Hybrid deep learning framework for detection of lateral movement in advanced persistent threats

Balaganesh Bojarajulu, M. Sethumadhavan, Vasily Sachnev, P. P. Amritha

Advanced persistent threats often use stolen or legitimate credentials to move stealthily across networks, making them difficult to detect with traditional security systems. This study introduces a novel framework called dual classifier-based lateral movement detection (DC-LMD-APTs), designed to identify such covert behaviours through a combination of feature engineering and hybrid deep learning. Data from the Sysmon-based LMD-2023 dataset, were enhanced with six statistical descriptors, one entropy feature, and one grass berger entropy-based mutual information (GBE-MI) feature, resulting in 101 features used for model training and validation. Data from the Sysmon-based LMD-2023 dataset, originally containing 95 raw features, were enhanced with six statistical descriptors, one entropy feature, and one GBE-MI feature, resulting in 101 features used for model training and validation. The data is first cleaned and normalized using Pareto-based variable stability normalization (P-VSN) to suppress noise and stabilize variance, followed by GBE-MI weighting to identify the most informative and non-redundant attributes. Unlike previous studies that train deep models directly on raw or unweighted features, the proposed approach employs entropy-guided and information-theoretic feature optimization, enabling the model to focus on highly discriminative attributes that improve generalization and reduce overfitting. Unlike conventional deep-learning models, DC-LMD-APTs applies convolutional neural network (CNN) and long short-term memory (LSTM) architectures to structured Sysmon log data arranged into a correlation matrix, where the PRCNN branch extracts spatial relationships among features and the Bi-LSTM models temporal dependencies of event sequences. This dual-domain learning enables effective detection of multi-stage APT behaviours. In experiments, the framework achieved 98.7% accuracy, 98.75% precision, 98.2% recall, and 97.1% specificity, outperforming CNN, LSTM, and DenseNet baselines. These results were achieved through the integration of P-VSN normalization, entropy-based feature weighting, and spatial–temporal fusion, which collectively enhanced learning stability, interpretability, and robustness. Extensive evaluations, including K-fold cross-validation, ablation studies, and SHAP-based explainability, confirm the reliability and scalability of the proposed model for real-time detection of lateral movements in large networks.