论文标题
D2M：网络中对抗运动的动态防御和建模
D2M: Dynamic Defense and Modeling of Adversarial Movement in Networks
论文作者
论文摘要
鉴于设备的大型企业网络及其身份验证历史记录（例如，设备登录），我们如何量化网络脆弱性的侧向攻击并识别危险的设备？我们通过D2M系统地解决了这些问题，D2M是第一个框架，该框架使用Microsoft Defender Advance Advanced Thrate Protection Group中的研究人员，工程师和威胁猎人开发的多种攻击策略对企业网络进行了横向攻击。这些策略整合了现实世界中的对抗动作（例如特权升级）以生成攻击路径：一系列折衷的机器。利用这些攻击路径和一种新颖的蒙特卡洛方法，我们将网络脆弱性作为网络拓扑的概率功能，访问凭证的分布和初始渗透点。为了识别有横向攻击风险的机器，我们提出了一套五种快速图挖掘技术的套件，包括一种新型技术，称为Anomalyshield，受节点免疫研究的启发。使用Microsoft和Los Alamos国家实验室的三个真实身份验证图（高达223,399个身份验证），我们报告了有关横向攻击的网络脆弱性的第一个实验结果，这表明D2M具有赋予IT赋予IT能力的独特潜力，以制定可靠的用户访问凭证。
Given a large enterprise network of devices and their authentication history (e.g., device logons), how can we quantify network vulnerability to lateral attack and identify at-risk devices? We systematically address these problems through D2M, the first framework that models lateral attacks on enterprise networks using multiple attack strategies developed with researchers, engineers, and threat hunters in the Microsoft Defender Advanced Threat Protection group. These strategies integrate real-world adversarial actions (e.g., privilege escalation) to generate attack paths: a series of compromised machines. Leveraging these attack paths and a novel Monte-Carlo method, we formulate network vulnerability as a probabilistic function of the network topology, distribution of access credentials and initial penetration point. To identify machines at risk to lateral attack, we propose a suite of five fast graph mining techniques, including a novel technique called AnomalyShield inspired by node immunization research. Using three real-world authentication graphs from Microsoft and Los Alamos National Laboratory (up to 223,399 authentications), we report the first experimental results on network vulnerability to lateral attack, demonstrating D2M's unique potential to empower IT admins to develop robust user access credential policies.
