DygLM: Detecting Lateral Movement Threat via Continuous-time Dynamic Graph Learning

In an advanced persistent threat (APT) targeting an enterprise, an adversary attempts to move through the network environment starting from their initial point, which is known as Lateral Movement (LM). Detecting LM typically uses authentication logs, which are modeled as dynamic graphs with temporal properties. Most prior research focuses on discrete snapshots, neglecting the evolving nature of the enterprise network. Recently, some researchers have proposed continuous-time graph approaches. However, they often fail to fully incorporate security domain knowledge, and suffer from detection target bias. In this paper, given the limitations of the above approaches, we propose DygLM, a framework based on continuous-time graph representation learning with suspicious LM events as the detection target. It enables self-supervised learning in an attack-free manner, adapting to the evolving network environment. By applying a well-designed encoder to the continuous-time authentication events, we encode the node-associated neighbors, edges, and time intervals to obtain topological as well as temporal representation, which is further enhanced by learning long-term correlations using Transformer. We address the detection target bias by scoring the likelihood of malicious events in the evaluation phase. Through extensive experiments on two large datasets, we demonstrate the effectiveness of DygLM in detecting LM in both transductive and inductive settings.