Published Paper Details:

Lateral movement continues to pose a significant threat within advanced persistent threat (APT) campaigns, allowing attackers to escalate privileges, navigate across systems, and stealthily access critical enterprise resources. Conventional privilege administration and identification strategies, which rely mostly on static guidelines, sign-based archives and hand-on controls, are unable to respond rapidly to such in motion intrusions. In this paper, we present the idea of an Autonomous Privilege Management (APM) system with the assistance of artificial intelligence that allows, in real-time, to predict and prevent the use of privileges to successfully prevent lateral movement. The architecture integrates endpoints, network and identity telemetry with machine-learning algorithms to detect anomalies in privilege usage and to calculate adaptive threat scores. By using a reinforced learning powered decision module, the APM automatically initiates privilege downgrades or revocations with little operational effect. APM was also tested in a hybrid enterprise setting involving both synthetic and real-world attack models and has significantly outperformed traditional Privileged Access Management (PAM) solutions due to a 43 % increase in the mean time to contain (MTTC) and a 31 % decrease in false positives. These results highlight the capability of the system to offer, in a context-aware fashion, rapid mitigation and update to new attack vectors without requiring manual system updates. In operationalizing the zero-trust principles by autonomous, intelligent control, the work presents an effective solution that is a scalable and proactive approach to the lateral movement defense.