🤖 machine learning

Tracing the Chain: Deep Learning for Stepping-Stone Intrusion Detection

This paper introduces ESPRESSO, a deep learning model that significantly outperforms existing state-of-the-art methods in detecting stepping-stone intrusions across multiple tunneling protocols by achieving a true positive rate exceeding 0.99 at a false positive rate of $10^{-3}$ , while also demonstrating capabilities in chain length prediction and identifying timing-based perturbations as the primary vulnerability for such detectors.

Original authors: Nate Mathews, Nicholas Hopper, Matthew Wright

Published 2026-04-13

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Nate Mathews, Nicholas Hopper, Matthew Wright

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine a thief trying to break into a bank. Instead of walking through the front door, they don a disguise, hop onto a friend's bike, ride to a park, switch to a skateboard, go to a coffee shop, and finally enter the bank through a back window. By the time the security cameras see the person entering the bank, they have no idea who started the journey or where they really came from.

In the digital world, this is called a Stepping-Stone Intrusion. Hackers hide their tracks by bouncing their connection through a chain of compromised computers (the "stepping stones") before reaching their target.

This paper introduces a new, super-smart detective system called ESPRESSO designed to catch these digital thieves, even when they are trying to hide. Here is how it works, broken down simply:

1. The Problem: The "Needle in a Haystack"

The biggest challenge isn't just finding the thief; it's not crying wolf.

The Haystack: A typical network sees millions of connections every hour (people checking email, streaming videos, etc.).
The Needle: Only a tiny handful of those connections are actually part of a hacker's chain.
The Trap: If your security system is even slightly inaccurate (say, 1% wrong), it will scream "ALERT!" 10,000 times an hour for normal traffic. Security guards would be so overwhelmed by false alarms that they'd ignore the real ones. The system needs to be 99.999% accurate.

2. The Old Way vs. The New Way

Old Detectives (Statistical Methods): These used to look for simple patterns, like "Did the packet size match?" or "Did the timing look similar?" But hackers learned to scramble these patterns easily.
The New Detective (ESPRESSO): This system uses Deep Learning (a type of AI that learns by example). Instead of just looking at one thing, it acts like a super-observant human who watches the entire conversation.

3. How ESPRESSO Works: The "Time-Stamped Dance"

Imagine two people dancing. One is at the start of the chain (the hacker), and one is at the end (the victim). Even if they are in different rooms, if they are dancing to the same music, their moves will be synchronized.

The "Time-Interval" Trick: Hackers often try to mess up the timing by adding fake delays. ESPRESSO doesn't just look at individual packets; it looks at chunks of time (like 30-millisecond slices). It asks: "In this specific slice of time, did the 'up' traffic and 'down' traffic move in a similar rhythm?"
The Transformer Brain: ESPRESSO uses a special AI architecture (called a Transformer) that is great at understanding context. It doesn't just look at the first step of the dance; it looks at the whole routine to see if the flow makes sense.
Triplet Learning: Think of this as a "spot the difference" game. The AI is shown three things:
1. Anchor: The hacker's traffic.
2. Positive: The victim's traffic (which is connected).
3. Negative: Random traffic from a totally different person.
  The AI learns to push the "Positive" closer to the "Anchor" and push the "Negative" far away. Over time, it becomes incredibly good at spotting the real connection.

4. The Results: A New Champion

The researchers built a "simulator" (a digital playground) to create fake hacker chains using different methods (SSH, DNS, ICMP, etc.) to train and test ESPRESSO.

The Score: In the hardest test (where the hacker is hiding behind a network boundary), ESPRESSO caught 99% of the real attacks while making almost zero false alarms.
The Competition: It crushed the previous best system (called DeepCoFFEA), which was like comparing a modern smartphone to a rotary phone.

5. The "Chain Length" Bonus

Sometimes, a connection chain is normal (like an IT admin logging into a server through a jump host). But a chain with 5 or 6 hops is almost certainly a hacker trying to hide.

ESPRESSO can also guess the length of the chain. If it sees a 6-hop chain, it raises the alarm much louder than a 1-hop chain. This helps security teams decide which alerts are emergencies and which are just routine maintenance.

6. The Weakness: The "Jitter" Problem

The researchers tested ESPRESSO against hackers trying to trick it.

Padding (Adding Fake Data): If the hacker adds fake "chaff" packets to make the traffic look bigger, ESPRESSO barely flinches. It's very tough against this.
Timing Jitter (Random Delays): If the hacker adds random, tiny delays to the packets (like a stutter in the music), ESPRESSO gets confused.
- Why? Because ESPRESSO relies heavily on the rhythm of the traffic. If the rhythm is broken, the dance doesn't match.
- Real-world example: This is why the system struggled with DNS tunnels. DNS traffic is naturally "chatty" and periodic (like a clock ticking), which breaks the natural rhythm ESPRESSO expects.

The Big Takeaway

This paper gives us a powerful new tool to catch digital thieves who are trying to hide in plain sight. It proves that AI can spot these hidden chains with incredible accuracy, provided the traffic follows a natural rhythm.

However, it also warns us: Timing is everything. If hackers learn to perfectly scramble the timing of their traffic (like a DNS tunnel), they can still slip past. The next step for security experts is to combine this "rhythm detector" with other methods to catch the cleverest of the bunch.

In short: We finally have a detective that can spot a thief in a crowd of a million people without screaming at the innocent bystanders, but we still need to teach it how to ignore a thief who is intentionally stuttering while they walk.

1. Problem Statement

Stepping-Stone Intrusions (SSIs), also known as pivoting, are a prevalent evasion technique where attackers route sessions through a chain of compromised intermediate hosts to obscure their origin. The core defensive challenge is flow correlation: determining whether an incoming flow and an outgoing flow at a relay host belong to the same end-to-end connection.

The Challenge: Modern attackers use encryption, rendering content-based inspection ineffective. Passive detection relies on statistical similarities in timing, size, and rate. However, a critical operational constraint is the extremely low False Positive Rate (FPR) required. In a large network, a 1% FPR would generate thousands of false alarms for every true intrusion, making the system unusable.
The Gap: Existing deep learning methods (like DeepCoFFEA) show promise but have not been rigorously evaluated on stepping-stone detection, particularly regarding the lack of large-scale, labeled datasets and the need for performance at ultra-low FPRs ( $10^{-3}$ to $10^{-5}$ ).

2. Methodology

The authors propose ESPRESSO, a deep learning flow correlation model adapted from Tor traffic correlation research, specifically tailored for the SSI domain.

A. Data Generation (Synthetic Dataset)

Due to the lack of public datasets, the authors developed a synthetic data collection tool using Docker containers to simulate multi-hop attack chains.

Protocols: SSH, SOCAT (TCP), ICMP, DNS, and Mixed multi-protocol chains.
Traffic Modeling: Derived from real-world SSH captures (DEFCON 25 CTF), the tool simulates "bursty" traffic patterns (ON/OFF periods) with realistic inter-burst intervals and byte counts.
Scale: Generated five distinct datasets, each containing 10,000+ chains, covering both host-mode (single relay) and network-mode (boundary) detection scenarios.

B. Model Architecture: ESPRESSO

ESPRESSO extends the DeepCoFFEA (DCF) baseline with three key architectural pillars:

Multi-Channel Time-Interval Features: Instead of raw packet sequences, the model aggregates traffic into fixed-width time bins ( $\Delta t = 30$ ms). It uses 9 channels capturing direction, size, and cumulative trends. This solves the packet misalignment issue caused by re-segmentation in intermediate hosts.
Transformer-Based Feature Extraction (FEN):
- Utilizes a Convolutional Vision Transformer (CvT) backbone.
- Processes the entire traffic sequence before windowing, capturing global temporal context (unlike DCF, which windows first).
- Uses strided convolutions for Key/Value projections to reduce computational complexity.
Triplet Metric Learning with Online Mining:
- Loss Function: Uses Triplet Loss to embed correlated flows closer together and uncorrelated flows further apart in a vector space.
- Online Mining: Dynamically selects "hard" and "semi-hard" triplets within each training batch (Batch-Hard strategy) rather than pre-computing offline, improving training efficiency and convergence.
- Decision Head: Replaces DCF's threshold-based voting with a learned Multi-Layer Perceptron (MLP) that takes window-level similarity scores to predict correlation, removing the need for manual threshold tuning.

C. Adaptation for SSID

Unlike Tor (where ingress/egress traffic differs structurally), SSI traffic is symmetric (raw network traffic at both ends). Therefore, ESPRESSO uses a single, shared FEN for both flows, rather than separate networks.

3. Key Contributions

Synthetic Dataset: Creation of the first large-scale, labeled stepping-stone dataset covering five protocols (SSH, SOCAT, ICMP, DNS, Mixed) with realistic traffic distributions.
Superior Baseline Performance: Demonstrated that ESPRESSO significantly outperforms the state-of-the-art DeepCoFFEA (DCF) across all protocols and detection modes.
Loss Function Enhancements: Investigated auxiliary objectives:
- Temporal Alignment: A hybrid loss combining feature and window-based similarity. Showed measurable gains, especially for mixed-protocol traffic.
- Feature Decorrelation: (Orthogonality and Covariance losses) showed inconsistent benefits and did not significantly improve performance.
Chain Length Prediction: Explored predicting the number of hops in a chain to distinguish malicious pivoting (long chains) from benign admin traffic (short chains).
- A standalone CNN using packet-level features outperformed a multi-task learning approach.
Robustness Analysis: Systematically evaluated the model against packet padding and timing perturbations (jitter).

4. Experimental Results

Performance Metrics

Network-Mode Detection (Hardest Scenario):
- SSH/SOCAT/ICMP: ESPRESSO achieved a True Positive Rate (TPR) > 0.99 at an FPR of $10^{-3}$ .
- Mixed Protocols: Achieved a TPR of 0.748 at $10^{-3}$ FPR (vs. DCF's 0.334).
- DNS: Performance was low (TPR ~0.13 at $10^{-3}$ ) due to the polling-based nature of DNS tunneling (dnscat2), which disrupts timing patterns.
Comparison: ESPRESSO consistently outperformed DCF and a "Modified DCF" (adapted to use time-interval features), proving that the combination of full-sequence context and time-aligned features is the primary driver of success.

Robustness Findings

Padding: ESPRESSO is highly resilient to packet padding (even 200% overhead), maintaining decent performance.
Timing Perturbations: The model is highly vulnerable to timing jitter. Even "light" delays (25% probability) caused significant performance drops. "Heavy" delays (75% probability) effectively nullified the detector (TPR $\approx$ 0.004). This confirms that timing features are the model's primary strength and primary vulnerability.

Chain Length Prediction

The standalone CNN model achieved high accuracy (e.g., 95% on SSH) in predicting chain length, offering a practical tool for risk assessment.
Full-path correlation (reconstructing the whole chain) was highly effective for stable protocols (SOCAT, ICMP) but failed for DNS and Mixed protocols where a single missed link breaks the chain.

5. Significance and Implications

Operational Viability: The results suggest that for networks using standard bursty protocols (SSH, TCP), deep learning flow correlation is operationally viable, as the FPR can be driven low enough ( $10^{-5}$ ) to avoid alert fatigue while catching the majority of intrusions.
Vulnerability Identification: The study highlights that timing-based obfuscation is the most effective countermeasure against current correlation detectors. This explains why DNS tunneling is difficult to detect and suggests that future defenses must either model timing noise or integrate anomaly detection for highly regularized traffic.
Future Directions:
- The need for real-world datasets containing benign background traffic to validate FPRs in a "open world" setting.
- Developing architectures robust to adaptive adversaries who can mimic the "polling" behavior of DNS to evade detection.
- Moving beyond per-connection correlation to holistic frameworks that combine correlation scores with other signals (TTPs).

In conclusion, this paper establishes a new benchmark for stepping-stone detection, demonstrating that transformer-based deep learning with time-aligned features can achieve the stringent low-FPR requirements necessary for real-world deployment, provided that timing-based obfuscation is addressed.