基于图的横向移动检测器的公平且现实的性能评估
On fair and realistic performance evaluations for graph-based lateral movement detectors
中文总结 AI 辅助
该研究针对横向移动检测领域数据集预处理与标注的差异问题，提出合理策略并重新评估三种检测方法，发现结果与原报告差异显著，凸显了预处理和标注的关键作用。
中文摘要 AI 辅助
近年来，得益于基准数据集的广泛可用使检测器评估成为可能，横向移动检测研究取得了显著进展。然而，不同文献中这些基准数据集的使用方式存在差异：将数据输入检测器前的预处理，以及与横向移动相关事件的标注，在不同论文间差异很大。我们调查了两个流行数据集的预处理和标注方法，展示了它们对下游评估公平性和现实性的影响。我们还为这些数据集提出了合理的预处理和标注策略。最后，我们在这些新策略下重新评估了三种被广泛引用的横向移动检测方法；我们的结果与原论文中报告的结果显著不同，进一步凸显了数据集预处理和标注实践在评估横向移动检测器中的关键重要性。
英文摘要
Research on lateral movement detection has made significant progress in recent years, spurred by the widespread availability of benchmark datasets that make evaluating detectors practical. However, the exact way in which these benchmark datasets are used varies across the literature: both the preprocessing applied before feeding the data to the detector and the labeling of lateral movement-related events change substantially from one paper to another. We survey preprocessing and labeling methodologies for two popular datasets and demonstrate their impact on the fairness and realism of downstream evaluations. We also propose well-grounded preprocessing and labeling policies for these datasets. Finally, we re-evaluate three widely cited lateral movement detection methods under these new policies; our results differ significantly from those reported in the original papers, further highlighting the critical importance of dataset preprocessing and labeling practices in evaluating lateral movement detectors.
