<p>Lateral Movement (LM) represents a growing threat, frequently employed by advanced persistent threat groups to escalate privileges and navigate a compromised network towards high-value assets and sensitive data. While a significant body of research explores the impact of dataset imbalance and resampling techniques on general-purpose Intrusion Detection Systems (IDS), it is not clear that these findings can be directly extrapolated to the specialized domain of LM detection. Unlike other common attacks, LM is inherently stealthy, often mimicking legitimate user and administrative behaviors recorded in host-based logs. Recognizing this critical distinction, we leverage the LMD-2023 imbalanced benchmark dataset, a corpus that is unique due to its exclusive focus on LM tactics and its use of host-based Microsoft Windows Sysmon logs. Our work makes a novel, multifaceted contribution to the LM IDS domain by (1) being the first to systematically examine the impact of resampling techniques on these LM-specific models, (2) analyzing a diverse range of 13 ML algorithms (nine shallow and four deep neural network techniques), and (3) providing a detailed analysis of the performance trade-offs, including False Positive Rate (FPR) / False Negative Rate (FNR), between shallow and deep learning models. Specifically, we address the research question: How does the sample distribution within a benchmark dataset affect the performance evaluation metrics of LM-oriented IDS models? To this end, we adopt a multiclass supervised approach, classifying network activity into Normal, Exploitation of Remote Services, and Exploitation of Hashing Techniques. Our key findings reveal that balanced versions of the dataset generally improved performance. Shallow models trained on resampled data achieved a marginal increase of <InlineEquation ID="IEq1"> <EquationSource Format="TEX">$\approx $</EquationSource> <EquationSource Format="MATHML"><math> <mo>≈</mo> </math></EquationSource> </InlineEquation>0.05 percentage points (p.p.) in AUC and F1-score compared to the imbalanced scenario. Notably, DNN models exhibited a more substantial performance gain of around 3.5 p.p. compared to the original imbalanced DNN scenario, across most balancing techniques. Furthermore, analysis of FPR and FNR revealed crucial trade-offs. While some balanced datasets led to near-zero FNR with ensemble methods like Bagging, others, particularly with DNNs and techniques like ADASYN, showed a higher propensity for false alarms. These observations underscore the critical role of data balancing in optimizing LM IDS performance and highlight the varying impact of different techniques on the FPR/FNR trade-off between shallow and deep learning models.</p>

Machine Learning for Lateral Movement Detection using Sysmon Logs: An Empirical Comparison of Imbalanced and Resampled Data

期刊论文
发表日期：

2026年1月22日

查看全文

Christos Smiliotopoulos,
Georgios Kambourakis

摘要

Lateral Movement (LM) represents a growing threat, frequently employed by advanced persistent threat groups to escalate privileges and navigate a compromised network towards high-value assets and sensitive data. While a significant body of research explores the impact of dataset imbalance and resampling techniques on general-purpose Intrusion Detection Systems (IDS), it is not clear that these findings can be directly extrapolated to the specialized domain of LM detection. Unlike other common attacks, LM is inherently stealthy, often mimicking legitimate user and administrative behaviors recorded in host-based logs. Recognizing this critical distinction, we leverage the LMD-2023 imbalanced benchmark dataset, a corpus that is unique due to its exclusive focus on LM tactics and its use of host-based Microsoft Windows Sysmon logs. Our work makes a novel, multifaceted contribution to the LM IDS domain by (1) being the first to systematically examine the impact of resampling techniques on these LM-specific models, (2) analyzing a diverse range of 13 ML algorithms (nine shallow and four deep neural network techniques), and (3) providing a detailed analysis of the performance trade-offs, including False Positive Rate (FPR) / False Negative Rate (FNR), between shallow and deep learning models. Specifically, we address the research question: How does the sample distribution within a benchmark dataset affect the performance evaluation metrics of LM-oriented IDS models? To this end, we adopt a multiclass supervised approach, classifying network activity into Normal, Exploitation of Remote Services, and Exploitation of Hashing Techniques. Our key findings reveal that balanced versions of the dataset generally improved performance. Shallow models trained on resampled data achieved a marginal increase of $\approx $ $\approx$ 0.05 percentage points (p.p.) in AUC and F1-score compared to the imbalanced scenario. Notably, DNN models exhibited a more substantial performance gain of around 3.5 p.p. compared to the original imbalanced DNN scenario, across most balancing techniques. Furthermore, analysis of FPR and FNR revealed crucial trade-offs. While some balanced datasets led to near-zero FNR with ensemble methods like Bagging, others, particularly with DNNs and techniques like ADASYN, showed a higher propensity for false alarms. These observations underscore the critical role of data balancing in optimizing LM IDS performance and highlight the varying impact of different techniques on the FPR/FNR trade-off between shallow and deep learning models.