Malicious login detection using long short-term memory with an attention mechanism - Advances in Digital Forensics XVII Access content directly
Conference Papers Year : 2021

Malicious login detection using long short-term memory with an attention mechanism

Abstract

Advanced persistent threats routinely leverage lateral movements in networks to cause harm. In fact, lateral movements account for more than 80% of the time involved in attacks. Attackers typically use stolen credentials to make lateral movements. However, current detection methods are too coarse grained to detect lateral movements effectively because they focus on malicious users and hosts instead of abnormal log entries that indicate malicious logins.This chapter proposes a malicious login detection method that focuses on attacks that steal credentials. The fine-grained method employs a temporal neural network embedding to learn host jumping representations. The learned host vectors and initialized attribute vectors in log entries are input to a long short-term memory with an attention mechanism for login feature extraction, which determines if logins are malicious. Experimental results demonstrate that the proposed method outperforms several baseline detection models.
522103_1_En_8_Reference.pdf (573.78 Ko) Télécharger le fichier

Dates and versions

hal-03764375 , version 1 (31-08-2022)

Licence

Attribution

Identifiers

Cite

Yanna Wu, Fucheng Liu, Yu Wen. Malicious login detection using long short-term memory with an attention mechanism. 17th IFIP International Conference on Digital Forensics (DigitalForensics), Feb 2021, Virtual, China. pp.157-173, ⟨10.1007/978-3-030-88381-2_8⟩. ⟨hal-03764375⟩
47 View
2 Download

Altmetric

Share

Gmail Facebook X LinkedIn More