Tracing the Chain: Deep Learning for Stepping-Stone Intrusion Detection

Nate Mathews; Nicholas Hopper; Matthew Wright

cs.CRApr 9, 2026

Tracing the Chain: Deep Learning for Stepping-Stone Intrusion Detection

Authors: Nate Mathews, Nicholas Hopper, Matthew Wright

Organizations: Department of Cybersecurity, Rochester Institute of Technology, Rochester, NY, USA · Department of Computer Science & Engineering, University of Minnesota, Minneapolis, MN, USA

Abstract

Stepping-stone intrusions (SSIs) are a prevalent network evasion technique in which attackers route sessions through chains of compromised intermediate hosts to obscure their origin. Effective SSI detection requires correlating the incoming and outgoing flows at each relay host at extremely low false positive rates -- a stringent requirement that renders classical statistical methods inadequate in operational settings. We apply ESPRESSO, a deep learning flow correlation model combining a transformer-based feature extraction network, time-aligned multi-channel interval features, and online triplet metric learning, to the problem of stepping-stone intrusion detection. To support training and evaluation, we develop a synthetic data collection tool that generates realistic stepping-stone traffic across five tunneling protocols: SSH, SOCAT, ICMP, DNS, and mixed multi-protocol chains. Across all five protocols and in both host-mode and network-mode detection scenarios, ESPRESSO substantially outperforms the state-of-the-art DeepCoFFEA baseline, achieving a true positive rate exceeding 0.99 at a false positive rate of $10^{-3}$ for standard bursty protocols in network-mode. We further demonstrate chain length prediction as a tool for distinguishing malicious from benign pivoting, and conduct a systematic robustness analysis revealing that timing-based perturbations are the primary vulnerability of correlation-based stepping-stone detectors.

Figures & tables

Fig. 1 : The standard stepping-stone intrusion detection model with a 3-hop chain containing two stepping stones (H2 and H3).

Fig. 2 : Convolutional projection during transformer self-attention. Strided convolutional projection of the value and key vectors reduces the sequence length and thus significantly reduces the impact of the quadratic computational complexity of attention.

Fig. 3 : Illustration of triplet metric learning. The anchor and positive flows are pushed closer together, while the negative flow is pushed away in the learned embedding space.

Fig. 4 : Architecture comparison between DCF and ESPRESSO . ESPRESSO generates a global feature sequence first and then applies windowing, whereas DCF performs windowing before feature extraction.

Hyperparameter	Value	Description
Input Size	1200	Length of the input sequence.
Feature Dim.	64	Output feature size.
Hidden Dim.	96	Token feature size in the Transformer.
Depth	9	Number of Transformer blocks.
Embedding Conv.	kernel: 3 stride: 3	Initial feature extraction layer.
Windowing Conv.	kernel: 50 stride: 3	Final windowing layer.

TABLE I : Hyperparameters of the ESPRESSO feature extraction network.

Fig. 5 : Diagram of synthetic stepping stone data collection scheme. A multi-hop tunnel is established between the attacker and the target through intermediate hosts (stepping stones) over a WAN link.

Fig. 6 : Illustration of the network traffic correlation scenarios considered in our evaluations.

Panel of Figure 8 — Fig. 7 : ROC curves presenting correlation efficacy of (a) ESPRESSO and (b) DCF on datasets in the host-mode detection scenario.

Panel of Figure 9 — Fig. 8 : ROC curves presenting correlation efficacy of (a) ESPRESSO and (b) DCF on datasets in the network-mode detection scenario.

Dataset	Model	FPR $\leq 10^{-3}$		FPR $\leq 10^{-4}$		FPR $\leq 10^{-5}$
Dataset	Model	TPR	pAUC	TPR	pAUC	TPR	pAUC
SSH-only	DCF	0.536	0.339	0.110	0.057	0.032	0.015
SSH-only	ESPRESSO	0.996	0.990	0.986	0.986	0.918	0.790
SOCAT-only	DCF	0.986	0.952	0.890	0.803	0.722	0.685
SOCAT-only	ESPRESSO	1.000	0.995	1.000	0.959	1.000	0.599
ICMP-only	DCF	0.984	0.938	0.862	0.776	0.614	0.446

TABLE II : Host-mode: Maximum TPR and pAUC for FPR thresholds of

10^{-3}

10^{-4}

, and

10^{-5}

across five stepping stone datasets.

Dataset	Model	FPR $\leq 10^{-3}$		FPR $\leq 10^{-4}$		FPR $\leq 10^{-5}$
Dataset	Model	TPR	pAUC	TPR	pAUC	TPR	pAUC
SSH-only	DCF	0.320	0.210	0.102	0.056	0.02	0.012
	ESPRESSO	0.992	0.975	0.962	0.8905	0.710	0.535
	Modified DCF	0.922	0.855	0.848	0.699	0.484	0.392
SOCAT-only	DCF	0.956	0.823	0.628	0.507	0.346	0.285
	ESPRESSO	1.00	0.989	1.00	0.989	1.00	0.989

TABLE III : Network-mode: Maximum TPR and pAUC for FPR thresholds of

10^{-3}

10^{-4}

, and

10^{-5}

across five stepping stone datasets.

Fig. 9 : Diagram that visually represents the feature vectors used for temporal feature similarity.

SSH Traffic
Model		AUC	FPR $\leq 10^{-3}$		FPR $\leq 10^{-4}$		FPR $\leq 10^{-5}$
			pAUC	max TPR	pAUC	max TPR	pAUC	max TPR
	ESPRESSO	0.998	0.975	0.992	0.891	0.962	0.535	0.710
	+ Temporal Loss	0.998	0.984	0.992	0.955	0.972	0.861	0.946
SOCAT Traffic
	ESPRESSO	1.000	0.989	1.000	0.989	1.000	0.989	1.000

TABLE IV : Benchmark performance of baseline models across various traffic protocols. We compare our standard ESPRESSO model and its variant with a temporal alignment loss. Performance is evaluated using overall AUC, as well as partial AUC (pAUC) and max true positive rate (TPR) at low false positive rate (FPR) thresholds.

Panel of Figure 14 — Fig. 10 : ROC curves demonstrating correlation performance on (a) SSH-only, (b) DNS-only, and (c) Mixed protocol datasets.

Protocol	Model Configuration	Loss Weight ( $\lambda$ )	AUC-ROC	pAUC-ROC	Max TPR
SSH	Standard ESPRESSO	-	0.998	0.535	0.710
	+ Temporal Loss	-	0.998	0.861	0.946
	+ $L_{\text{orth}}$	0.1	0.994	0.043	0.074
		0.01	0.996	0.677	0.680
		0.001	0.998	0.656	0.856
		0.0001	0.997	0.727	0.870

TABLE V : Performance of ESPRESSO with feature decorrelation loss augmentations across various traffic protocols. The detailed breakdown of loss augmentation experiments was performed on the SSH dataset. The SSH-only model is compared on key detection metrics at an FPR threshold of

10^{-5}

, while the DNS-only and Mixed-protocols models are compared at an FPR threshold of

10^{-3}

Fig. 11 : Comparison of window feature similarity of ESPRESSO trained with different loss strategies on one randomly chosen traffic sample.

Fig. 12 : ROC comparison of ESPRESSO trained using single-model and multi-model settings against the Mixed-protocol data in network-mode .

Fig. 13 : ROC results for additional benchmarks on the Multi-protocol dataset without chains that include DNS-tunneled traffic.

Dataset	Up Acc.	Down Acc.	Avg. Acc.
SSH	0.950	0.890	0.920
SOCAT	0.800	0.710	0.755
ICMP	0.925	0.963	0.944
DNS	0.798	0.797	0.798
Mixed	0.814	0.770	0.792

TABLE VI : Performance of the standalone chain-only prediction model across various datasets.

		Chain-Length Prediction			Correlation Performance
						FPR $\leq 10^{-5}$		FPR $\leq 10^{-4}$
Protocol	$\lambda$	Up Acc.	Down Acc.	Avg. Acc.	AUC	pAUC	max TPR	pAUC	max TPR
SSH	0.1	0.808	0.790	0.799	0.998	0.702	0.898	0.929	0.972
	0.5	0.814	0.838	0.826	0.998	0.702	0.914	0.928	0.970
	1.0	0.812	0.832	0.822	0.998	0.554	0.914	0.930	0.976
SOCAT	0.1	0.810	0.806	0.808	0.999	0.888	1.000	0.888	1.000

TABLE VII : Performance of the jointly learned model for direct stepping-stone chain-length prediction and flow correlation. The weight

\lambda

balances the contribution of the chain-length prediction loss against the primary correlation loss.

Dataset	FPR $\leq 10^{-3}$		FPR $\leq 10^{-4}$		FPR $\leq 10^{-5}$
Dataset	Avg. TPR	Chain Acc.	Avg. TPR	Chain Acc.	Avg. TPR	Chain Acc.
SSH	0.993 $\pm$ 0.080	0.992	0.983 $\pm$ 0.123	0.980	0.947 $\pm$ 0.214	0.938
SOCAT	1.000 $\pm$ 0.000	1.000	1.000 $\pm$ 0.000	1.000	1.000 $\pm$ 0.000	1.000
ICMP	1.000 $\pm$ 0.000	1.000	0.996 $\pm$ 0.055	0.994	0.994 $\pm$ 0.070	0.992
DNS	0.000 $\pm$ 0.000	0.000	0.000 $\pm$ 0.000	0.000	0.000 $\pm$ 0.000	0.000
Mixed	0.842 $\pm$ 0.307	0.758	0.310 $\pm$ 0.414	0.220	0.000 $\pm$ 0.000	0.000

TABLE VIII : Performance of correlation-based (full-chain) prediction at various FPR thresholds. The table shows the average True Positive Rate (TPR) with standard deviation, and the full chain accuracy for each dataset.

Fig. 14 : Full chain correlation accuracy as a function of FPR with ESPRESSO .

Panel of Figure 23 — Fig. 15 : ROC curves for (a) ESPRESSO and (b) DCF on the SSH-only dataset under traffic padding obfuscation in the network-mode detection scenario.

Panel of Figure 24 — Fig. 16 : ROC curves for (a) ESPRESSO and (b) DCF on the SSH-only dataset under padding with light delays (v1) in the network-mode detection scenario.

Panel of Figure 25 — Fig. 17 : ROC curves for (a) ESPRESSO and (b) DCF on the SSH-only dataset under padding with light delays (v2) in the network-mode detection scenario.

Panel of Figure 26 — Fig. 18 : ROC curves for (a) ESPRESSO and (b) DCF on the SSH-only dataset under padding with heavy delays in the network-mode detection scenario.

Appendix figures & tables8 assets

Supplementary material from the paper’s appendix.

Appendix

Fig. 19 : ROC curves comparing ESPRESSO (online mining), ESPRESSO (offline mining), and DeepCoFFEA.

Fig. 20 : ROC curves comparing ESPRESSO , GreenTea, HotWater, and DeepCoFFEA models.

Fig. 21 : ROC curves comparing ESPRESSO trained with different loss margins in the online mining scenario.

Fig. 22 : ROC curves comparing DeepCoFFEA trained with various margins and mining strategies.

Fig. 23 : ROC curves comparing ESPRESSO and DeepCoFFEA when benchmarked on the TrafficSliver dataset.

Model	Training	Loss	FPR $\leq 10^{-5}$		FPR $\leq 10^{-6}$		FPR $\leq 10^{-7}$
Model	Mode	Margin	TPR	pAUC	TPR	pAUC	TPR	pAUC
DCF	Offline	0.1	0.768	0.584	0.304	0.197	0.076	0.034
DCF	Online	0.1	0.756	0.581	0.313	0.177	0.047	0.012
DCF	Offline	0.5	0.691	0.491	0.112	0.038	0.002	0.001
DCF	Online	0.5	0.594	0.357	0.039	0.011	0.000	0.000
ESPRESSO	Online	0.1	0.884	0.762	0.602	0.384	0.139	0.061

Appendix

TABLE IX : Maximum TPR and pAUC for FPR thresholds of

10^{-5}

10^{-6}

, and

10^{-7}

Panel of Figure 33 — Fig. 24 : ROC curves presenting correlation efficacy across five datasets in the network-mode detection scenario for DCF window scaling and framework modification experiments. ESPRESSO is included as a reference.

Panel of Figure 34 — Fig. 25 : ROC curves demonstrating correlation performance of Modified DCF with loss augmentation strategies on (a) SSH-only, (b) DNS-only, and (c) Mixed protocol datasets.

Network Intrusion Detection

Network intrusion detection identifies malicious or abnormal network activity to help protect computers, connected devices, and critical infrastructure.

See all 168 papers

GESR: Graph-Based Edge Semantic Reconstruction for Stealthy Communication Detection with Benign-Only Training
May 8, 2026Henghui Xu, Yuchen Zhang, Xiaobo MaNetwork Intrusion Detection Reconstruction-Based Anomaly Detection
MOE Key Laboratory for Intelligent Networks and Network Security, Xi’an Jiaotong University, Xi’an, China · Faculty of Electronic and Information Engineering, Xi’an Jiaotong University, Xi’an, China · Shaanxi Province Key Laboratory of Computer Network, Xi’an Jiaotong2026 University, Xi’an, China
Multi-Level Distributional Entropy for Explainable Network Intrusion Detection
Jun 29, 2026Mohamed Aly Bouke, Md Shohel Sayeed, Swee-Huay Heng +2Distribution Shift Network Intrusion Detection
Centre for Intelligent Cloud Computing, CoE for Advanced Cloud, Faculty of Information Science and Technology, Multimedia University, Jalan Ayer Keroh Lama, Bukit Beruang, 75450, Melaka, Malaysia · Department of Communication Technology and Networking, Faculty of Computer Science and Information Technology, Universiti Putra Malaysia, Serdang 43400, Malaysia · Laboratory of Computational Science and Mathematical Physics, Institute for Mathematical Research, Universiti Putra Malaysia, Serdang, Malaysia
Few-Shot Network Intrusion Detection Using Online Triplet Mining
May 17, 2026Jack Wilkie, Hanan Hindy, Christos Tachtatzis +2Network Intrusion Detection Few-Shot Learning
Department of Electronics and Electrical Engineering, University of Strathclyde, Glasgow G1 1XQ, UK · Faculty of Computer and Information Sciences, Ain Shams University, Cairo 11566, Egypt · Faculty of Electrical Engineering, Czech Technical University, 160 00 Prague, Czech Republic

May 8, 2026J/K move · Enter open · S save

GESR: Graph-Based Edge Semantic Reconstruction for Stealthy Communication Detection with Benign-Only Training

Henghui Xu, Yuchen Zhang, Xiaobo Ma

MOE Key Laboratory for Intelligent Networks and Network Security, Xi’an Jiaotong University, Xi’an, China · Faculty of Electronic and Information Engineering, Xi’an Jiaotong University, Xi’an, China · Shaanxi Province Key Laboratory of Computer Network, Xi’an Jiaotong2026 University, Xi’an, China

Network Intrusion Detection Reconstruction-Based Anomaly Detection Anomaly Detection

Open paper AskPDF arXiv

Detecting stealthy malicious communications from flow logs under benign-only training remains a critical challenge in network security. Malicious communications often camouflage as normal traffic like standard HTTPS flows. Conventional intrusion detectors rely strictly on known labeled attacks. Alternatively, they score flows completely independently. These approaches fail against sparse and context-dependent suspicious activity. To capture this essential context, graph anomaly detectors have been introduced to add valuable relational information to the analysis. However, existing methods fail to test the structural consistency of specific communication edges. To overcome these fundamental limitations, we present GESR, a novel graph-based framework for detecting suspicious communications and anomalous hosts under a benign-only training setting. GESR models complex network activity as attributed communication graphs. It cleverly reconstructs edge semantics entirely from local structural context rather than isolated features. This non-intuitive design forces the framework to predict expected communication patterns from neighborhood topologies. Attackers cannot easily manipulate this deep structural dependency. The model then converts the resulting structural inconsistencies into host-level anomaly scores. It utilizes robust Median Absolute Deviation (MAD) calibration for this final step. We evaluate GESR extensively on CTU-13 and CICIDS2017 datasets. These evaluations strictly impose tight false-positive operating constraints. On CICIDS2017, GESR achieves an outstanding ROC-AUC of 0.9753. It also yields a high TPR of 0.8569 at a strict 5% FPR threshold. GESR consistently outperforms existing methods across both evaluated benchmarks. The results prove that structure-conditioned edge reconstruction is a credible direction for practical intrusion detection.

Abstract

Network Intrusion Detection

Explore similar work

GESR: Graph-Based Edge Semantic Reconstruction for Stealthy Communication Detection with Benign-Only Training

Multi-Level Distributional Entropy for Explainable Network Intrusion Detection

Few-Shot Network Intrusion Detection Using Online Triplet Mining