Pith. sign in

REVIEW 3 major objections 8 minor 34 references

Lateral Movement Detection via Time-aware Subgraph Classification on Authentication Logs

T0 review · 3 major / 8 minor · reviewed 2026-08-12 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Lateral movement shows up as small time-aware subgraphs in authentication logs, and a classifier on those subgraphs reports F1 above 98% on two public corpora.

desk verdict Plausible new framing for lateral movement detection, but the near-perfect results are likely an artifact of entity leakage from random subgraph splits with one-hot ID features. read the letter →

arxiv 2411.10279 v1 pith:SVQFLS2U submitted 2024-11-15 cs.CR cs.AI

Jiajun Zhou , Jiacheng Yao , Xuanze Chen , Shanqing Yu , Qi Xuan , Xiaoniu Yang This is my paper · ORCID
classification cs.CRcs.AI
keywords lateralmovementdetectionauthenticationlogsheterogeneousmultigraphsubgraphclassificationgraphattentionnetworktime-awaresamplinganomalyadvancedpersistentthreat
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Lateral movement is the stage of an advanced attack where an intruder hops between machines using ordinary-looking logins, so it tends to hide in the noise of authentication logs. This paper argues that the right unit of analysis is not a single login event but the small, time-bounded subgraph of related activity around it. Its framework, LMDetect, builds a heterogeneous multigraph from authentication logs, samples a time-aware subgraph for each event, and classifies that subgraph as benign or malicious using a multi-scale attention encoder. On two public authentication-log corpora the framework reports F1 scores above 98% and AUC near 99.99%, outperforming every comparison method on every reported metric. The authors argue this makes subgraph classification a practical, scalable way to catch multi-step intrusions from log data enterprises already collect.

What carries the argument

The load-bearing object is the time-aware authentication subgraph produced by the paper's subgraph generator. Starting from the target event, it unions the 1-hop neighbors of its user, device, and object nodes, filters edges to a window $[t_i-\tau, t_i+\tau]$, collapses parallel edges into an interaction-frequency feature $T$, and keeps the top-$k$ edges between core and auxiliary nodes, which makes each training instance small enough for mini-batch learning. The second piece is the multi-scale attention encoder: a local attention layer, a relative-position encoding built from powers $M^K$ of the random-walk transition matrix $M=D^{-1}A$, and a global attention transformer, whose fused local and global features are pooled and classified. The relative-position encoding is what lets the model see long-range dependencies inside a small subgraph, and the ablation study credits the global attention module with much of the performance.

What would settle it

Retrain the model on events from the first half of each corpus and test on events from the second half, or split by disjoint sets of users and hosts, and compare precision, recall, and AUC; a large drop from the reported ~99% F1 and ~99.99% AUC would indicate the random-split results relied on shared entities between training and test subgraphs.

Watch

Extended reading notes

Core claim

The paper's central claim is that lateral movement is visible as a local, time-aware structure rather than as isolated edges: around each authentication event, the one-hop neighborhood pruned to a short time window and to the most frequent interactions contains enough signal to label the event as benign or malicious. LMDetect makes this concrete by constructing a Heterogeneous Authentication Multigraph (HAMG) in which users, hosts, servers, files, and processes are nodes and login, connection, access, and creation interactions are edges with timestamps. For each target event $z_i=\langle t_i, U_i, D_i, O_i\rangle$, a generator merges the 1-hop neighborhoods of the three core entities, removes edges with $|t-t_i|>\tau$, aggregates parallel edges by interaction frequency, and keeps the top-$k$ edges by frequency; the label of the event is assigned to the resulting subgraph. A multi-scale attention encoder, combining local attention, random-walk relative-position encoding, and global attention, produces a sum-pooled subgraph embedding that a softmax head classifies. The paper reports that this design outperforms all compared methods on both datasets across all metrics, with near-perfect scores on the larger corpus.

Load-bearing premise

The load-bearing assumption is that training and test subgraphs are independent, even though all of them are cut from one shared authentication graph and overlap in users, hosts, files, and time; if the model memorizes entity identities during training, the near-perfect test scores would not show real generalization.

Editorial extensions

If this is right

  • Lateral movement detection can be cast as subgraph classification of authentication events, and on the two corpora this paradigm beats the compared edge-, path-, and link-prediction approaches.
  • Time-aware subgraph sampling is itself a source of signal: graph-convolution, graph-attention, and sampling-aggregation baselines all improve when they receive time-aware subgraphs instead of randomly sampled ones.
  • The global attention module is the main driver of performance; removing it drops F1 from 99.03 to 87.93 on one corpus and from 98.44 to 79.87 on the other.
  • One-hop neighborhoods suffice and two-hop neighborhoods hurt, suggesting that direct, temporally nearby interactions carry the discriminative information for lateral movement.
  • Because subgraphs are small and trained in mini-batches, the framework is designed to scale to the volume of real enterprise authentication logs.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Editorial inference: the reported near-perfect numbers may partly reflect memorization of entity IDs rather than structural generalization, because the random 6:2:2 split lets training and test subgraphs share users, hosts, and files; a temporal or entity-disjoint split would test this.
  • Editorial inference: the window length and top-$k$ are tuned per corpus (one hour versus three hours), so deployment would likely require per-network calibration rather than a fixed setting.
  • Editorial inference: the same event-centered time-aware subgraph recipe could transfer to other security questions, such as detecting data exfiltration, malicious file access, or insider-threat actions that also show up as small contextual subgraphs around a logged event.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 8 minor

Summary. The paper proposes LMDetect, a framework for lateral movement detection from authentication logs. It constructs a heterogeneous authentication multigraph (HAMG), samples time-aware subgraphs centered on each authentication event via a time-window and top-k edge selection, and classifies each subgraph with a multi-scale attention encoder combining local attention, relative position encoding based on random walks, and global attention. Experiments on the LANL and CERT datasets report near-perfect detection metrics (e.g., AUC 99.99 on both) and the authors claim state-of-the-art performance over GNN baselines and existing graph-based detectors.

Significance. If the reported results were valid, the paper would make a useful contribution by reframing lateral movement detection as subgraph classification and by introducing a time-aware subgraph generator. The conceptual shift from edge/path classification to time-aware subgraph classification is reasonable and addresses a real limitation of prior GNN-based approaches. However, the evaluation protocol has a serious entity-leakage problem: subgraphs are randomly split while sharing node IDs from a single HAMG, and node features include one-hot IDs. This makes the near-perfect metrics in Table 4 consistent with memorization rather than generalization. The paper also provides no code or data artifacts, so the results cannot be independently checked. The strengths of the idea do not compensate for the unsupported central empirical claim.

major comments (3)
  1. [§5.4, Definition 1, Algorithm 1] The random split of event samples does not prevent subgraphs in the training and test sets from sharing entities. Definition 1 specifies node features as one-hot type concatenated with one-hot ID; Algorithm 1 (step 7) assigns the label of the target event to the entire sampled subgraph. Since all subgraphs are extracted from a single HAMG, a training subgraph containing a malicious entity's ID allows the model to memorize that ID, and a test subgraph containing the same ID can then be classified by recognition of the ID rather than by any lateral-movement behavior. This is a direct label-leakage path. The near-perfect results in Table 4 (e.g., AUC 99.99 on both datasets) are therefore not evidence of generalization, and the claim in Section 5.5 that LMDetect outperforms all methods across all metrics is unsupported.
  2. [§5.8, Figure 7] The random-walk length K is selected on the test set. Section 5.8 reports varying K in the set {16, 24, 32, 36, 40} and choosing K = 32 based on the resulting performance metrics; the K = 32 row exactly matches the final Table 4 results. No validation set is used for this hyperparameter choice. Thus the reported performance is an optimistically biased selection of the best test-fold configuration, and the sensitivity analysis does not establish the robustness claimed.
  3. [§5.6, Table 5] The ablation and sensitivity analyses are computed on the same test folds as the final model, and they inherit the leakage described above. For example, Table 5 reports that removing global attention (LMDetect w/o ge) drops F1 from 99.03 to 87.93 on LANL, but because the evaluation protocol allows ID memorization, the magnitude of these differences is not a reliable measure of the module's contribution. The ablation results cannot support the conclusion that each module significantly enhances detection.
minor comments (8)
  1. [§5.5] The section title contains a typo ('Detecttion' should be 'Detection'), and the text states 'LMDetect performes exceptionally well' ('performes' should be 'performs').
  2. [Figures 6 and 7] Figures 6 and 7 contain garbled overlaid text and embedded table fragments (e.g., '表格 1' and duplicated 'K TSG k=1 TSG k=2' lines) that make the figures difficult to interpret; the captions and figures should be cleaned up.
  3. [§2.2 and §5.2] LMTracker is described inconsistently: Section 2.2 calls it an unsupervised anomalous path detection method using predefined thresholds and meta-paths, while Section 5.2 says it models lateral movement detection as a path classification problem using metapath2vec. The description should be reconciled.
  4. [§4.3, Eq. (14)] The loss in Eq. (14) is an unweighted cross-entropy, despite the severe class imbalance (17,000 benign vs. 400 malicious samples) described in Section 5.4. The paper should justify this choice or describe any balancing technique used.
  5. [Algorithm 1, Definition 1] In Algorithm 1, step 4, the edge feature T is introduced as interaction frequency, but Definition 1 defines an edge feature vector containing interaction type, authentication type, logon type, and authentication orientation; it is not specified how T is combined with these features in the model.
  6. [§4.2.2, Eq. (7)] The relative position encoding concatenates P_{i,i} (self-transition probabilities after random walks) to node features, which seems uninformative; the authors should clarify whether node features should instead aggregate transition probabilities to or from other nodes.
  7. [§5.4] The paper states '17,000 benign event samples and 400 malicious event samples on both datasets' but does not explain how these samples are selected or whether the 400 malicious events constitute the complete set of malicious events in each dataset.
  8. [General] No code or data artifacts are provided, which prevents post-hoc verification of the experimental results and the claimed leakage-free evaluation.

Circularity Check

2 steps flagged · score 6.0 of 10

Test-set hyperparameter selection and entity-level leakage make the reported near-perfect detection metrics partly an artifact of the evaluation construction rather than an independent prediction.

  1. fitted input called prediction [Section 5.8 (Analysis of Relative Position Encoding), Table 3, Table 4]
    "We further analyze the influence of key parameter in relative position encoding (i.e., random walk step length K) on model's detection performance. Specifically, we varies K within the set {16, 24, 32, 36, 40} and observe the performance fluctuations, as shown in Figure 7. We observe that as K increases, the model's performance initially improves but then declines, reaching optimal detection performance when K = 32."

    The same test split is used both to select K (Figure 7) and to produce the final detection results in Table 4; Table 3 then fixes K=32 for both datasets. The reported near-perfect F1/AUC numbers are therefore the best values of a grid search over the test set, not independent predictions. The central claim that 'LMDetect outperforms other methods across all detection metrics' is partly a selection artifact rather than an unbiased evaluation.

  2. other [Section 3.2 (Graph Construction), Algorithm 1 step 7, Section 5.4 (Experimental Settings)]
    "xi is the feature vector constructed by concatenating the type information (one-hot encoded) of node vi and its ID information ... We divide the dataset into training, validation, and testing sets according to the ratio of 6:2:2 ... Assign the label yi of event zi to gi"

    Each sampled subgraph is labeled by its target authentication event and contains the one-hot ID of that event's user/host/object. Because the 6:2:2 split is random over events, not over entities, the same malicious user and host IDs appear in both training and test subgraphs cut from the single global HAMG. With one-hot ID features, the model can memorize the label associated with an ID during training and apply it to any test subgraph containing that same ID. The near-perfect test metrics are thus forced by the construction of the features and the split, reflecting ID lookup rather than lateral-movement generalization.

full rationale

This is an empirical machine-learning paper rather than a formal derivation, so most derivation-chain circularity checks are not applicable. There is no load-bearing self-citation: the authors cite their own prior work only in the related-work survey, and no uniqueness theorem is imported. The central empirical claim, however, is subject to two evaluative reductions. First, the random-walk step length K is selected by running the model on the test set in Figure 7, then fixed in Table 3, after which the same test set is reported in Table 4; the 'optimal' test metrics are therefore fitted rather than predicted. Second, Algorithm 1 assigns the target event's label to each subgraph, and Section 3.2 defines node features as one-hot type plus one-hot ID, while the Section 5.4 split is at the event/subgraph level. Since all subgraphs come from one global HAMG, the same user, host, server, and file IDs occur in both training and test subgraphs, allowing the model to memorize malicious IDs and look them up in test subgraphs. Both issues make the near-perfect F1/AUC numbers partly forced by construction. The architecture and time-aware sampling may still have merit, but the state-of-the-art claim as evaluated is not self-contained evidence of generalization.

Assumptions & free parameters 10 free parameters · 5 assumptions · 0 invented entities

The framework introduces no new physical or conceptual entities; its contributions are modeling choices. The central claim rests on a set of dataset-specific hyperparameters and on a labeling assumption that may cause train/test leakage.

free parameters (10)
  • Time window parameter tau = 3600 s (LANL), 10800 s (CERT)
    Controls how much surrounding context is kept in each subgraph; chosen per dataset with no ablation or stated rule.
  • Top-k sampling parameter k = 150 (both datasets)
    Retains the 150 most frequent core-auxiliary edges; affects subgraph size and noise.
  • Random walk step length K = 32 (both datasets)
    Swept as {16,24,32,36,40} and selected by best metrics; at K=16 CERT precision falls to 66.84, so the reported result depends on this choice.
  • Training sample sizes = 17,000 benign and 400 malicious events per dataset
    Arbitrary fixed sample to simulate imbalance; selection of these events is not specified.
  • Number of local attention layers L = 2 (both datasets)
    From Table 3; no sensitivity analysis.
  • Number of global attention heads = 4 (both datasets)
    From Table 3; no sensitivity analysis.
  • Hidden dimension = 64 (both datasets)
    From Table 3; no sensitivity analysis.
  • Dropout rate = 0.2 (both datasets)
    From Table 3; no sensitivity analysis.
  • Batch size = 16 (both datasets)
    From Table 3; no sensitivity analysis.
  • Learning rate = 0.0005 (both datasets)
    From Table 3; no sensitivity analysis.
assumptions (5)
  • standard math Random-walk transition matrix M = D^{-1}A is a valid Markov transition matrix, so its powers define multi-step relative positions.
    Used in Section 4.2.2 for relative position encoding; standard linear algebra result.
  • domain assumption Authentication log fields and the five entity types / four interaction types are sufficient to represent lateral movement behavior.
    Section 3.1 and 3.2; if attackers use operations outside these categories, the graph loses the behavior.
  • domain assumption A 1-hop neighborhood within time window tau captures the relevant context of a lateral movement event.
    Algorithm 1 and Section 5.7; the paper itself shows 2-hop neighborhoods hurt performance, so the method depends on the 1-hop assumption.
  • ad hoc to paper Top-k edges by interaction frequency retain the discriminative structure of the event.
    Algorithm 1 step 6; no theory or ablation justifies k=150 as opposed to other values.
  • ad hoc to paper The label of an authentication event can be assigned unchanged to its sampled subgraph.
    Algorithm 1 step 7; this is the main source of potential label leakage, because neighboring events with different labels share subgraph content.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Lateral Movement Detection via Time-aware Subgraph Classification on Authentication Logs." pith.science (2026). https://pith.science/paper/SVQFLS2U

@misc{pith2026241110279,
  author       = {Pith},
  title        = {Pith review of: Lateral Movement Detection via Time-aware Subgraph Classification on Authentication Logs},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/SVQFLS2U}},
  note         = {Machine review of arXiv:2411.10279}
}
read the original abstract

Lateral movement is a crucial component of advanced persistent threat (APT) attacks in networks. Attackers exploit security vulnerabilities in internal networks or IoT devices, expanding their control after initial infiltration to steal sensitive data or carry out other malicious activities, posing a serious threat to system security. Existing research suggests that attackers generally employ seemingly unrelated operations to mask their malicious intentions, thereby evading existing lateral movement detection methods and hiding their intrusion traces. In this regard, we analyze host authentication log data from a graph perspective and propose a multi-scale lateral movement detection framework called LMDetect. The main workflow of this framework proceeds as follows: 1) Construct a heterogeneous multigraph from host authentication log data to strengthen the correlations among internal system entities; 2) Design a time-aware subgraph generator to extract subgraphs centered on authentication events from the heterogeneous authentication multigraph; 3) Design a multi-scale attention encoder that leverages both local and global attention to capture hidden anomalous behavior patterns in the authentication subgraphs, thereby achieving lateral movement detection. Extensive experiments on two real-world authentication log datasets demonstrate the effectiveness and superiority of our framework in detecting lateral movement behaviors.

Figures

Figures reproduced from arXiv: 2411.10279 by the authors.

Figure 1
Figure 1. Two lateral movement scenarios in the enterprise internal network: 1) External threat actors employ advanced persistent threat (APT) techniques [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Workflow of the LMDetect framework. terize behavior patterns in network authentication events and further achieve lateral movement detection [PITH_FULL_IMAGE:figures/full_fig_p002_2.png] view at source ↗
Figure 3
Figure 3. Illustration of the Heterogeneous Authentication Multigraph. [PITH_FULL_IMAGE:figures/full_fig_p004_3.png] view at source ↗
Figures from the paper (4 more)
Figure 4
Figure 4. Figure 4: Illustration of LMDetect framework. The complete workflow is as follows: 1) Constructing heterogeneous authentication multigraph using authentication logs; 2) Sampling authentication subgraphs for target events via time-aware subgraph generator; 3) Learning the behavio…
Figure 5
Figure 5. Figure 5: Illustration of global attention encoding. [PITH_FULL_IMAGE:figures/full_fig_p007_5.png]
Figure 6
Figure 6. Figure 6: Impact of time-aware subgraph on detection performance. [PITH_FULL_IMAGE:figures/full_fig_p010_6.png]
Figure 7
Figure 7. Figure 7: Impact of random walk step length in relative position encoding. [PITH_FULL_IMAGE:figures/full_fig_p011_7.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

34 extracted references · 31 canonical work pages

  1. [1]

    A game-theoretic approach to respond to attacker lateral movement,

    M. A. Noureddine, A. Fawaz, W. H. Sanders, and T. Bas ¸ar, “A game-theoretic approach to respond to attacker lateral movement,” in Decision and Game Theory for Security: 7th International Con- ference, GameSec 2016, New York, NY, USA, November 2-4, 2016, Proceedings 7. Springer, 2016, pp. 294–313

    work page 2016

  2. [2]

    A hybrid game theory and reinforcement learning approach for cyber-physical systems security,

    J. Khoury and M. Nassar, “A hybrid game theory and reinforcement learning approach for cyber-physical systems security,” in NOMS 2020-2020 IEEE/IFIP Network Operations and Management Sym- posium. IEEE, 2020, pp. 1–9

    work page 2020

  3. [3]

    Game theoretical model for cybersecurity risk assessment of industrial control systems,

    M. Nassar, J. Khoury, A. Erradi, and E. Bou-Harb, “Game theoretical model for cybersecurity risk assessment of industrial control systems,” in 2021 11th IFIP International Conference on New Technologies, Mobility and Security (NTMS) . IEEE, 2021, pp. 1–7

    work page 2021

  4. [4]

    Identifying critical attack assets in de- pendency attack graphs,

    R. E. Sawilla and X. Ou, “Identifying critical attack assets in de- pendency attack graphs,” in Computer Security-ESORICS 2008: 13th European Symposium on Research in Computer Security, M ´alaga, Spain, October 6-8, 2008. Proceedings 13 . Springer, 2008, pp. 18– 34

    work page 2008

  5. [5]

    Baiting inside attackers using decoy documents,

    B. M. Bowen, S. Hershkop, A. D. Keromytis, and S. J. Stolfo, “Baiting inside attackers using decoy documents,” in Security and Privacy in Communication Networks: 5th International ICST Con- ference, SecureComm 2009, Athens, Greece, September 14-18, 2009, Revised Selected Papers 5 . Springer, 2009, pp. 51–70

    work page 2009

  6. [6]

    Hopper: Modeling and detecting lateral movement,

    G. Ho, M. Dhiman, D. Akhawe, V . Paxson, S. Savage, G. M. V oelker, and D. Wagner, “Hopper: Modeling and detecting lateral movement,” in 30th USENIX Security Symposium (USENIX Security 21) , 2021, pp. 3093–3110

    work page 2021

  7. [7]

    Unicorn: Runtime provenance-based detector for advanced persistent threats,

    X. Han, T. Pasquier, A. Bates, J. Mickens, and M. Seltzer, “Unicorn: Runtime provenance-based detector for advanced persistent threats,” arXiv preprint arXiv:2001.01525 , 2020

    arXiv 2001

  8. [8]

    Holmes: real-time apt detection through correlation of suspi- cious information flows,

    S. M. Milajerdi, R. Gjomemo, B. Eshete, R. Sekar, and V . Venkatakr- ishnan, “Holmes: real-time apt detection through correlation of suspi- cious information flows,” in 2019 IEEE Symposium on Security and Privacy (SP). IEEE, 2019, pp. 1137–1152

    work page 2019

Show all 34 references
  1. [9]

    Rdp-based lateral movement detection using machine learning,

    T. Bai, H. Bian, M. A. Salahuddin, A. Abou Daya, N. Limam, and R. Boutaba, “Rdp-based lateral movement detection using machine learning,” Computer communications, vol. 165, pp. 9–19, 2021

    2021

  2. [10]

    Anomaly-based detection of lateral movement in a microsoft windows environment,

    M. Meijerink, “Anomaly-based detection of lateral movement in a microsoft windows environment,” Master’s thesis, University of Twente, 2019

    2019

  3. [11]

    On the detection of lateral movement through supervised machine learning and an open-source tool to create turnkey datasets from sysmon logs,

    C. Smiliotopoulos, G. Kambourakis, and K. Barbatsalou, “On the detection of lateral movement through supervised machine learning and an open-source tool to create turnkey datasets from sysmon logs,” International Journal of Information Security , vol. 22, no. 6, pp. 1893–1919, 2023

    1919

  4. [12]

    Uncovering lateral movement using authentication logs,

    H. Bian, T. Bai, M. A. Salahuddin, N. Limam, A. Abou Daya, and R. Boutaba, “Uncovering lateral movement using authentication logs,” IEEE Transactions on Network and Service Management , vol. 18, no. 1, pp. 1049–1063, 2021

    2021

  5. [13]

    A comprehensive detection method for the lateral movement stage of apt attacks,

    D. He, H. Gu, S. Zhu, S. Chan, and M. Guizani, “A comprehensive detection method for the lateral movement stage of apt attacks,” IEEE Internet of Things Journal , 2023

    2023

  6. [14]

    A machine learning approach for rdp-based lat- eral movement detection,

    T. Bai, H. Bian, A. Abou Daya, M. A. Salahuddin, N. Limam, and R. Boutaba, “A machine learning approach for rdp-based lat- eral movement detection,” in 2019 IEEE 44th Conference on Local Computer Networks (LCN) . IEEE, 2019, pp. 242–245

    2019

  7. [15]

    Cyberlearning: Effectiveness analysis of machine learn- ing security modeling to detect cyber-anomalies and multi-attacks,

    I. H. Sarker, “Cyberlearning: Effectiveness analysis of machine learn- ing security modeling to detect cyber-anomalies and multi-attacks,” Internet of Things , vol. 14, p. 100393, 2021

    2021

  8. [16]

    Implementation of deep packet inspection in smart grids and industrial internet of things: Challenges and opportunities,

    G. D. L. T. Parra, P. Rad, and K.-K. R. Choo, “Implementation of deep packet inspection in smart grids and industrial internet of things: Challenges and opportunities,” Journal of Network and Computer Applications, vol. 135, pp. 32–46, 2019

    2019

  9. [17]

    Detecting internet of things attacks using distributed deep learning,

    G. D. L. T. Parra, P. Rad, K.-K. R. Choo, and N. Beebe, “Detecting internet of things attacks using distributed deep learning,” Journal of Network and Computer Applications , vol. 163, p. 102662, 2020

    2020

  10. [18]

    Latte: Large-scale lateral movement detection,

    Q. Liu, J. W. Stokes, R. Mead, T. Burrell, I. Hellen, J. Lambert, A. Marochko, and W. Cui, “Latte: Large-scale lateral movement detection,” in MILCOM 2018-2018 IEEE Military Communications Conference (MILCOM). IEEE, 2018, pp. 1–6

    2018

  11. [19]

    Euler: Detecting network lateral movement via scalable temporal link prediction,

    I. J. King and H. H. Huang, “Euler: Detecting network lateral movement via scalable temporal link prediction,” ACM Transactions on Privacy and Security , vol. 26, no. 3, pp. 1–36, 2023

    2023

  12. [20]

    Lmtracker: Lateral movement path detection based on heterogeneous graph embedding,

    Y . Fang, C. Wang, Z. Fang, and C. Huang, “Lmtracker: Lateral movement path detection based on heterogeneous graph embedding,” Neurocomputing, vol. 474, pp. 37–47, 2022

    2022

  13. [21]

    Detecting lateral movement in enterprise computer networks with unsupervised graph {AI},

    B. Bowman, C. Laprade, Y . Ji, and H. H. Huang, “Detecting lateral movement in enterprise computer networks with unsupervised graph {AI},” in 23rd International Symposium on Research in Attacks, Intrusions and Defenses (RAID 2020) , 2020, pp. 257–268

    2020

  14. [22]

    Log2vec: A heterogeneous graph embedding based approach for detecting cyber threats within enterprise,

    F. Liu, Y . Wen, D. Zhang, X. Jiang, X. Xing, and D. Meng, “Log2vec: A heterogeneous graph embedding based approach for detecting cyber threats within enterprise,” in Proceedings of the 2019 ACM SIGSAC conference on computer and communications security , 2019, pp. 1777–1794

    2019

  15. [23]

    Heterogeneous feature augmentation for ponzi detection in ethereum,

    C. Jin, J. Jin, J. Zhou, J. Wu, and Q. Xuan, “Heterogeneous feature augmentation for ponzi detection in ethereum,” IEEE Transactions on Circuits and Systems II: Express Briefs, vol. 69, no. 9, pp. 3919–3923, 2022

    2022

  16. [24]

    Behavior- aware account de-anonymization on ethereum interaction graph,

    J. Zhou, C. Hu, J. Chi, J. Wu, M. Shen, and Q. Xuan, “Behavior- aware account de-anonymization on ethereum interaction graph,” IEEE Transactions on Information Forensics and Security , vol. 17, pp. 3433–3448, 2022

    2022

  17. [25]

    Time-aware metapath feature augmentation for ponzi detection in ethereum,

    C. Jin, J. Zhou, J. Jin, J. Wu, and Q. Xuan, “Time-aware metapath feature augmentation for ponzi detection in ethereum,” IEEE Transac- tions on Network Science and Engineering , vol. 11, no. 4, pp. 3747– 3758, 2024

    2024

  18. [26]

    Graph neural networks for intrusion detection: A survey,

    T. Bilot, N. El Madhoun, K. Al Agha, and A. Zouaoui, “Graph neural networks for intrusion detection: A survey,” IEEE Access, vol. 11, pp. 49 114–49 139, 2023

    2023

  19. [27]

    Pathmlp: Smooth path towards high-order homophily,

    J. Zhou, C. Xie, S. Gong, J. Qian, S. Yu, Q. Xuan, and X. Yang, “Pathmlp: Smooth path towards high-order homophily,” Neural Net- works, vol. 180, p. 106650, 2024

    2024

  20. [28]

    Clarify confused nodes via separated learning,

    J. Zhou, S. Gong, X. Chen, C. Xie, S. Yu, Q. Xuan, and X. Yang, “Clarify confused nodes via separated learning,” arXiv preprint arXiv:2306.02285, 2023

    2023 arXiv

  21. [29]

    Cyber security data sources for dynamic network re- search,

    A. D. Kent, “Cyber security data sources for dynamic network re- search,” in Dynamic Networks and Cyber-Security. World Scientific, 2016, pp. 37–65

    2016

  22. [30]

    Insider Threat Test Dataset,

    B. Lindauer, “Insider Threat Test Dataset,” 9 2020. [Online]. Available: https://kilthub.cmu.edu/articles/dataset/Insider Threat Test Dataset/12841247

    2020

  23. [31]

    Semi-supervised classification with graph convolutional networks,

    T. N. Kipf and M. Welling, “Semi-supervised classification with graph convolutional networks,” arXiv preprint arXiv:1609.02907 , 2016

    2016 arXiv

  24. [32]

    Graph attention networks,

    P. Velickovic, G. Cucurull, A. Casanova, A. Romero, P. Lio, Y . Bengio et al. , “Graph attention networks,” stat, vol. 1050, no. 20, pp. 10– 48 550, 2017

    2017

  25. [33]

    Inductive representation learning on large graphs,

    W. Hamilton, Z. Ying, and J. Leskovec, “Inductive representation learning on large graphs,” Advances in neural information processing systems, vol. 30, 2017

    2017

  26. [34]

    metapath2vec: Scalable representation learning for heterogeneous networks,

    Y . Dong, N. V . Chawla, and A. Swami, “metapath2vec: Scalable representation learning for heterogeneous networks,” in Proceedings of the 23rd ACM SIGKDD international conference on knowledge discovery and data mining , 2017, pp. 135–144

    2017

Pith tools

Reviewed August 12, 2026 · model on record in the stance chip above.