When an attacker gets access to the network of an enterprise, he/she tries to exploit vulnerabilities on a given network node. While doing this, the attacker moves from one network endpoint to another while gaining access to more services and the administration of the network and application infrastructure. This movement leaves traces within the network logs.
Machine learning algorithms can be trained with lateral movements to trace data and detect the suspicious user movements. If these movements are tracked by streaming the live network logs through the processing systems, the intrusion can potentially be detected in near real time.
