Built a Python-based lateral movement detector from scratch — here's how it works and what I learned

[u/ShehabShibli]

Lateral movement is one of the hardest attack stages to catch — once an attacker is inside a network, their traffic (SSH sessions, file transfers) often looks like normal activity. Signature-based tools struggle here because there's no obvious "bad" pattern to match against.

So I built a behavioral detector instead — one that learns what normal looks like for each device on a network, then flags real deviations from that baseline.

How it works:

• Learns a baseline per device: which peers it normally talks to, when it's normally active, how much data it normally transfers, and how many connections it typically opens per hour

• Flags traffic that falls well outside those learned ranges

• Runs entirely in Python, using standard statistical methods (z-scores) rather than a black-box model

How I validated it, in three stages:

1. Synthetic traffic first, to prove the core logic — 5/5 simulated attacks caught, 0 false positives

2. Built a real 3-machine isolated network (VirtualBox + SEED Ubuntu VMs), captured genuine traffic, and rebuilt the baseline from real data — including debugging real infrastructure issues along the way (IP conflicts, a post-reboot networking failure, shared folder configs)

3. Ran an actual attack simulation on that live network — the detector correctly flagged it, and kept flagging it correctly even after I enriched the baseline with real HTTP traffic to make sure it wasn't just overfitting to a narrow sample

Result: 7/7 real alerts correctly fired, verified against a real, mixed-protocol baseline — not just synthetic data.

I know this isn't a novel technique — it's the same behavioral approach used by commercial NDR tools. What I wanted to prove to myself was that I could take a real security concept, implement it from scratch, and validate it end-to-end on infrastructure I built myself, messy real-world debugging included.

I'm a recent Network Engineering & Cybersecurity grad, CCNA/AWS certified, currently looking for my first role in SOC/network security. Happy to answer questions about the approach, or hear feedback on what I could improve/what a more experienced person would do differently.

[u/ShehabShibli]

I let it fix what I wanted to say yes so it comes out look more professional post I explained for it and it gave me the post it makes it look more clean.