Iranian Society of Cryptology The ISC International Journal of Information Security 2008-2045 Articles in Press 2026 03 26 Lateral Movement Attack Detection using Variational Autoencoders 242099 10.22042/isecure.2026.242099 EN Mostafa Shabani Department of Industrial Engineering, Iran University of Science and Technology, Tehran, Iran. ICT Security Faculty, ICT Research Institute (ITRC), Tehran, Iran. Tala Tafazoli ICT Security Faculty, ICT Research Institute (ITRC), Tehran, Iran. Journal Article Lateral movement, a sophisticated cyberattack strategy, enables adversaries to stealthily infiltrate networks following an initial breach. Detecting such maneuvers is exceptionally challenging, as they are designed to seamlessly blend with legitimate system operations and network traffic, rendering traditional signature-based defenses ineffective. Supervised machine learning approaches, while promising, are constrained by their dependence on pre-labeled datasets of known attack patterns. To overcome these limitations, this study introduces a novel hybrid deep learning framework that integrates a Variational Autoencoder (VAE) for robust feature extraction, coupled with a supervised classifier to identify lateral movement. Through meticulous feature engineering on the LMD dataset, the VAE is trained exclusively on normative system and network behavior, constructing a probabilistic representation of legitimate activity. Anomalies, detected via reconstruction error, signal potential malicious intrusions. Empirical evaluation demonstrates the framework’s superior performance, achieving a detection time of 00:00:02:54 and an AUC of 99.6983%, reflecting exceptional class separation and computational efficiency. This hybrid architecture delivers a scalable, high-accuracy solution, establishing the VAE as a pivotal tool for combating advanced persistent threats with unparalleled precision and operational viability.  https://www.isecure-journal.com/article_242099_008719d1f4782b1073152f781ed5e64f.pdf