M.S. Candidate: Yasin Aksüt
Program: Cybersecurity
Date: 22.11.2024 / 14:00
Place: A-108

Abstract: Active Directory (AD) is one of the most widely used directory services today, playing a key role in organizing and managing network resources within an organization. In cybersecurity, AD serves as a significant component for defense in depth, offering layered security by controlling access to network assets, enforcing authentication policies, and monitoring for suspicious activity. Therefore, it is essential to have a robust security strategy in place to prevent and detect AD attacks in depth. Detection of AD attacks is difficult because attackers often use techniques that blend in with normal network traffic and activities. Among the AD attacks, Kerberoasting attack which leverages inherent weaknesses in the Kerberos authentication protocol used by AD can be most stealthy and may not exhibit obvious signs of compromise. It makes it difficult for security teams to detect them using traditional security tools. In this work, we are  going to try to provide a solution for  detection of Kerberoasting attacks by using supervised machine learning algorithms. Moreover, there is no publicly available dataset that can be used to measure the efficiency of any machine learning algorithm for Kerberoasting attacks for the sake of protecting the security of sensitive data. For this reason, we created a dataset by conducting the study in a virtual environment and we made security logs publicly available.