, Lateral Movement (LM) is defined as any activity that allows adversaries to progressively move deeper into a system in seek of high-value assets. Although this timely subject has been studied in the cybersecurity literature to a significant degree, so far, no work provides a comprehensive survey regarding the identification of LM from mainly an Intrusion Detection System (IDS) viewpoint. To cover this noticeable gap, this work provides a systematic, holistic overview of the topic, not neglecting new communication paradigms, such as the Internet of Things (IoT). The survey part, spanning a time window of eight years and 53 articles, is split into three focus areas, namely, Endpoint Detection and Response (EDR) schemes, machine learning oriented solutions, and graph-based strategies. On top of that, we bring to light interrelations, mapping the progress in this field over time, and offer key observations that may propel LM research forward.