Open Access

ARTICLE

UGEA-LMD: A Continuous-Time Dynamic Graph Representation Enhancement Framework for Lateral Movement Detection

Jizhao Liu, Yuanyuan Shao^*, Shuqin Zhang, Fangfang Shan, Jun Li

College of Computer, Zhongyuan University of Technology, Zhengzhou, 450007, China

* Corresponding Author: Yuanyuan Shao. Email:

Computers, Materials & Continua 2026, 86(1), 1-20. https://doi.org/10.32604/cmc.2025.068998

Received 11 June 2025; Accepted 12 September 2025; Issue published 10 November 2025

Abstract

Lateral movement represents the most covert and critical phase of Advanced Persistent Threats (APTs), and its detection still faces two primary challenges: sample scarcity and “cold start” of new entities. To address these challenges, we propose an Uncertainty-Driven Graph Embedding-Enhanced Lateral Movement Detection framework (UGEA-LMD). First, the framework employs event-level incremental encoding on a continuous-time graph to capture fine-grained behavioral evolution, enabling newly appearing nodes to retain temporal contextual awareness even in the absence of historical interactions and thereby fundamentally mitigating the cold-start problem. Second, in the embedding space, we model the dependency structure among feature dimensions using a Gaussian copula to quantify the uncertainty distribution, and generate augmented samples with consistent structural and semantic properties through adaptive sampling, thus expanding the representation space of sparse samples and enhancing the model's generalization under sparse sample conditions. Unlike static graph methods that cannot model temporal dependencies or data augmentation techniques that depend on predefined structures, UGEA-LMD offers both superior temporal-dynamic modeling and structural generalization. Experimental results on the large-scale LANL log dataset demonstrate that, under the transductive setting, UGEA-LMD achieves an AUC of 0.9254; even when 10% of nodes or edges are withheld during training, UGEA-LMD significantly outperforms baseline methods on metrics such as recall and AUC, confirming its robustness and generalization capability in sparse-sample and cold-start scenarios.

---

Keywords

---