D2m Defense Eval

d2m-defense-eval

D2M: Dynamic Defense and Modeling of Adversarial Movement in Networks — Freitas et al. (2020) (arXiv:2001.11108, 2020)

What this evaluates

Evaluates enterprise network vulnerability to lateral attacks by simulating adversarial movement across authentication graphs. It also measures the effectiveness of defense strategies in predicting attacker movement based on graph topology and credential hygiene levels.

Datasets

• G_s — total 100; splits: test (-1)
• G_l — total 2039; splits: test (-1)
• G_lanl — total 14813; splits: test (-1)

Metrics

• Network Vulnerability (primary) — range: [0, 1]
  • Probabilistic measure of network susceptibility to lateral attack, computed via Monte-Carlo simulation over 50 credential distributions. It represents the likelihood of an attacker reaching the domain controller given graph topology, credential distribution, and hygiene level.
• Defense Strategy Success — range: [0, 1]
  • Measures the ability to predict attacker movement by intersecting the predicted at-risk machines S_k with the actual next attack node p^{i+1}, averaged over all sub-paths.
• Average Attack Path Length — range: [0, ∞)
  • Mean number of hops required for simulated attack strategies (Rank-Explore, Degree-Explore, Random Walk) to reach the domain controller across all credential distributions.

Input / output format

Input: Graph topology G, credential distribution d, network hygiene level h, and simulated attack paths p^i.

Output: Predicted set of at-risk machines S_k, vulnerability scores L(G,h), and average path lengths.

Scoring recipe

def score_defense(attack_paths, get_predicted_machines, k=8):
    hits = 0
    total = 0
    for path in attack_paths:
        for i in range(1, len(path)):
            predicted = get_predicted_machines(G, path[:i], k)
            actual_next = path[i]
            if actual_next in predicted:
                hits += 1
            total += 1
    return hits / total if total > 0 else 0

def score_vulnerability(G, d, h, num_trials=200):
    success_count = 0
    for _ in range(num_trials):
        path = simulate_attack(G, d, h)
        if path_reaches_dc(path):
            success_count += 1
    return success_count / num_trials

Common pitfalls

• Computation budget limits data collection; some strategy/hygiene combinations terminate early after 10,000 failed attempts.
• Domain controller is explicitly excluded from the predicted at-risk set S_k during defense evaluation.
• Vulnerability scores are computed via Monte-Carlo simulation over 50 credential distributions, not deterministic graph traversal.

Evidence (verbatim from paper)

We compute the network vulnerability statistics using Eq. 6.5—hygiene-specific L(G,h) ; and Eq. 6.6—whole-network L(G) from Section 6. We identify multiple key insights: 1. Informed Strategies Lead to Quicker Attacks The RE and DE strategies produce shorter paths in general, compared to RWE. This is expected, as prior knowledge should help the attacker reach the domain controller in less time.

Citation

@misc{freitas2020d2m,
  title={D2M: Dynamic Defense and Modeling of Adversarial Movement in Networks},
  author={Freitas et al. (2020)},
  year={2020},
  note={arXiv:2001.11108}
}

• arXiv: 2001.11108