In the digital world, security often relies on a simple idea: build a strong wall around the inside of a network and let nothing suspicious get through. This is how firewalls and intrusion detection systems work; they stand guard at the perimeter, watching for attackers trying to break in from the outside. However, this strategy has a blind spot. Once an attacker manages to trick their way past the outer wall and compromise a single computer inside, they do not need to break the wall again to reach their ultimate target. Instead, they can use that first compromised machine as a stepping stone, or a pivot, to jump to other, more protected computers deep within the network. Because the traffic moving between these internal computers looks perfectly normal and trusted, it slips right past the perimeter guards. This technique, known as pivoting, allows attackers to move silently through a network, stealing data or spreading malware without ever triggering the alarms designed to stop them.

The problem is that detecting this movement is incredibly difficult. The data flowing between internal computers often looks just like the legitimate work of the people using them. Existing solutions to catch these attackers have struggled with a difficult trade-off: they are either too slow to be useful in real time, they require every single computer in a network to cooperate (which is often impossible in modern, flexible environments), or they generate so many false alarms that security teams become overwhelmed and miss the real threats. To solve this, researchers at Dalhousie University and the University of Virginia developed a new system called Stitch. Rather than trying to watch the entire network from a central point, Stitch lives directly on the individual computers themselves. It acts as a local observer that watches how a computer's internal processes handle network traffic, looking for the specific signature of an attacker using one machine to talk to another.

The core insight behind Stitch is that to catch a pivot, you must connect the dots between what comes into a computer and what goes out of it, and you must know which software program is responsible for that movement. Previous methods often looked only at the timing and size of data packets, guessing that if two streams of data arrived and left at similar times with similar sizes, they were connected. This approach is flawed because it frequently mistakes harmless, routine traffic for attacks, leading to a flood of false alarms. Stitch avoids this guesswork by using a special technology built into the Linux operating system called eBPF. This technology allows the system to safely insert small, custom programs into the kernel—the core of the operating system—without needing to slow down the computer or require permission from every other device on the network.

Stitch works by tracing the life of a process, which is simply a running program, from the moment it receives a piece of data to the moment it sends a new piece of data out. When a packet of data arrives at a computer, Stitch labels it and follows it as it is handed over to a specific program. If that program then opens a new connection to send data elsewhere, Stitch checks if the new outgoing connection is linked to the original incoming one. It does this by watching the system calls—the requests a program makes to the operating system—to see if the same process that received the data is the one sending the new data. If the system detects that a process is relaying traffic from one place to another, it then checks the characteristics of that traffic. It looks at how much time passed between the incoming and outgoing data and how similar their sizes are.

To ensure it does not cry wolf, Stitch also keeps a record of where a computer usually sends its data. If a computer frequently talks to a specific server for legitimate reasons, like checking a database or managing a user account, Stitch learns to recognize this as normal behavior and ignores it. It only raises an alarm if the traffic pattern looks like a pivot and is heading to a destination that is rarely visited. This combination of tracking the software process, analyzing the data flow, and learning the computer's normal habits allows Stitch to be highly accurate. In tests using simulated attacks, Stitch improved detection accuracy by about 31 percent compared to the best existing methods that rely only on traffic timing and size. More importantly, it reduced the rate of false alarms to less than one-fifth of one percent, a massive improvement over previous systems that often flagged harmless traffic as dangerous.

The researchers did not stop at simulations. They installed Stitch on real servers within a large university network, which serves thousands of students, faculty, and staff. They ran the system for over 80 days on a shared faculty server and a public-facing web server. During this time, the system monitored millions of network events without slowing down the servers or requiring any changes to the network's existing security setup. On the faculty server, the system successfully identified all the test attacks the researchers launched, which involved using secure shell tunnels to move data. It generated only a tiny number of false alarms, most of which were caused by legitimate administrative tasks like port forwarding for database access. On the public web server, the system ran for 32 days without generating a single alert, confirming that it could distinguish between normal web traffic and potential pivoting attempts.

The results show that Stitch offers a practical way to defend against these stealthy attacks without needing a complete overhaul of a network's infrastructure. It works independently on each computer, meaning it does not matter if other devices in the network are running different software or if the network topology changes frequently. The system is lightweight, using less than 350 megabytes of memory and adding almost no extra load to the computer's processor. Even under heavy traffic loads, it maintained its ability to spot attacks. The researchers found that the system could handle thousands of new network connections per second while still accurately tracing the paths of data. This efficiency is crucial because modern networks are dynamic and busy; a security tool that is too heavy or slow would be impractical for real-world use.

By focusing on the relationship between the software processes and the network traffic, Stitch solves the problem of distinguishing between a legitimate user doing their job and an attacker using that user's computer as a bridge. It does not rely on the cooperation of every device in the network, nor does it require storing massive amounts of historical data to find patterns. Instead, it observes the immediate context of the traffic as it happens. The researchers demonstrated that this approach is effective against common tools used by attackers, such as SSH, Nmap, and Chisel, which are frequently used to create these pivoting tunnels. The system successfully identified these attacks even when they were disguised within normal network activity.

The work also highlights the importance of looking at the whole picture when securing a network. Relying solely on the perimeter is no longer enough, and relying solely on traffic statistics is too prone to error. By combining the observation of system processes with network flow analysis, Stitch provides a more complete view of what is happening inside a computer. The researchers plan to release the source code for the system to the public, allowing others to test and build upon their work. This transparency is intended to help the broader security community improve defenses against advanced persistent threats, which are sophisticated, long-term attacks often launched by organized groups. The success of Stitch suggests that a shift toward host-based, real-time detection that understands the context of the traffic is a viable and necessary path forward for network security.

In the end, the paper presents a system that is both accurate and efficient, filling a gap in current security tools. It proves that it is possible to detect pivoting attacks in real time without generating a flood of false alarms or requiring the entire network to change its behavior. The system's ability to operate independently on individual hosts makes it adaptable to various environments, from small office networks to large, complex university infrastructures. The findings suggest that by integrating system-level tracing with network analysis, security teams can gain a much clearer view of the threats lurking within their networks, allowing them to respond to attacks before they can cause significant damage. The work stands as a demonstration that effective security does not always require more complex or expensive hardware, but rather a smarter way of looking at the data that is already there.