Abstract

Lateral movement is the phase of an intrusion where speed matters most: every hop an adversary completes expands their access surface and increases dwell time cost. Traditional network detection and response (NDR) tools detect individual suspicious connections - anomalous port usage, known-bad IPs, unusual protocols - but struggle to correlate multi-hop traversal across time and systems. Graph-based NDR platforms model the network as a directed graph of communication relationships, enabling detection of traversal patterns that are invisible at the individual-connection level but statistically anomalous as paths.

Graph Modeling of Network Behavior

The core data structure is an adjacency graph where nodes represent hosts (or identities, in identity-aware environments) and edges represent observed communication relationships, weighted by frequency, volume, and protocol. Baseline graphs built over a two-to-four week learning period capture the normal topology of a network: which servers talk to which databases, which workstations reach which internal services, which hosts communicate at all. Edges that appear for the first time, or that cross cluster boundaries without historical precedent, become candidates for anomaly scoring.

Graph-based reasoning enables detection of specific lateral movement patterns that threshold-based rules miss. A workstation that establishes a new connection to an internal file server is unremarkable. The same workstation establishing five new connections to five different internal servers in a 20-minute window - with none of those pairs having communicated before - is a textbook reconnaissance-and-pivot pattern. The detection requires correlating across the graph, not just evaluating each connection individually.

Platforms like Darktrace, ExtraHop Reveal(x), and Vectra AI implement variations of this approach. Open-source alternatives include Malcolm (from CISA/Idaho National Laboratory), which builds on Zeek and Arkime and supports graph-based queries through its OpenSearch backend.

Identity-Enriched Graph Analysis

Pure network graphs miss credential reuse. If an adversary compromises a service account and uses it to authenticate to five different hosts via WinRM or SMB, the network connections may look legitimate - originating from expected source IPs, using standard protocols. Identity-enriched NDR graphs incorporate authentication event data alongside network flows, creating edges that encode both the network path and the credential used. A service account that authenticates to a host it has never touched before, even over a legitimate protocol, generates a graph edge that warrants scoring.

Integrating Windows Event Log data (event IDs 4624, 4625, 4648 for logon events; 4688 for process creation) into the NDR graph is the standard pattern for Windows-heavy environments. Zeek’s Kerberos and SMB analyzers extract authentication metadata directly from network traffic, reducing dependency on endpoint log forwarding.

Reducing Alert Fatigue with Path Scoring

Graph-based detection generates path scores rather than binary alerts. A path score aggregates the novelty of each edge in a traversal sequence, the sensitivity classification of destination nodes, the velocity of traversal, and the identity of the account used. High-scoring paths surface as investigation candidates; low-scoring paths - even novel edges - are suppressed if they connect low-sensitivity nodes at low velocity.

Calibrating the scoring model requires mapping asset sensitivity into the graph as node weights. This is the operational investment the approach demands: an asset inventory with sensitivity classifications that the security team maintains and updates. Without it, a domain controller and a developer’s workstation look structurally equivalent to the graph, and the score for a path terminating at the domain controller is no higher than one ending at a test VM.