An analysis of Kerberoasting attack and detection with supervised machine learning algorithms

---

Tezin Türü: Yüksek Lisans

Tezin Yürütüldüğü Kurum: Orta Doğu Teknik Üniversitesi, Enformatik Enstitüsü, Siber Güvenlik Anabilim Dalı, Türkiye

Tezin Onay Tarihi: 2024

Tezin Dili: İngilizce

Öğrenci: YASİN AKSÜT

Danışman: Cihangir Tezcan

Açık Arşiv Koleksiyonu: AVESİS Açık Erişim Koleksiyonu

Özet:

Active Directory (AD) is one of the most widely used directory services today, playing a key role in organizing and managing network resources within an organization. In cybersecurity, AD serves as a significant component for defense in depth, offering layered security by controlling access to network assets, enforcing authentication policies, and monitoring for suspicious activity. Therefore, it is essential to have a robust security strategy in place to prevent and detect AD attacks in depth. Detection of AD attacks is difficult because attackers often use techniques that blend in with normal network traffic and activities. Among the AD attacks, Kerberoasting attack which leverages inherent weaknesses in the Kerberos authentication protocol used by AD can be most stealthy and may not exhibit obvious signs of compromise. It makes it difficult for security teams to detect them using traditional security tools. In this work, we are going to try to provide a solution for detection of Kerberoasting attacks by using supervised machine learning algorithms. Moreover, there is no publicly available dataset that can be used to measure the efficiency of any machine learning algorithm for Kerberoasting attacks for the sake of protecting the security of sensitive data. For this reason, we created a dataset by conducting the study in a virtual environment and we made security logs publicly available.