基于人工智能的横向移动攻击检测综述

谭儒; 范俪君; 王晓茜; 吴贤达; 高畅; 刘鑫阳; 杨碧铮; 刘玉岭; 刘奇旭

引用本文：

谭儒,范俪君,王晓茜,吴贤达,高畅,刘鑫阳,杨碧铮,刘玉岭,刘奇旭.基于人工智能的横向移动攻击检测综述[J].信息安全学报,已采用 [点击复制]
TANRU,FANLIJUN,WANGXIAOXI,WUXIANDA,GAOCHANG,LIUXINYANG,YANGBIZHENG,LIUYULING,LIUQIXU.A Survey on Artificial Intelligence-Based Lateral Movement Attack Detection[J].Journal of Cyber Security,Accept [点击复制]

本文已被：浏览 456次下载 134次
基于人工智能的横向移动攻击检测综述
谭儒¹, 范俪君¹, 王晓茜¹, 吴贤达¹, 高畅¹, 刘鑫阳², 杨碧铮³, 刘玉岭¹, 刘奇旭¹
字体:加大+\|默认\|缩小-
(1.中国科学院信息工程研究所;2.太原理工大学;3.西安电子科技大学)

摘要:

近年来，横向移动在高级可持续性威胁中的作用愈发凸显，传统互联网、云环境、工业互联网的持续演进与物联网设备的大规模部署，极大扩展了横向移动的攻击面，造成了不可估量的损失，亟需对现有检测技术开展系统性综述。随着人工智能技术的发展，该领域已涌现大量基于人工智能的检测方法。本文综合梳理相关研究以及近些年全球中横向移动相关的典型攻击事件，总结横向移动的攻击特征和发展趋势，随后从智能化的视角，分析横向移动攻击检测方法在数据表征形式、检测技术方法、数据集构建与增强三个维度的赋能路径，分析不同维度下人工智能的效能表现，按当前发展的网络场景分析归纳横向移动攻击检测的研究进展。本文的框架系统性地呈现了该领域的发展现状，通过总结现有研究的不足，讨论了当前人工智能驱动下横向移动攻击检测面临的关键挑战，并提出未来在大模型急速发展情况下的检测技术增强手段，提升横向移动威胁的发现与应对能力。

关键词: 横向移动人工智能检测技术网络安全

DOI：10.19363/J.cnki.cn10-1380/tn.2026.06.03

投稿时间：2025-12-17修订日期：2026-06-30

基金项目:国家自然科学基金项目（面上项目，重点项目，重大项目）

A Survey on Artificial Intelligence-Based Lateral Movement Attack Detection

TANRU¹, FANLIJUN¹, WANGXIAOXI¹, WUXIANDA¹, GAOCHANG¹, LIUXINYANG², YANGBIZHENG³, LIUYULING¹, LIUQIXU¹

(1.Institute of Information Engineering, Chinese Academy of Sciences;2.Taiyuan University of Technology;3.Xidian University)

Abstract:

In recent years, lateral movement has played an increasingly critical role in Advanced Persistent Threats. The continuous evolution of traditional networks, cloud and industrial internet, along with large-scale IoT deployment, has greatly expanded the attack surface of lateral movement, causing significant losses and creating an urgent need for a systematic review of detection technologies. With advances in artificial intelligence, many AI-based detection methods have emerged. This paper reviews relevant research and recent global attack incidents involving lateral movement, summarizes its characteristics and trends, and from an intelligent perspective to analyzes detecting approaches across three dimensions: data representation, detection techniques, and dataset construction and enhancement, and evaluates the performance of AI across these dimensions. It further outlines research progress in lateral movement detection across current network environments. The proposed framework systematically presents the state of the field, identifies shortcomings in existing work, discusses the challenges in AI-driven detection, and suggests future directions for enhancing detection capabilities with the rapid development of LLMs, with the aim of improving threat discovery and response.

Key words: Lateral Movement Artificial Intelligence Detection Technology Cyber Security