Re-Evaluating Three Widely Cited Lateral Movement Detectors Under Fair Preprocessing Changes Their Reported Results Significantly

arXiv 2607.29390·medium signalXBlueskyLinkedInCopy link

Benchmark datasets made lateral movement detection research practical, but this survey shows preprocessing and event-labeling methodologies vary substantially from paper to paper on two popular datasets, quietly determining how fair and realistic the resulting evaluations are. The authors propose grounded preprocessing and labeling policies, then re-evaluate three widely cited detection methods under them — and their results differ significantly from the originally published numbers. It is a reproducibility warning with direct bearing on anyone selecting a detector from published benchmark scores.