Artificial intelligence-based lateral movement identification tool

A local host computing device, comprising:

• a processor;
• and
• memory storing instructions that, when executed by the processor, cause the local host computing device to:
• monitor, in real time by a lateral movement identification tool, network communications associated with the local host computing device;
• identify, by the lateral movement identification tool, a communication between the local host computing device and a second host computing device, wherein the communication corresponds to a user associated with a user group;
• determine, by an artificial intelligence engine and based on an indication of the user group, a risk score corresponding to a probability that the communication corresponds to an unauthorized lateral movement event on the network;
• and
• trigger, based on the risk score, an alert identifying the probability that the communication between the local host computing device and the second host computing device corresponds to the unauthorized lateral movement event on the network.

One or more non-transitory computer-readable media storing instructions that, when executed by a host computing device comprising a processor, memory, and a communication interface, cause the host computing device to:

• monitor, in real time by a lateral movement identification tool, network communications associated with the host computing device;
• identify, by the lateral movement identification tool, a communication between the host computing device and a second host computing device, wherein the communication corresponds to a user associated with a user group;
• determine, by an artificial intelligence engine and based on an indication of the user group, a risk score associated with a probability that the communication corresponds to an unauthorized lateral movement event on the network;
• and
• trigger, based on the risk score, an alert identifying the probability that the communication between the host computing device and the second host computing device corresponds to the unauthorized lateral movement event on the network.