A novel centrality measure for analyzing lateral movement in complex networks

Identifying critical nodes whose removal or compromise can significantly disrupt network functionality is a fundamental challenge within complex networks. Recognizing these pivotal nodes enables the analysis of topological features like vulnerability and robustness, and plays a crucial role in understanding the dynamics of diverse systems across various network analysis applications. Traditional centrality measures, including local, global, and semi-local measures, provide valuable insights into node importance but often fail to capture the complexities of lateral movement scenarios, where nodes play varied roles beyond simple connectivity. In such scenarios, nodes are typically categorized as source nodes (initial points of cyber adversaries’ access), intermediate nodes, and target nodes (intended destinations for cyber adversaries). Existing centrality measures neglect this categorization, rendering them ineffective for lateral movement analysis. This paper introduces a novel centrality measure that integrates insights from established centrality measures with an understanding of lateral movement dynamics, offering a comprehensive framework for evaluating node influence in lateral movement contexts. Empirical analyses across diverse network datasets demonstrate the effectiveness of our proposed centrality measure in accurately identifying influential nodes in lateral movement scenarios. Our work addresses a critical gap in network analysis and has implications for enhancing security measures across various domains.