Enterprise organizations operate multiple connected systems and user accounts that communicate through authentication services. If an attacker compromises an account on one system, the attacker may attempt to use existing authentication relationships and access permissions to reach additional systems. This activity is known as lateral movement.
In this use case, an enterprise-like Linux environment is created using Ubuntu virtual machines, while Kali Linux is used as the security-testing environment. OpenSSH is used to establish controlled authentication relationships between authorized laboratory systems. A controlled lateral movement simulation is performed to determine whether the designated test account can authenticate to another system through an existing access relationship.
Nmap is used to identify active laboratory hosts and available services, while Wireshark is used to capture and inspect network traffic generated during the simulation. Authentication logs from the Ubuntu systems are collected to identify successful and failed authentication attempts and establish evidence of the simulated activity.
A publicly available labeled authentication-event dataset is also used to support authentication relationship analysis. Python and Pandas are used to process the dataset and the laboratory authentication records. NetworkX is used to construct a knowledge graph in which user accounts and systems are represented as nodes, while authentication relationships are represented as edges.
Breadth-First Search (BFS) and Depth-First Search (DFS) algorithms are applied to explore the graph and identify potential lateral movement paths from the initially compromised account. The paths identified by graph traversal are compared with the observed laboratory authentication events. Matplotlib is used to visualize the graph and its identified paths.
Application/Service: Enterprise Linux Authentication Networks Using OpenSSH
OpenSSH provides secure remote access between Linux systems. Enterprise environments may contain multiple systems and user accounts connected through configured authentication relationships and access permissions.
If an attacker compromises an account that can authenticate to other systems, the attacker may attempt to use those existing relationships to move through the network. Authentication events may be recorded separately on individual systems, making it difficult to understand the complete relationship between the initial account and other systems it can potentially reach.
Host and service discovery can identify active systems and exposed services, but it does not independently establish which accounts can authenticate to which systems. Similarly, individual authentication logs may show separate login events without presenting the complete set of relationships as a graph.
Without structured authentication relationship analysis, security analysts may find it difficult to identify potential lateral movement paths, determine which systems are reachable from a compromised account, and distinguish paths predicted by a graph from movement actually observed during an attack.
The proposed solution introduces controlled SSH-based lateral movement assessment, authentication-event collection, knowledge graph construction, BFS/DFS path identification, comparison with observed laboratory events, graph visualization, and final security validation.
Specific Attack: SSH-Based Lateral Movement Through Existing Authentication Relationships
The controlled attack scenario evaluates whether a designated laboratory account, representing an initially compromised account, can authenticate to another authorized Linux system through a configured SSH authentication relationship.
Kali Linux is used as the security-testing workstation, and Ubuntu Linux provides the target systems. Nmap is used to discover authorized laboratory hosts and relevant services. Controlled SSH authentication attempts are performed using the laboratory accounts and permissions configured for the experiment.
Authentication logs are examined to determine whether the attempts succeeded or failed. Wireshark captures and inspects relevant network traffic generated during the experiment. The resulting authentication events are used to construct and validate the knowledge graph and compare potential lateral movement paths with the activity observed during the simulation.
The assessment is restricted to the isolated laboratory. Only designated test accounts and systems are used, and the simulation does not target external systems or use real compromised credentials.
Knowledge Graph-Based Authentication Relationship and Lateral Movement Path Analysis
The primary security concept is Knowledge Graph-Based Authentication Relationship Analysis. It represents user accounts, systems, and their authentication relationships in a structured graph so that security analysts can examine how access between systems is connected.
In this project, NetworkX constructs the graph using authentication relationships extracted from the laboratory records and the publicly available labeled authentication-event dataset. User accounts and systems are represented as nodes, while the relevant authentication relationships are represented as edges. Available event attributes, such as source account, destination system, authentication result, and event source, are retained to support analysis and validation.
BFS and DFS are used to explore the graph from the node representing the initially compromised account. BFS explores connected nodes level by level, while DFS explores one branch before backtracking. These algorithms identify reachable nodes and potential paths within the graph. The resulting paths are compared with observed laboratory authentication events to determine which paths are supported by evidence and which remain predictions based on the graph.
Authentication Records and Lab Events
↓
Account and System Identification
↓
Authentication Relationship Extraction
↓
Knowledge Graph Construction
↓
Initial Account Node Selection
↓
BFS and DFS Traversal
↓
Potential Lateral Movement Paths Identified
↓
Comparison with Observed Events
↓
Path Validation
↓
Graph Visualization and Analysis
The security concept defines the overall strategy for identifying potential lateral movement paths through authentication relationship analysis.
The following are the specific defensive mechanisms implemented.
Relevant SSH authentication records are collected from the Ubuntu laboratory systems. Available details, including timestamps, account identities, source information, destination information, and authentication outcomes, are used to establish the sequence of observed activity.
Laboratory accounts are configured with only the permissions required for the experiment. Unnecessary SSH access and excessive account privileges are reviewed to reduce the number of systems a compromised account could potentially reach.
Authentication relationships are represented as graph edges, and BFS/DFS traversal is applied to identify possible paths from the initially compromised account to other systems.
Graph-generated paths are compared with authentication logs and controlled simulation records. Successful authentication events, failed attempts, inferred relationships, and paths that were not observed are distinguished during the analysis.
Nmap is used to identify active laboratory hosts and available services relevant to the controlled simulation.
Wireshark is used to capture and inspect network communications generated during the controlled authentication-based simulation.
After unnecessary access relationships or permissions are restricted, the controlled authentication test is repeated to verify the resulting access behavior.
NetworkX is the primary graph analysis tool because it represents authentication relationships between accounts and systems and supports graph traversal and path analysis.
Pandas is used to process authentication-event records collected from the laboratory systems and the publicly available labeled dataset.
Breadth-First Search and Depth-First Search are the algorithms used to explore the authentication relationship graph from the initially compromised account.
Matplotlib is used to display the constructed authentication graph and highlight the paths identified during the analysis.
Nmap is used to discover active hosts and identify available services within the authorized laboratory network.
Wireshark is used to capture and inspect network traffic generated during the controlled SSH-based simulation.
OpenSSH provides the SSH authentication service used to establish controlled remote-access relationships between the Ubuntu laboratory systems.
Ubuntu Linux provides the target systems and authentication environment used for the controlled lateral movement simulation.
Kali Linux provides the controlled security-testing environment used to initiate authorized SSH authentication attempts and perform network discovery.
Oracle VirtualBox provides the isolated laboratory infrastructure for running the Kali and Ubuntu virtual machines.
A publicly available labeled authentication-event dataset provides additional records for authentication relationship extraction, graph construction, and analysis. The dataset records are maintained separately from the events generated during the local laboratory simulation.
An isolated Linux laboratory is established using Oracle VirtualBox, Ubuntu Linux, and Kali Linux to assess SSH-based lateral movement through configured authentication relationships.
Authorized laboratory hosts and available services are identified using Nmap, establishing the initial network topology and identifying relevant SSH services.
A controlled lateral movement simulation is performed using designated laboratory accounts to determine whether an initially compromised account can authenticate to another system through an existing authentication relationship.
Authentication logs are collected from Ubuntu systems, and Wireshark captures provide supporting evidence of the network communications generated during the simulation.
A publicly available labeled authentication-event dataset is processed separately from the laboratory records to provide additional authentication relationships for graph analysis.
A knowledge graph is constructed using NetworkX to represent user accounts, systems, and authentication relationships identified in the available records.
BFS and DFS algorithms are applied to identify reachable nodes and potential lateral movement paths from the initially compromised account.
The paths identified through graph traversal are compared with observed authentication events to distinguish evidence-supported findings from paths predicted by the graph.
Graph visualization using Matplotlib presents authentication relationships and potential lateral movement paths, helping security analysts identify potentially risky access relationships for further investigation.
The complete lateral movement assessment, authentication-event collection, knowledge graph construction, BFS/DFS path identification, evidence-based path validation, graph visualization, and final security reporting workflow is demonstrated.
Research Breakthrough Possible @S-Logix