Designing a reliable lateral movement detector using a graph foundation model
This addresses the problem of making cybersecurity tools more accessible and effective for practitioners by leveraging pre-trained models, though it is incremental as it focuses on a specific use case.
The paper tackled the challenge of applying foundation models to cybersecurity by using a graph foundation model (GFM) to build a lateral movement detector, achieving state-of-the-art performance without domain-specific training.
Foundation models have recently emerged as a new paradigm in machine learning (ML). These models are pre-trained on large and diverse datasets and can subsequently be applied to various downstream tasks with little or no retraining. This allows people without advanced ML expertise to build ML applications, accelerating innovation across many fields. However, the adoption of foundation models in cybersecurity is hindered by their inability to efficiently process data such as network traffic captures or binary executables. The recent introduction of graph foundation models (GFMs) could make a significant difference, as graphs are well-suited to representing these types of data. We study the usability of GFMs in cybersecurity through the lens of one specific use case, namely lateral movement detection. Using a pre-trained GFM, we build a detector that reaches state-of-the-art performance without requiring any training on domain-specific data. This case study thus provides compelling evidence of the potential of GFMs for cybersecurity.