Explainable Tree-Based Machine Learning for Event-Level Lateral Movement Detection in Active Directory
DOI:
10.33395/sinkron.v10i4.16850Keywords:
Active Directory, Explainable AI, Lateral Movement, Machine Learning, SysmonAbstract
Windows Active Directory governs authentication across enterprise networks, making it a primary target for lateral movement techniques such as Pass-the-Hash and Golden Ticket, which disguise themselves as legitimate administrative activity within high-volume Sysmon logs. Prior work reported near-perfect accuracy for tree-based machine learning on this task but relied on global feature-importance methods that cannot explain individual predictions, leaving the source of that accuracy unexamined. This study aims to compare four tree-based algorithms and to determine which technical indicators actually drive their decisions. The method comprises leakage-aware feature selection, stratified splitting, partial SMOTE oversampling applied to training data only, evaluation through Macro F1-Score, Matthews Correlation Coefficient, ROC AUC and per-event inference time, and instance-level interpretation using SHAP and LIME, supported by an ablation study across four feature sets. On 35 behavioral features Extra Trees achieved the highest Macro F1 of 0.9370, and every algorithm exceeded the throughput required for event-level stream processing. The ablation study produced the central result: on the full feature set the model reached a near-perfect Macro F1 of 0.9998, yet this stemmed largely from memorizing attack-tool identities rather than learning behavior, because precision on the credential-theft class collapsed to 0.7343 in the ablation setting once binary-identity features were removed, corresponding to 0.7345 for the same feature set in the main 200-estimator run. It is concluded that Explainable AI serves not only as a transparency mechanism but as a diagnostic instrument capable of exposing shortcut learning behind seemingly excellent detection performance.
Downloads
References
Alabbadi, A., & Bajaber, F. (2025). An intrusion detection system over the IoT data streams using eXplainable Artificial Intelligence (XAI). Sensors, 25(3), 847. https://doi.org/10.3390/s25030847
Arreche, O., Guntur, T. R., Roberts, J. W., & Abdallah, M. (2024). E-XAI: Evaluating black-box explainable AI frameworks for network intrusion detection. IEEE Access, 12, 23954–23988. https://doi.org/10.1109/ACCESS.2024.3364526
Bai, T., Bian, H., Salahuddin, M. A., Abou Daya, A., Limam, N., & Boutaba, R. (2021). RDP-based lateral movement detection using machine learning. Computer Communications, 165, 9–19. https://doi.org/10.1016/j.comcom.2020.10.013
Barredo Arrieta, A., Díaz-Rodríguez, N., Del Ser, J., Bennetot, A., Tabik, S., Barbado, A., … Herrera, F. (2020). Explainable Artificial Intelligence (XAI): Concepts, taxonomies, opportunities and challenges toward responsible AI. Information Fusion, 58, 82–115. https://doi.org/10.1016/j.inffus.2019.12.012
Bin Hulayyil, S., Li, S., & Saxena, N. (2025). Explainable AI-based intrusion detection in IoT systems. Internet of Things, 31, 101589. https://doi.org/10.1016/j.iot.2025.101589
Bin Sarhan, B., & Altwaijry, N. (2023). Insider threat detection using machine learning approach. Applied Sciences, 13(1), 259. https://doi.org/10.3390/app13010259
Breiman, L. (2001). Random forests. Machine Learning, 45(1), 5–32. https://doi.org/10.1023/A:1010933404324
Chen, T., & Guestrin, C. (2016). XGBoost: A scalable tree boosting system. Proceedings of the 22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, 785–794. https://doi.org/10.1145/2939672.2939785
Demšar, J. (2006). Statistical comparisons of classifiers over multiple data sets. Journal of Machine Learning Research, 7, 1–30.
Gaspar, D., Silva, P., & Silva, C. (2024). Explainable AI for intrusion detection systems: LIME and SHAP applicability on multi-layer perceptron. IEEE Access, 12, 30164–30175. https://doi.org/10.1109/ACCESS.2024.3368987
Geurts, P., Ernst, D., & Wehenkel, L. (2006). Extremely randomized trees. Machine Learning, 63(1), 3–42. https://doi.org/10.1007/s10994-006-6226-1
Herranz-Oliveros, D., Tejedor-Romero, M., Gimenez-Guzman, J. M., & Cruz-Piris, L. (2024). Unsupervised learning for lateral-movement-based threat mitigation in Active Directory attack graphs. Electronics, 13(19), 3944. https://doi.org/10.3390/electronics13193944
Jin, D., Lu, Y., Qin, J., Cheng, Z., & Mao, Z. (2020). SwiftIDS: Real-time intrusion detection system based on LightGBM and parallel intrusion detection mechanism. Computers & Security, 97, 101984. https://doi.org/10.1016/j.cose.2020.101984
Kalakoti, R., Nõmm, S., & Bahsi, H. (2025). Federated learning of explainable AI (FedXAI) for deep learning-based intrusion detection in IoT networks. Computer Networks, 270, 111479. https://doi.org/10.1016/j.comnet.2025.111479
Le, V.-H., & Zhang, H. (2022). Log-based anomaly detection with deep learning: How far are we? Proceedings of the 44th International Conference on Software Engineering, 1356–1367. https://doi.org/10.1145/3510003.3510155
Lundberg, S. M., Erion, G., Chen, H., DeGrave, A., Prutkin, J. M., Nair, B., … Lee, S.-I. (2020). From local explanations to global understanding with explainable AI for trees. Nature Machine Intelligence, 2(1), 56–67. https://doi.org/10.1038/s42256-019-0138-9
Lundberg, S. M., & Lee, S.-I. (2017). A unified approach to interpreting model predictions. Advances in Neural Information Processing Systems, 30, 4765–4774.
Mahmoud, M. M., Youssef, Y. O., & Abdel-Hamid, A. A. (2025). XI2S-IDS: An explainable intelligent 2-stage intrusion detection system. Future Internet, 17(1), 25. https://doi.org/10.3390/fi17010025
Mallampati, S. B., & Seetha, H. (2024). Enhancing intrusion detection with explainable AI: A transparent approach to network security. Cybernetics and Information Technologies, 24(1), 98–117. https://doi.org/10.2478/cait-2024-0006
Milajerdi, S. M., Gjomemo, R., Eshete, B., Sekar, R., & Venkatakrishnan, V. N. (2019). HOLMES: Real-time APT detection through correlation of suspicious information flows. Proceedings of the IEEE Symposium on Security and Privacy, 1137–1152. https://doi.org/10.1109/SP.2019.00026
Pedregosa, F., Varoquaux, G., Gramfort, A., Michel, V., Thirion, B., Grisel, O., … Duchesnay, E. (2011). Scikit-learn: Machine learning in Python. Journal of Machine Learning Research, 12, 2825–2830.
Prokhorenkova, L., Gusev, G., Vorobev, A., Dorogush, A. V, & Gulin, A. (2018). CatBoost: Unbiased boosting with categorical features. Advances in Neural Information Processing Systems, 31, 6638–6648.
Ribeiro, M. T., Singh, S., & Guestrin, C. (2016). Why should I trust you? Explaining the predictions of any classifier. Proceedings of the 22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, 1135–1144. https://doi.org/10.1145/2939672.2939778
Ring, M., Schlör, D., Wunderlich, S., Landes, D., & Hotho, A. (2021). Malware detection on Windows audit logs using LSTMs. Computers & Security, 109, 102389. https://doi.org/10.1016/j.cose.2021.102389
Smiliotopoulos, C., & Kambourakis, G. (2026). Machine learning for lateral movement detection using Sysmon logs: An empirical comparison of imbalanced and resampled data. International Journal of Information Security, 25(1), 38. https://doi.org/10.1007/s10207-025-01182-1
Smiliotopoulos, C., Kambourakis, G., & Barbatsalou, K. (2023). On the detection of lateral movement through supervised machine learning and an open-source tool to create turnkey datasets from Sysmon logs. International Journal of Information Security, 22(6), 1893–1919. https://doi.org/10.1007/s10207-023-00725-8
Smiliotopoulos, C., Kambourakis, G., & Kolias, C. (2024). Detecting lateral movement: A systematic survey. Heliyon, 10(4), e26317. https://doi.org/10.1016/j.heliyon.2024.e26317
Wali, S., Farrukh, Y. A., & Khan, I. (2025). Explainable AI and Random Forest based reliable intrusion detection system. Computers & Security, 157, 104542. https://doi.org/10.1016/j.cose.2025.104542
Downloads
|
How to Cite
Issue
Section
License
Copyright (c) 2026 Antonius Djajakusuma, Theresia Herlina
This work is licensed under a Creative Commons Attribution-NonCommercial 4.0 International License.
Muhammad Khoiruddin harahap
Google Scholar 
Moraref
PKP Index
Garuda Kemdikbud
Indonesia OneSearch
OCLC Worldcat
Dimensions
Index Copernicus
Scilit
