D2m Defense Eval

---
name: d2m-defense-eval
description: Evaluates enterprise network vulnerability to lateral attacks by simulating adversarial movement across authentication graphs. It also measures the effectiveness of defense strategies in predicting attacker movement based on graph topology and credential hygiene levels. Use when the user wants to benchmark on G_s, G_l, G_lanl, or asks about evaluating this task. Reports Network Vulnerability.
metadata:
  skill_kind: dataset_eval
  source_arxiv: 2001.11108
  bibtex_key: freitas2020d2m
  confidence: high
---

# d2m-defense-eval

> D2M: Dynamic Defense and Modeling of Adversarial Movement in Networks — Freitas et al. (2020) (arXiv:2001.11108, 2020)

## What this evaluates

Evaluates enterprise network vulnerability to lateral attacks by simulating adversarial movement across authentication graphs. It also measures the effectiveness of defense strategies in predicting attacker movement based on graph topology and credential hygiene levels.

## Datasets

- **G_s** — total 100; splits: test (-1)
- **G_l** — total 2039; splits: test (-1)
- **G_lanl** — total 14813; splits: test (-1)

## Metrics

- `Network Vulnerability` **(primary)** — range: [0, 1]
  - Probabilistic measure of network susceptibility to lateral attack, computed via Monte-Carlo simulation over 50 credential distributions. It represents the likelihood of an attacker reaching the domain controller given graph topology, credential distribution, and hygiene level.
- `Defense Strategy Success` — range: [0, 1]
  - Measures the ability to predict attacker movement by intersecting the predicted at-risk machines S_k with the actual next attack node p^{i+1}, averaged over all sub-paths.
- `Average Attack Path Length` — range: [0, ∞)
  - Mean number of hops required for simulated attack strategies (Rank-Explore, Degree-Explore, Random Walk) to reach the domain controller across all credential distributions.

## Input / output format

**Input**: Graph topology G, credential distribution d, network hygiene level h, and simulated attack paths p^i.

**Output**: Predicted set of at-risk machines S_k, vulnerability scores L(G,h), and average path lengths.

## Scoring recipe

```python
def score_defense(attack_paths, get_predicted_machines, k=8):
    hits = 0
    total = 0
    for path in attack_paths:
        for i in range(1, len(path)):
            predicted = get_predicted_machines(G, path[:i], k)
            actual_next = path[i]
            if actual_next in predicted:
                hits += 1
            total += 1
    return hits / total if total > 0 else 0

def score_vulnerability(G, d, h, num_trials=200):
    success_count = 0
    for _ in range(num_trials):
        path = simulate_attack(G, d, h)
        if path_reaches_dc(path):
            success_count += 1
    return success_count / num_trials
```

## Common pitfalls

- Computation budget limits data collection; some strategy/hygiene combinations terminate early after 10,000 failed attempts.
- Domain controller is explicitly excluded from the predicted at-risk set S_k during defense evaluation.
- Vulnerability scores are computed via Monte-Carlo simulation over 50 credential distributions, not deterministic graph traversal.

## Evidence (verbatim from paper)

> We compute the network vulnerability statistics using Eq. 6.5—hygiene-specific L(G,h) ; and Eq. 6.6—whole-network L(G) from Section 6. We identify multiple key insights: 1. Informed Strategies Lead to Quicker Attacks The RE and DE strategies produce shorter paths in general, compared to RWE. This is expected, as prior knowledge should help the attacker reach the domain controller in less time.

## Citation

```bibtex
@misc{freitas2020d2m,
  title={D2M: Dynamic Defense and Modeling of Adversarial Movement in Networks},
  author={Freitas et al. (2020)},
  year={2020},
  note={arXiv:2001.11108}
}
```

- arXiv: 2001.11108