Lateral movement detection through a heteregenous GNN model of kernel-level log

Lateral movement is a technique for complex attack scenarios such as Advanced Persistent Threat (APT) that the attacker moves laterally from one machine to another one and can infect all networks or systems of the organization. One of the ways to identify this threat is to check the kernel-level $\log$ for investigating the behavior or activity of a user who makes the processes and events that are suspicious. From the relationships between different processes and events and their characteristics, a malicious activity can be identified, which can indicate the presence of an attacker. Therefore, regarding this point of view, we form a Heterogenous Graph Neural Network (HGNN) by considering these relationships. We apply the proposed method on the public labeled kernel-level $\log$ of BETH dataset that gathered in 23 honeypots. We reach $\mathbf{9 9. 4 \%}$ accuracy and evaluate the HGNN model by precision and recall. This is a good result to detect the presence of an attacker with a lateral movement behavior.