Detecting Lateral Movement with Neural Networks Trained Solely on Synthetic Data

A researcher has demonstrated that neural networks trained exclusively on synthetic data can effectively detect lateral movement in real enterprise networks. The method relies on a compact 135-line configuration that defines an entire fictional corporate environment, including user accounts, machines, roles, and authentication histories. No real attack logs were used during training or threshold tuning.

The synthetic generator creates five classes of machines: ordinary workstations, high-traffic servers, newly added systems, compromised hosts, and hosts that are both new and compromised. This structure forces the model to learn the difference between legitimate novelty and attacker-driven novelty. Authentication events are produced deterministically from the configuration, yielding roughly 400,000 events in seconds on a laptop.

After training, the models were tested on the public Los Alamos National Laboratory Comprehensive Multi-Source Cyber-Security Events dataset containing 1.65 billion authentication records over 58 days. The red-team ground truth included 749 labeled events involving 104 compromised accounts and 301 destination machines, with 94 percent of activity originating from a single beachhead.

The best ensemble of six networks ranked 3.6 million hourly machine windows by suspicion. Sixteen of the 23 highest-ranked windows corresponded to actual red-team activity, leaving only seven false positives for analysts to review. A conventional count-based detector required 161,000 false positives to surface the same sixteenth attack.

The work also revealed a practical refinement loop: each false negative on real data pointed to a missing phenomenon in the synthetic world, which could be added with two additional configuration lines. The resulting models achieved AUC scores within the range reported by research groups that trained directly on labeled real-world data.