Tracing the Chain: Deep Learning for Stepping-Stone Intrusion Detection

TL;DR

This paper introduces ESPRESSO, a deep learning model utilizing transformers and triplet learning for highly accurate stepping-stone intrusion detection across multiple protocols, outperforming existing methods.

Contribution

The paper presents a novel deep learning approach with a synthetic data tool for effective stepping-stone intrusion detection and robustness analysis.

Findings

ESPRESSO achieves over 0.99 TPR at 10^-3 FPR across protocols.

It outperforms the DeepCoFFEA baseline in all tested scenarios.

Timing perturbations are identified as the main vulnerability.

Abstract

Stepping-stone intrusions (SSIs) are a prevalent network evasion technique in which attackers route sessions through chains of compromised intermediate hosts to obscure their origin. Effective SSI detection requires correlating the incoming and outgoing flows at each relay host at extremely low false positive rates -- a stringent requirement that renders classical statistical methods inadequate in operational settings. We apply ESPRESSO, a deep learning flow correlation model combining a transformer-based feature extraction network, time-aligned multi-channel interval features, and online triplet metric learning, to the problem of stepping-stone intrusion detection. To support training and evaluation, we develop a synthetic data collection tool that generates realistic stepping-stone traffic across five tunneling protocols: SSH, SOCAT, ICMP, DNS, and mixed multi-protocol chains. Across all five protocols and in both host-mode and network-mode detection scenarios, ESPRESSO substantially outperforms the state-of-the-art DeepCoFFEA baseline, achieving a true positive rate exceeding 0.99 at a false positive rate of $10^{-3}$ for standard bursty protocols in network-mode. We further demonstrate chain length prediction as a tool for distinguishing malicious from benign pivoting, and conduct a systematic robustness analysis revealing that timing-based perturbations are the primary vulnerability of correlation-based stepping-stone detectors.