{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,1,31]],"date-time":"2026-01-31T21:14:17Z","timestamp":1769894057056,"version":"3.49.0"},"publisher-location":"Singapore","reference-count":36,"publisher":"Springer Nature Singapore","isbn-type":[{"value":"9789819544332","type":"print"},{"value":"9789819544349","type":"electronic"}],"license":[{"start":{"date-parts":[[2025,11,13]],"date-time":"2025-11-13T00:00:00Z","timestamp":1762992000000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"},{"start":{"date-parts":[[2025,11,13]],"date-time":"2025-11-13T00:00:00Z","timestamp":1762992000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2026]]},"DOI":"10.1007\/978-981-95-4434-9_25","type":"book-chapter","created":{"date-parts":[[2025,11,12]],"date-time":"2025-11-12T23:02:58Z","timestamp":1762988578000},"page":"542-561","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":0,"title":["Synthetic Lateral Movement Data Generation for\u00a0Azure Cloud: A Hopper-Based Approach"],"prefix":"10.1007","author":[{"given":"Mohammad","family":"Mamun","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Hadeer","family":"Ahmed","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Anas","family":"Mabrouk","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Sherif","family":"Saad","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"297","published-online":{"date-parts":[[2025,11,13]]},"reference":[{"key":"25_CR1","unstructured":"Vectra AI: Using AI to detect and stop lateral movement in the cloud (2024). https:\/\/www.vectra.ai\/resources\/using-ai-to-detect-and-stop-lateral-movement-in-the-cloud"},{"issue":"3","key":"25_CR2","doi-asserted-by":"publisher","first-page":"626","DOI":"10.1007\/s10618-014-0365-y","volume":"29","author":"L Akoglu","year":"2015","unstructured":"Akoglu, L., Tong, H., Koutra, D.: Graph based anomaly detection and description: a survey. Data Min. Knowl. Disc. 29(3), 626\u2013688 (2015)","journal-title":"Data Min. Knowl. Disc."},{"key":"25_CR3","unstructured":"Ammara, D.A., Ding, J., Tutschku, K.: Synthetic network traffic data generation: a comparative study (2025). https:\/\/arxiv.org\/abs\/2410.16326"},{"key":"25_CR4","doi-asserted-by":"publisher","first-page":"9","DOI":"10.1016\/j.comcom.2020.10.013","volume":"165","author":"T Bai","year":"2021","unstructured":"Bai, T., Bian, H., Salahuddin, M.A., Abou Daya, A., Limam, N., Boutaba, R.: RDP-based lateral movement detection using machine learning. Comput. Commun. 165, 9\u201319 (2021)","journal-title":"Comput. Commun."},{"key":"25_CR5","unstructured":"Chierici, S.: Sysdig cloud lateral movement: Breaking in through a vulnerable container (2021). https:\/\/sysdig.com\/blog\/lateral-movement-cloud-containers"},{"key":"25_CR6","doi-asserted-by":"crossref","unstructured":"Chowdhury, A., Nguyen, H.: Cozure: context free grammar co-pilot tool for finding new lateral movements in azure active directory. In: Proceedings of the 26th International Symposium on Research in Attacks, Intrusions and Defenses, pp. 426\u2013439 (2023)","DOI":"10.1145\/3607199.3607228"},{"key":"25_CR7","unstructured":"Cybersecurity and Infrastructure Security Agency (CISA): Joint cybersecurity advisory: Protecting against interlock ransomware (2025). https:\/\/www.cisa.gov\/news-events\/alerts\/2025\/07\/22\/joint-advisory-issued-protecting-against-interlock-ransomware. Accessed 22 July 2025"},{"key":"25_CR8","unstructured":"Esteban, J.: Simulating network lateral movements through the cyberbattlesim web platform. Ph.D. thesis, Massachusetts Institute of Technology (2022)"},{"key":"25_CR9","doi-asserted-by":"crossref","unstructured":"Hagberg, A., Kent, A., Lemons, N., Neil, J.: Credential hopping in authentication graphs. In: 2014 International Conference on Signal-Image Technology Internet-Based Systems (SITIS). IEEE Computer Society (2014)","DOI":"10.1109\/SITIS.2014.95"},{"key":"25_CR10","unstructured":"Hamilton, W.L., Ying, R., Leskovec, J.: Inductive representation learning on large graphs. In: Advances in Neural Information Processing Systems, pp. 1024\u20131034 (2017)"},{"key":"25_CR11","unstructured":"Hariri, S., Kind, M.C., Brunner, R.J.: Extended isolation forest. In: 2021 IEEE 8th International Conference on Data Science and Advanced Analytics (DSAA), pp. 1\u201310. IEEE (2021)"},{"key":"25_CR12","unstructured":"Ho, G., et al.: Hopper: modeling and detecting lateral movement. In: 30th USENIX Security Symposium (USENIX Security 2021), pp. 3093\u20133110 (2021)"},{"key":"25_CR13","first-page":"2056","volume":"36","author":"S Huang","year":"2023","unstructured":"Huang, S., et al.: Temporal graph benchmark for machine learning on temporal graphs. Adv. Neural. Inf. Process. Syst. 36, 2056\u20132073 (2023)","journal-title":"Adv. Neural. Inf. Process. Syst."},{"key":"25_CR14","unstructured":"Illumio Editorial: Lateral movement: How to solve the cloud\u2019s biggest risk (2024). www.illumio.com\/blog\/lateral-movement-how-to-solve-the-clouds-biggest-risk. Accessed 13 Aug 2025"},{"key":"25_CR15","unstructured":"Kaiafas, P., Papadopoulos, G.K.: Detecting lateral movement: a systematic survey. Comput. Secur. J. (2024)"},{"key":"25_CR16","unstructured":"Kent, A.D.: Comprehensive, multi-source cyber-security events data set. Technical report, Los Alamos National Lab.(LANL), Los Alamos, NM (United States) (2015)"},{"key":"25_CR17","doi-asserted-by":"crossref","unstructured":"Khoury, J., Klisura, \u0110., Zanddizari, H., Parra, G.D.L.T., Najafirad, P., Bou-Harb, E.: Jbeil: temporal graph-based inductive learning to infer lateral movement in evolving enterprise networks. In: 2024 IEEE Symposium on Security and Privacy (SP), pp. 3644\u20133660. IEEE (2024)","DOI":"10.1109\/SP54263.2024.00009"},{"issue":"3","key":"25_CR18","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1145\/3588771","volume":"26","author":"IJ King","year":"2023","unstructured":"King, I.J., Huang, H.H.: Euler: detecting network lateral movement via scalable temporal link prediction. ACM Trans. Privacy Secur. 26(3), 1\u201336 (2023)","journal-title":"ACM Trans. Privacy Secur."},{"key":"25_CR19","unstructured":"Kroll: Q2 2024 threat landscape report (2024). https:\/\/www.kroll.com\/en\/reports\/cyber\/threat-intelligence-reports\/q2-2024-threat-landscape-report-threat-actors-ransomware-cloud-risks-accelerate. Accessed 07 Nov 2024"},{"key":"25_CR20","unstructured":"Kushwaha, D., et\u00a0al.: Lateral movement detection using user behavioral analysis. arXiv preprint arXiv:2208.13524 (2022)"},{"key":"25_CR21","doi-asserted-by":"crossref","unstructured":"Liu, F.T., Ting, K.M., Zhou, Z.H.: Isolation forest. In: 2008 Eighth IEEE International Conference on Data Mining, pp. 413\u2013422. IEEE (2008)","DOI":"10.1109\/ICDM.2008.17"},{"issue":"1","key":"25_CR22","first-page":"3","volume":"6","author":"FT Liu","year":"2012","unstructured":"Liu, F.T., Ting, K.M., Zhou, Z.H.: Isolation-based anomaly detection. ACM Trans. Knowl. Discov. Data (TKDD) 6(1), 3 (2012)","journal-title":"ACM Trans. Knowl. Discov. Data (TKDD)"},{"key":"25_CR23","doi-asserted-by":"crossref","unstructured":"Mamun, M., Buffett, S.: Taptree: process-tree based host behavior modeling and threat detection framework via sequential pattern mining. In: International Conference on Information and Communications Security, pp. 546\u2013565. Springer, Cham (2022)","DOI":"10.1007\/978-3-031-15777-6_30"},{"key":"25_CR24","doi-asserted-by":"crossref","unstructured":"Mamun, M., Shi, K.: Deeptaskapt: insider apt detection using task-tree based deep learning. In: 2021 IEEE 20th International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom), pp. 693\u2013700. IEEE (2021)","DOI":"10.1109\/TrustCom53373.2021.00102"},{"key":"25_CR25","unstructured":"Meijerink, T.: Anomaly-based detection of lateral movement in a Microsoft Windows environment. Master\u2019s thesis, University of Twente, Enschede, The Netherlands (2019). https:\/\/essay.utwente.nl\/77122\/1\/Meijerink_MA_EWI.pdf"},{"issue":"22","key":"25_CR26","doi-asserted-by":"publisher","first-page":"4546","DOI":"10.3390\/electronics13224546","volume":"13","author":"Z Mori\u0107","year":"2024","unstructured":"Mori\u0107, Z., Daki\u0107, V., Kapulica, A., Regvart, D.: Forensic investigation capabilities of Microsoft azure: a comprehensive analysis and its significance in advancing cloud cyber forensics. Electronics 13(22), 4546 (2024)","journal-title":"Electronics"},{"key":"25_CR27","doi-asserted-by":"crossref","unstructured":"Purohit, S., Mackey, P.S., Cottam, J.A., Dunning, M.P., Chin, G.: Synthetic data and graph generation for modeling adversarial activity (final project report). Technical report, Pacific Northwest National Lab. (PNNL), Richland, WA (US) (2022)","DOI":"10.2172\/1871012"},{"issue":"3","key":"25_CR28","doi-asserted-by":"publisher","first-page":"223","DOI":"10.1002\/wics.1347","volume":"7","author":"S Ranshous","year":"2015","unstructured":"Ranshous, S., Shen, S., Koutra, D., Harenberg, S., Faloutsos, C., Samatova, N.F.: Anomaly detection in dynamic networks: a survey. Wiley Interdisc. Rev.: Comput. Stat. 7(3), 223\u2013247 (2015)","journal-title":"Wiley Interdisc. Rev.: Comput. Stat."},{"key":"25_CR29","doi-asserted-by":"publisher","first-page":"156","DOI":"10.1016\/j.cose.2018.12.012","volume":"82","author":"M Ring","year":"2019","unstructured":"Ring, M., Wunderlich, S., Scheuring, D., Landes, D.: Flow-based network traffic generation using generative adversarial networks. Comput. Secur. 82, 156\u2013172 (2019)","journal-title":"Comput. Secur."},{"issue":"5","key":"25_CR30","doi-asserted-by":"publisher","first-page":"756","DOI":"10.1109\/JPROC.2021.3052449","volume":"109","author":"L Ruff","year":"2021","unstructured":"Ruff, L., et al.: A unifying review of deep and shallow anomaly detection. Proc. IEEE 109(5), 756\u2013795 (2021)","journal-title":"Proc. IEEE"},{"key":"25_CR31","unstructured":"SentinelOne: The state of cloud ransomware in 2024 (2024). https:\/\/www.sentinelone.com\/blog\/the-state-of-cloud-ransomware-in-2024\/. Accessed 02 Jan 2025"},{"key":"25_CR32","doi-asserted-by":"publisher","unstructured":"Sun, X., Yang, J.: Hetglm: lateral movement detection by discovering anomalous links with heterogeneous graph neural network. In: 2022 IEEE International Performance, Computing, and Communications Conference (IPCCC), p. 404 (2022). https:\/\/doi.org\/10.1109\/IPCCC55026.2022.9894347","DOI":"10.1109\/IPCCC55026.2022.9894347"},{"key":"25_CR33","unstructured":"Velickovic, P., Cucurull, G., Casanova, A., Romero, A., Li\u00f2, P., Bengio, Y.: Graph attention networks. In: 6th International Conference on Learning Representations, ICLR 2018, Vancouver, BC, Canada. OpenReview.net (2018)"},{"key":"25_CR34","unstructured":"Wang, R., et al.: Context correlation discrepancy analysis for graph anomaly detection. IEEE Trans. Knowl. Data Eng. (2024)"},{"key":"25_CR35","doi-asserted-by":"publisher","first-page":"3972","DOI":"10.1109\/TIFS.2022.3208815","volume":"17","author":"S Wang","year":"2022","unstructured":"Wang, S., et al.: Threatrace: detecting and tracing host-based threats in node level through provenance graph learning. IEEE Trans. Inf. Forensics Secur. 17, 3972\u20133987 (2022)","journal-title":"IEEE Trans. Inf. Forensics Secur."},{"issue":"7","key":"25_CR36","doi-asserted-by":"publisher","DOI":"10.1371\/journal.pone.0327161","volume":"20","author":"C Xu","year":"2025","unstructured":"Xu, C., Li, D., Liu, Z., Yang, J., Shen, Q., Tong, N.: Few-shot network intrusion detection method based on multi-domain fusion and cross-attention. PLoS ONE 20(7), e0327161 (2025). https:\/\/doi.org\/10.1371\/journal.pone.0327161","journal-title":"PLoS ONE"}],"container-title":["Lecture Notes in Computer Science","Cryptology and Network Security"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/978-981-95-4434-9_25","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,1,31]],"date-time":"2026-01-31T10:02:34Z","timestamp":1769853754000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/978-981-95-4434-9_25"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,11,13]]},"ISBN":["9789819544332","9789819544349"],"references-count":36,"URL":"https:\/\/doi.org\/10.1007\/978-981-95-4434-9_25","relation":{},"ISSN":["0302-9743","1611-3349"],"issn-type":[{"value":"0302-9743","type":"print"},{"value":"1611-3349","type":"electronic"}],"subject":[],"published":{"date-parts":[[2025,11,13]]},"assertion":[{"value":"13 November 2025","order":1,"name":"first_online","label":"First Online","group":{"name":"ChapterHistory","label":"Chapter History"}},{"value":"CANS","order":1,"name":"conference_acronym","label":"Conference Acronym","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"International Conference on Cryptology and Network Security","order":2,"name":"conference_name","label":"Conference Name","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Osaka","order":3,"name":"conference_city","label":"Conference City","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Japan","order":4,"name":"conference_country","label":"Conference Country","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"2025","order":5,"name":"conference_year","label":"Conference Year","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"17 November 2025","order":7,"name":"conference_start_date","label":"Conference Start Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"21 November 2025","order":8,"name":"conference_end_date","label":"Conference End Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"24","order":9,"name":"conference_number","label":"Conference Number","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"cans2025","order":10,"name":"conference_id","label":"Conference ID","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"https:\/\/cy2sec.comm.eng.osaka-u.ac.jp\/miyaji-lab\/event\/cans2025\/index.html","order":11,"name":"conference_url","label":"Conference URL","group":{"name":"ConferenceInfo","label":"Conference Information"}}]}}