arXiv:2604.08800v1 [cs.CR] 9 Apr 2026
Tracing the Chain: Deep Learning for Stepping-Stone Intrusion Detection Nate Mathews , Matthew Wright
Nicholas Hopper
Department of Cybersecurity Rochester Institute of Technology Rochester, NY, USA {njm3308, matthew.wright}@rit.edu
Department of Computer Science & Engineering University of Minnesota Minneapolis, MN, USA [email protected]
Abstract—Stepping-stone intrusions (SSIs) are a prevalent network evasion technique in which attackers route sessions through chains of compromised intermediate hosts to obscure their origin. Effective SSI detection requires correlating the incoming and outgoing flows at each relay host at extremely low false positive rates—a stringent requirement that renders classical statistical methods inadequate in operational settings. We apply ESPRESSO, a deep learning flow correlation model combining a transformer-based feature extraction network, timealigned multi-channel interval features, and online triplet metric learning, to the problem of stepping-stone intrusion detection. To support training and evaluation, we develop a synthetic data collection tool that generates realistic stepping-stone traffic across five tunneling protocols: SSH, SOCAT, ICMP, DNS, and mixed multi-protocol chains. Across all five protocols and in both host-mode and network-mode detection scenarios, ESPRESSO substantially outperforms the state-of-the-art DeepCoFFEA baseline, achieving a true positive rate exceeding 0.99 at a false positive rate of 10−3 for standard bursty protocols in networkmode. We further demonstrate chain length prediction as a tool for distinguishing malicious from benign pivoting, and conduct a systematic robustness analysis revealing that timing-based perturbations are the primary vulnerability of correlation-based stepping-stone detectors. Index Terms—stepping-stone intrusion detection, network traffic correlation, flow correlation, deep learning, triplet metric learning, transformer networks, network security
I. I NTRODUCTION Stepping-stone intrusions (SSIs), also known as pivoting, are a fundamental evasion tactic in the modern attacker’s playbook. Rather than connecting directly to a target, an adversary routes their session through a chain of compromised intermediate hosts—stepping stones—each of which relays the traffic to the next, obscuring the true origin of the attack. This technique has been widely exploited in high-profile campaigns, malware operations, and botnets [1], [2], [3], [4], [5], and the European Union Agency for Cybersecurity (ENISA) has identified SSIs as one of the top ten threats to IoT security [6]. The core defensive challenge is therefore flow correlation: given the traffic observed at a host or network boundary, determine whether an incoming flow and an outgoing flow belong to the same end-to-end connection. Because attackers routinely encrypt their traffic, contentbased inspection is largely ineffective against modern SSIs [7]. Passive detection methods instead exploit subtle statistical
similarities in the timing, size, and rate of network flows [8], [9], [10], [11], [12], [13], [14]. Active methods go further, embedding timing-based watermarks into flows that survive the transformations introduced by intermediate hosts [15], [16], [17], [18]. Despite two decades of research in both directions, a critical and often overlooked challenge remains unsolved: the extremely low base rate of stepping-stone activity in real networks. In a typical large-scale deployment, malicious relayed traffic constitutes only a tiny fraction of total connection volume. Consider a network gateway that observes one million connection pairs per hour, of which only ten are part of a true stepping-stone chain. A detector with a seemingly excellent 1% false positive rate (FPR) would still generate approximately 10,000 false alarms per hour while correctly flagging all ten true intrusions—an entirely intractable workload for any security analyst. For stepping-stone detection to be operationally useful, its FPR must be driven far below 1%, ensuring that genuine alerts are not buried under a flood of false positives. This stringent low-FPR requirement is a regime in which most existing passive and active SSID methods fall short. The challenge of correlating encrypted, transformed flows under tight FPR constraints mirrors the problem of traffic correlation attacks against anonymity networks like Tor, where adversaries attempt to link ingress and egress flows to deanonymize users. Recent deep learning approaches to this problem—most notably DeepCoFFEA (DCF) [19]—have demonstrated that triplet metric learning can yield significant improvements in the low-FPR regime compared to classical statistical methods. The key insight is to train a neural network to embed flows into a space where correlated pairs cluster together and uncorrelated pairs are pushed apart, rather than performing direct pairwise classification. This embedding approach generalizes well to unseen traffic conditions and scales efficiently to large numbers of candidate pairs. In this paper, we investigate the application of ESPRESSO [20], a deep learning flow correlation model that extends DCF with a transformer-based feature extraction network, time-aligned multi-channel interval features, and online triplet mining, to the domain of steppingstone intrusion detection. The primary contributions of
this paper are the adaptation, evaluation, and analysis of this correlation approach in the SSID setting, which has received comparatively little attention from the deep learning community: • Synthetic stepping-stone dataset. A primary obstacle to progress in this field is the absence of large-scale, labeled datasets suitable for training and evaluating modern correlation methods. We develop a flexible synthetic data collection tool that simulates stepping-stone attack chains over five tunneling protocols (SSH, SOCAT/TCP, ICMP, DNS, and mixed multi-protocol chains) using realistic traffic distributions derived from real-world SSH captures. • Strong baseline results. We benchmark ESPRESSO against DCF across all five datasets in both a hostmode setting (correlating flows at a single intermediate host) and the more demanding network-mode setting (correlating traffic at the network boundary). ESPRESSO consistently and substantially outperforms DCF across all protocols and both detection modes. • Loss function enhancements. We investigate two auxiliary training objectives—temporal alignment and feature decorrelation—designed to improve the quality of the learned embeddings. Temporal alignment yields measurable gains, particularly for challenging mixed-protocol traffic, while feature decorrelation provides inconsistent benefits. • Chain length prediction. Since long connection chains are a strong indicator of malicious intent, we explore two complementary approaches to estimating chain length: a standalone CNN-based regression model and a multi-task extension of ESPRESSO. We find that the standalone model offers the best accuracy, while chain reconstruction via full-path correlation provides high-confidence results where correlation signals are strong. • Robustness evaluation. We systematically evaluate ESPRESSO’s resilience against packet padding and timing perturbation obfuscation strategies. While ESPRESSO is highly robust to padding-only defenses, we find that even modest artificial timing jitter causes significant performance degradation, identifying the primary vulnerability of timing-based correlation methods. 12 • Source code. We release the traffic model code , data 3 4 generation tools , and datasets for community usage. The remainder of this paper is organized as follows. Section II reviews the stepping-stone intrusion threat model and prior detection approaches, and introduces the transformer architecture and triplet metric learning framework that underpin our model. Section III describes the ESPRESSO architecture in detail, including its time-interval feature representation, transformer backbone, and online mining strategy. 1 https://github.com/notem/ESPRESSO-Flow-Correlation 2 https://github.com/notem/SSID-ESPRESSO 3 https://github.com/notem/SSI-Simulator 4 https://drive.google.com/drive/folders/1tPEkS6BXcSXXtwoBGICEmAUoiH0Lkiv
Fig. 1: The standard stepping-stone intrusion detection model with a 3-hop chain containing two stepping stones (H2 and H3).
Section V presents our stepping-stone detection experiments: dataset generation, baseline comparisons, loss enhancements, chain length prediction, and robustness against obfuscation. Section VI discusses the broader implications of our findings and directions for future work, and Section VII concludes. Appendix A reports the original evaluation of ESPRESSO on Tor traffic correlation, which motivated its application to the SSID domain. Appendix B provides supplemental ablation experiments on the DCF architecture. II. BACKGROUND This section provides the background necessary to understand the design and evaluation of ESPRESSO. We begin by surveying the stepping-stone intrusion threat and the landscape of prior detection approaches (Section II-A). We then describe Tor traffic correlation—the problem domain in which ESPRESSO was originally developed—and explain why the two problems are deeply related (Section II-B). Finally, we review the transformer architecture (Section II-C) and the triplet metric learning framework (Section II-D) that form the technical foundations of ESPRESSO. A. Stepping-Stone Intrusions and Detection Stepping-stone attacks, also known as pivoting, involve adversaries using multiple compromised intermediary hosts to relay traffic, making it difficult to trace the origin of the attack. In a stepping stone intrusion (SSI), an attacker establishes a sequence of connections through multiple compromised intermediary hosts, known as stepping stones. These connections form a connection chain, where each pair of hosts communicates using bidirectional flows (e.g., a single SSH connection), which can be further divided into unidirectional send and echo (or reply) flows. The primary motivations for using SSIs include evading detection, concealing the attacker’s identity, and facilitating lateral movement within a target network. SSIs are particularly effective and have been widely utilized in high-profile attacks, malware campaigns, and botnets [1], [2], [3], [4], [5]. Recognizing their potency, the European Union Agency for Cybersecurity (ENISA) has identified SSIs as one of the top ten threats to IoT security [6]. In response to this threat, various stepping stone intrusion detection (SSID) methods have been proposed over the last two
decades. We present a standard model for SSID in Figure 1. These methods can be divided into two main categories: passive SSID and active SSID. 1) Passive SSID: Passive SSID techniques detect steppingstone intrusions by analyzing network traffic without interfering. These methods are further subdivided into host-based, network-based, and chain-based detection approaches [21]. a) Host & Network-Based SSID: Host-based methods focus on identifying whether a specific host within the network is acting as a stepping stone. For example, in a three-host chain (H1, H2, H3), host-based SSID would analyze H2 to determine if it is relaying traffic between H1 and H3. Early host-based methods relied on content-based fingerprinting, which proved ineffective against encrypted communications prevalent in modern networks [7]. Consequently, researchers shifted towards analyzing packet timing information to correlate flows [8], [9], [10], [11]. Techniques included: • Traffic Activity Patterns: Zhang et al. [8] utilized periods of traffic activity (ON/OFF) to correlate flows between hosts. • Time Lag Analysis: Yoda et al. [9] employed average time lag measurements between connections to establish correlations. • Inter-Packet Delay Similarity: Wang et al. [10] compared flows based on the similarity of their inter-packet delays. • Wavelet Transformation: Donoho et al. [11] applied wavelet transformations to inter-arrival times, separating short-term and long-term traffic behaviors. To enhance resistance against jitter and chaff (fake or padding packets), methods were developed to model traffic as a Poisson process [12], [22], [23]. Additionally, packet length features have been identified as valuable for flow correlation [24]. More recent approaches incorporate Pearson’s correlation coefficient [13] and neural networks to improve detection performance [14]. Despite these advancements, host-based SSID methods have limitations, particularly in distinguishing between benign and hostile intrusions. Moreover, recent research has shown that many traditional techniques achieve low true positive rates with minimal false positive rates when faced with advanced evasion strategies like chaffing [25], [26]. b) Chain-Based SSID: Chain-based SSID techniques assess a connection chain’s overall length and structure to identify potential intrusions. The rationale is that benign stepping stones are unlikely to form long chains, whereas malicious intrusions often involve extended chains to obscure the attacker’s origin. Key methods in chain-based SSID include: • Round-Trip Time (RTT) Estimation: Early methods estimate RTT for each hop and compare it against expected values to infer chain lengths [27], [28]. • Clustering and Data Mining: More recent approaches use clustering algorithms to handle outliers and improve RTT estimation accuracy [29], [30], [31].
Chain-based SSID is most effective when sensors are positioned early in the network, allowing for more accurate RTT measurements. However, accurately estimating both upstream and downstream RTT remains challenging, and current methods have not fully addressed robustness against sophisticated evasion techniques. 2) Active SSID (Watermarking): A separate line of work pursues active flow correlation techniques that insert “watermarks” into network flows—by delaying or dropping packets—that can survive the transformations introduced by various network conditions [15], [16], [17], [18], [32], [33], [34], [35], [36], [37], [38], [39]. These techniques have been applied successfully against botnet detection [36], anonymity system flow correlation [39], and SSID [15]. In comparison to passive SSID, watermarking incurs a network overhead that must be considered for real-world deployment. These methods can be categorized into blind and non-blind watermarking techniques. Blind watermarking techniques embed watermarks without requiring any prior knowledge of the traffic flow. The primary challenge is ensuring the watermark remains detectable despite potential network-induced perturbations. Non-blind techniques combine watermark embedding with traffic feature analysis. For example, RAINBOW [17] integrates watermarking with statistical traffic features to enhance detection robustness. Key challenges in watermarking-based SSID include ensuring that watermarks survive network perturbations like jitter and packet loss; making watermarks imperceptible to avoid adversarial evasion; and efficiently applying watermarking across large networks without significant overhead. Recent advancements have focused on improving watermark robustness and efficiency [18]. However, adversaries have also devised methods to detect and neutralize watermarks [40], [41], [42], [43], [44], and few techniques address deliberate noise addition by attackers. B. Tor Traffic Correlation The challenge posed by stepping-stone connection chains mirrors that of flow correlation attacks against anonymity networks such as Tor, where an adversary positioned at two points in the network attempts to link an ingress flow (entering the anonymity system) with its corresponding egress flow (exiting toward the destination) to deanonymize a user. This structural parallel is important: in both settings, the two flows being correlated have traversed one or more intermediate relays that introduce timing jitter, packet re-sizing, and other transformations—yet they must retain enough statistical similarity to be identified as belonging to the same end-to-end connection. Early Tor correlation attacks used classical statistical methods [45], but the introduction of deep learning transformed the state of the art. DeepCorr [45] was among the first to demonstrate that a convolutional neural network trained endto-end on raw packet sequences could substantially outperform hand-crafted features. DeepCoFFEA (DCF) [19] advanced the
C. Transformer Networks The transformer [46] is a deep learning architecture that excels at capturing contextual relationships in sequential data. By using an attention mechanism to process all tokens in an input sequence simultaneously, the model can attend to all positions in the input, making it effective for capturing relationships throughout the sequence. The transformer’s self-attention mechanism computes a weighted sum of all tokens in the input for each token, with weights determined by how relevant each token is to the others. Specifically, the mechanism uses three representations: query, key, and value. The relevance between a pair of tokens is computed by taking the dot product of their query and key representations and applying a softmax function. The outcome is used to weight the value representations, such that the output is a contextually enriched embedding for each token. Layers in the transformer consist of a multi-head self-attention (MHSA) mechanism and a position-wise feed-forward network. The multi-head attention allows the model to focus on different parts of the input for different tasks or reasons, amplifying its capacity to discern complex patterns. Despite its success across many domains, self-attention has a critical limitation: computational cost scales quadratically with sequence length, since every token attends to every other token. This is problematic for applications that operate on long sequences, such as the traffic traces used in flow correlation. Since the self-attention mechanism has no inherent notion of order, positional encodings are added to the input embeddings to preserve the positional context of each token. In ESPRESSO, this role is fulfilled naturally by the timeinterval feature representation described in Section III-A0b, which embeds positional information directly into the input. 1) The Convolutional Vision Transformer (CvT): The Convolutional vision Transformer (CvT) [47] improves vision transformers in terms of performance and efficiency by strategically adding convolutional layers, combining the shift and scale invariance of convolutions with the transformer’s ability to model long-range dependencies. This allows the architecture to consider both local and global structures efficiently.
Value
with stride = 2
Convolutional kernel
Conv. projection
field further by replacing direct classification with triplet metric learning (described in Section II-D), which embeds flows into a low-dimensional space where correlated pairs cluster together. This approach generalized better to unseen network conditions and achieved significantly lower false positive rates than prior methods. ESPRESSO was designed to further improve upon DCF for Tor correlation, and its performance on that problem is documented in Appendix A. Crucially, the low-FPR requirements of Tor correlation—where even 1-in-a-million false positives can expose an innocent user—closely align with the operational constraints of stepping-stone detection discussed in Section I. This makes Tor correlation research a natural source of techniques for SSID, and motivates the application of ESPRESSO to the stepping-stone domain.
Key
Query
Fig. 2: Convolutional projection during transformer selfattention. Strided convolutional projection of the value and key vectors reduces the sequence length and thus significantly reduces the impact of the quadratic computational complexity of attention.
The CvT arranges transformers hierarchically across multiple stages. At the onset of each stage, a convolutional layer increases the feature dimension while performing spatial downsampling via strided convolutions. As one progresses through the stages, the feature dimension grows while the sequence length is reduced, decreasing the cost of attention. Furthermore, CvT substitutes the conventional linear projection used to produce the key, query, and value representations with convolutional projection (see Figure 2). The convolutional kernel captures local relationships to embed into the attention mechanism, and strided convolutions on the key and value sequences reduce their length, providing additional computational efficiency. The ESPRESSO architecture builds on these concepts to construct an efficient transformer backbone for network traffic sequences, as described in Section III-B. D. Triplet Metric Learning for Flow Correlation Framing flow correlation as a standard classification task is a poor fit for the problem: the goal is not to assign flows to discrete classes, but to map related flows from different vantage points onto one another in a shared embedding space. Triplet metric learning provides a powerful framework for this. DeepCoFFEA (DCF) [19], inspired by Triplet Fingerprinting [48], was the first to apply this approach to flow correlation and demonstrated substantial gains over classification-based methods like DeepCorr [45]. 1) The Triplet Loss Function: At the heart of triplet metric learning is the triplet loss function, designed to ensure that, in the learned embedding space, correlated traffic flows are closer together than uncorrelated flows. The loss is computed using three inputs: an anchor sample xa , a positive sample xp (correlated with the anchor), and a negative sample xn (uncorrelated). The network learns an embedding function f (x) such that the anchor–positive distance is smaller than the anchor–negative distance by a margin α: d(f (xa ), f (xp )) + α < d(f (xa ), f (xn ))
where d(·, ·) denotes the distance metric5 and α is a margin that prevents the model from collapsing all distances to zero. The corresponding loss function L is: L = max (0, d(f (xa ), f (xp )) − d(f (xa ), f (xn )) + α) This loss minimizes the distance between correlated flows (anchor and positive) while maximizing the distance between uncorrelated flows (anchor and negative), as illustrated in Figure 3.
Easy Negatives
N
Semi-hard Negatives Hard Negatives
N margin
A
margin
Learning P
A P
a) Separate Feature Embedding Networks (FENs): DCF uses separate feature embedding networks for Tor ingress and egress flows, recognizing that traffic characteristics differ significantly between the two: ingress traffic is encapsulated in Tor cells of fixed size, while egress traffic follows the protocol of the underlying application. Two distinct networks allow the model to capture the unique nature of traffic at each observation point, leading to more accurate embeddings. b) Amplification with Windowing: Rather than comparing entire flows at once, DCF divides flows into short overlapping windows, computes embeddings for each window, and aggregates results through a threshold-based voting mechanism. This windowing strategy amplifies the correlation signal while reducing false positives and allows the model to handle traffic variability within different time frames. ESPRESSO retains both of these innovations while introducing architectural improvements that substantially boost performance, particularly in the low-FPR regime. These improvements are described in detail in the following section. III. D EEP L EARNING FOR F LOW C ORRELATION
Fig. 3: Illustration of triplet metric learning. The anchor and positive flows are pushed closer together, while the negative flow is pushed away in the learned embedding space. 2) Triplet Mining Strategies: In practice, training with triplet loss requires carefully selecting triplets from the dataset. Naive random sampling is inefficient, as many triplets may already satisfy the constraint (i.e., the anchor is already closer to the positive than the negative) and contribute no gradient signal. Two key strategies address this: a) Hard Negative Mining.: Hard negative mining selects triplets where the negative sample is very close to the anchor in the embedding space, forcing the network to sharpen its decision boundaries. A hard negative satisfies: d(f (xa ), f (xn )) < d(f (xa ), f (xp )) + α b) Semi-Hard Negative Mining: Semi-hard mining selects negatives that are farther from the anchor than the positive but still within the margin α, balancing difficulty with training stability: d(f (xa ), f (xp )) < d(f (xa ), f (xn )) < d(f (xa ), f (xp )) + α A variant that combines both hard and semi-hard negatives (excluding only easy triplets) exposes the model to a diverse range of difficult distinctions, improving generalization without destabilizing convergence. This combined strategy is used by DCF. 3) Key Contributions of DeepCoFFEA: DCF introduced several innovations beyond standard triplet learning that make it particularly effective for flow correlation. 5 Measures of similarity, such as cosine similarity used by DCF and ESPRESSO, can be used in place of distance by reversing the inequality.
This section describes the deep learning flow correlation model at the core of our stepping-stone detection system. The model, ESPRESSO, was originally developed for Tor traffic correlation and is described and evaluated in that context in Appendix A; here we present the components necessary to understand its application to SSID. The design rests on three pillars: a multi-channel time-interval feature representation (Section III-A), a transformer-based feature extraction network (Section III-B), and a triplet learning training framework with online mining (Section III-C). A. Multi-Channel Traffic Feature Representation The choice of input representation has an outsized effect on the performance of deep learning models for traffic analysis. Early deep learning attacks on network traffic [49], [50] used a single-channel direction-only representation—a sequence of +1 for each outgoing packet and −1 for each incoming packet. Subsequent work showed that incorporating timing information [51], [52] and exploring richer feature spaces [53] can substantially improve model accuracy, since different feature forms leak variable amounts of information depending on the traffic conditions [54], [55]. Motivated by these findings, we use a multi-channel input representation that provides the model with a variety of complementary views of the same traffic sequence, allowing it to learn more robust internal representations. Our features fall into two categories. a) Packet-Level Features: Packet-level representations operate directly on the ordered sequence of individual packets. The two fundamental packet-level feature vectors are times — raw packet timestamps — and dirs — a sequence of +1 for each outgoing packet and −1 for each incoming packet, padded to the maximum sequence length with zeros. Additional packet-level features are derived from these base vectors by applying transformations; for example, burst_edges is
a sparse vector computed as the difference between adjacent dirs values, taking on values of +2, −2, or (most commonly) 0, and thus compactly encodes the boundaries between traffic bursts. b) Interval Features: Packet-level representations have an important limitation for flow correlation: two correlated flows, having passed through intermediate relays, will generally contain different numbers of packets due to resegmentation. Comparing them on a packet-index basis therefore introduces a systematic misalignment. Interval features address this by aggregating packets into fixed-width time bins, producing representations whose indices correspond to identical periods of real time in both flows, regardless of how many packets each interval contains. Concretely, for a time interval of width ∆t, the traffic is divided into consecutive windows and a set of statistics is computed per window. For SSID, ESPRESSO uses nine interval features, combining direction and size information: • interval_dirs_up / interval_dirs_down: count of upstream / downstream packets per interval. • interval_dirs_sum / interval_dirs_sub: sum and difference of the upstream and downstream packet counts. • interval_size_up / interval_size_down: total bytes sent upstream / downstream per interval. • interval_size_sum / interval_size_sub: sum and difference of upstream and downstream byte counts. • interval_cumul_norm: cumulative normalized directional byte count, providing a global view of the traffic’s directional trend. The interval_size_* features are included because, unlike Tor traffic (where all cells have a fixed size), the raw egress traffic in the SSID setting is not encapsulated in uniformlength cells, making packet size a meaningful discriminating signal. Each feature vector is computed over the same set of time bins and stacked along a channel dimension, forming a multichannel tensor of shape [C ×T ] where C = 9 is the number of channels and T is the number of time intervals. The interval width used in all experiments is ∆t = 30 ms, and the input is truncated or padded to T = 1,200 bins (corresponding to 36 seconds of traffic). B. Transformer-Based Feature Extraction The feature extraction network (FEN) maps an input traffic sequence to a sequence of embedding vectors that are subsequently used for correlation. ESPRESSO uses a transformerbased FEN, building on concepts from the Convolutional vision Transformer (CvT) [47] described in Section II-C. The FEN begins with a convolutional embedding layer that projects the multi-channel input into a sequence of ddimensional tokens (kernel size 3, stride 3). A stack of L transformer blocks is then applied. Each block uses a multihead self-attention (MHSA) layer with CvT-style convolutional projection for the key and value sequences (kernel size 3, stride 2), which reduces the effective sequence length during attention and captures local structure within the attention
DeepCoFFEA-style FEN Architecture
ESPRESSO-style FEN Architecture Traffic Sequence
Traffic Sequence
(Time-interval Representation)
(Per-Packet Representation) Split packets into windows
W1
W2
W3
Backbone Network
W4
Backbone Network
Traffic Sequence
(as encoded features)
Windowing Layer(s)
F1
F2
F3
F4
F1
F2
F3
(aka. wide-width convolutions)
F4
Fig. 4: Architecture comparison between DCF and ESPRESSO. ESPRESSO generates a global feature sequence first and then applies windowing, whereas DCF performs windowing before feature extraction.
computation. The self-attention layer is followed by a positionwise feed-forward (MLP) sublayer. By processing the full traffic sequence before any windowing operation, the FEN can capture global temporal context that would be lost if windows were processed in isolation, as in DCF. After the transformer blocks, a large-kernel convolutional layer (kernel size 50, stride 3) maps the resulting feature stream into a sequence of window embeddings. This post-FEN windowing strategy (illustrated in Figure 4) has two advantages over the DCF approach of windowing before feature extraction: (i) the entire sequence is encoded in a single forward pass rather than one pass per window, and (ii) the windows are guaranteed to be temporally aligned because the interval feature representation ensures that each index corresponds to the same absolute time in both flows. The hyperparameters of the FEN are summarized in Table I. The effective temporal span of each output window is 0.03 s× 3 × 50 = 4.5 seconds, which is comparable to the default 5-second window used by DCF. Two architectural ablations — GreenTea (MHSA replaced with a local convolutional mixer, kernel width 7) and HotWater (MHSA replaced with an identity layer) — are evaluated in Appendix A to isolate the contribution of global self-attention. C. Triplet Learning Framework Building on the triplet metric learning background described in Section II-D, ESPRESSO extends DCF’s framework with two improvements: online mining and a learned classification head. a) Online Triplet Mining.: DCF relies on offline semihard mining, pre-computing embeddings for the entire training set at the start of each epoch to identify triplets. This is computationally expensive and scales poorly to large datasets. ESPRESSO instead uses online mining strategies that select triplets dynamically within each training batch, eliminating the pre-computation step: •
Batch-All: All valid (hard and semi-hard) triplets within a batch are used; easy triplets with zero loss are excluded.
Hyperparameter Input Size
Value 1200
Feature Dim. Hidden Dim.
64 96
Depth
9
Embedding Conv.
kernel: 3 stride: 3
Windowing Conv. Mixer Type Mixer Conv.
kernel: 50 stride: 3 Type: MHSA head_dim: 16 conv_proj: True kernel: 3 stride: 2
Block Dropout
Style: MLP ratio: 4 dropout: 0.0 0.1
Interval Width
30 ms
Feedforward
Description Length of the input sequence. Output feature size. Token feature size in the Transformer. Number of Transformer blocks. Initial feature extraction layer. Final windowing layer. Token mixer used in each block. Parameters for CvT-style MHSA. Feedforward sublayer parameters. Dropout after each Transformer block. Time bin width for interval features.
TABLE I: Hyperparameters of the ESPRESSO feature extraction network.
•
Fig. 5: Diagram of synthetic stepping stone data collection scheme. A multi-hop tunnel is established between the attacker and the target through intermediate hosts (stepping stones) over a WAN link.
Batch-Hard: For each anchor, only the hardest positive and hardest negative within the batch are selected, maximizing training efficiency.
Online batch-hard mining significantly accelerates training while also improving correlation accuracy, since the model is continuously challenged by the most difficult triplets available. b) Classification-Based Correlation Decision: DCF uses a threshold-based voting scheme: each window’s cosine similarity is compared against a fixed threshold, and the majority vote determines whether the overall flow pair is correlated. Tuning this threshold requires a separate optimization step over the full set of candidate pairs. ESPRESSO replaces this with a small multi-layer perceptron (MLP) that takes the vector of per-window cosine similarity scores as input and is trained to predict whether the pair is correlated. This learned decision boundary requires no manual threshold tuning, naturally exploits the large number of overlapping windows that ESPRESSO’s efficient single-pass architecture produces, and can accommodate non-monotonic relationships between window-level scores and overall correlation. D. Adaptation for Stepping-Stone Detection The ESPRESSO model requires only minimal adaptation for the stepping-stone detection task. In the Tor setting, separate FENs are trained for ingress and egress flows because the two differ structurally: ingress traffic is encapsulated in fixed-size Tor cells, while egress traffic follows the underlying application protocol. In the steppingstone setting there is no such asymmetry—both flows being correlated are raw network traffic observed at different points along the same connection chain. A single, shared FEN is
therefore sufficient to capture the critical features needed for correlating traffic across all intermediate hosts. Under the triplet learning setup, the traffic captured at the attacker’s host (the connection entering the first stepping stone) serves as the anchor, and the traffic captured at the target host (the connection exiting the final stepping stone) serves as the positive example. Negative examples are drawn from traffic flows belonging to different, unrelated steppingstone chains. All other aspects of the training procedure— online batch-hard mining, the MLP classification head, and the triplet loss with cosine similarity—carry over unchanged. IV. S YNTHETIC S TEPPING -S TONE DATASET One key challenge in developing effective stepping-stone intrusion detection methods is the scarcity of suitable datasets for training and evaluation. Specifically, no publicly available datasets provide network traffic samples with the packet-level information required to train ESPRESSO. Existing datasets are often incomplete, outdated, or lack the necessary metadata to simulate stepping stone attacks accurately. This limitation motivated the development of a synthetic network environment capable of generating realistic stepping-stone intrusion traffic. To address this gap, we have developed a synthetic data collection tool to simulate stepping stone chains and capture the associated network traffic. This tool automates the data generation process, providing a flexible and scalable method for creating high-quality datasets tailored to the unique challenges of stepping-stone detection. By incorporating various tunneling protocols and customizable network conditions, this approach enables the generation of diverse traffic patterns that reflect real-world attack scenarios. A. Synthetic Stepping-Stone Dataset Generation Our data collection tool simulates stepping-stone attacks across a multi-hop network using tunneling protocols such as SSH, SOCAT (TCP), DNS, and ICMP. These tunneling techniques mimic real-world scenarios where attackers attempt to relay their traffic across intermediate hosts (stepping stones) to obscure their presence. Figure 5 illustrates the design of the stepping-stone simulator. We developed this tool using Docker containers to manage and simulate the network hosts through which the stepping-stone intrusion chain is constructed. Our collection tool supports the use of multiple protocols and tunneling methods within a single stepping stone
chain, offering flexibility in simulating various forms of traffic obfuscation and evasion techniques. This ensures that the dataset covers a range of different intrusion techniques. A unique aspect of our approach is the ability to randomize the tunneling tool used at each hop in the chain, simulating more complex multi-protocol tunneling chains that could be used by sophisticated attackers and pose a large challenge for flow correlation methods. B. Simulating Stepping Stone Chains The simulation begins by establishing an artificial steppingstone chain of multiple hosts. In this chain, the attacker initiates a series of connections from a starting host (the attacker) to an end-point host (the target) through one or more intermediate hosts (stepping stones). These hosts are represented as Docker containers, allowing for easy scalability and deployment in experimental settings. A variable number of stepping-stone hosts can be used in each chain to create different levels of complexity; in our experiments, we use a range from 1 to 3 intermediate hosts. A network delay is simulated between hosts using the netem [56] tool, which introduces artificial network latencies between the first and second hosts to mimic the high-latency wide-area network (WAN) links typically seen between remote nodes. The target and intermediate hosts, on the other hand, are simulated as being on a local-area network (LAN) with lower latency. The delay emulation ensures that the simulated network conditions resemble realistic stepping-stone intrusion scenarios. C. Emulating Realistic Traffic Properties The traffic collection tool we developed uses a generic transmission mechanism designed around bursts of data. The tool sends bursts of data into the tunnel consisting of two phases: (i) the attacker sends N bytes of data upstream (i.e., toward the target), and (ii) the target responds by sending M bytes downstream. This is accomplished using an ECHO Linux command. After completing a burst, the attacker waits for Z seconds before initiating the next burst, repeating this process for J bursts in total. In an effort to generate network traffic that reflects real-world attacker behavior, we have constructed distributions based on real-world traffic data to parameterize our traffic-sending mechanism. a) Burst Definition and Threshold Selection: To create the distributions needed for our collector, we first parse realworld traffic samples into bursts that approximate the functionality of our tool. For this purpose, we define a burst as a contiguous sequence of packets transmitted over a connection, separated from adjacent sequences by an extended period of inactivity. To identify suitable burst boundaries, we analyzed a publicly available DEFCON 25 capture-the-flag dataset [57], focusing on the timing characteristics of SSH traffic. Based on the global inter-packet delay distribution observed within these flows, we selected the 97th percentile of the inter-packet delays (approximately 6.5 ms) as the threshold for distinguishing distinct bursts of activity. This choice captures the majority of
meaningful bursts while minimizing the classification of sporadic or isolated packets as separate bursts, and is reasonably modellable by our transmission mechanism. With this definition, we parse the DEFCON SSH flows into bursts and extract four key statistics to build global distributions of traffic properties: 1) The distribution of the total number of bursts in a given traffic sample; 2) The distribution of inter-burst time intervals; 3) The distribution of upstream bytes per burst; and 4) The distribution of downstream bytes per burst. These empirical distributions then govern the timing and volume of data transmissions, allowing the simulation to emulate bursty traffic patterns characteristic of interactive sessions. Specifically, the simulation samples the total number of bursts (J), the amount of data sent upstream and downstream for each burst (N and M), and the inter-burst interval (Z) from these distributions. To generate the stepping stone traffic, the collection tool samples bursts of traffic from the aforementioned distributions and relays them across the stepping stone chain using a variety of tunneling protocols. SSH tunnels are created using the ssh command, raw TCP tunnels using socat [58], and covert tunnels using ptunnel-ng [59] (for ICMP) or dnscat2 [60] (for DNS). The variety of tunneling protocols allows the dataset to capture a wide range of attack techniques, from more overt forms of tunneling (SSH, TCP) to covert methods designed to evade detection (ICMP, DNS). These are also standard and openly available tools that real-world adversaries are likely to use. D. Dataset Collection and Structure Using this data collection tool, we generated five distinct datasets, each containing at least 10,000 artificial stepping stone chains. The protocols used for each dataset are as follows: 1) SSH-only: All stepping stone traffic is relayed via SSH tunnels. 2) SOCAT-only: Raw TCP sockets are used for tunneling. 3) DNS covert tunnels: All traffic is relayed through covert DNS tunnels, simulating techniques designed to evade traditional intrusion detection systems. 4) ICMP covert tunnels: ICMP is used for covert traffic relaying, further increasing the difficulty of detection. 5) Mixed protocol: Each hop in the stepping stone chain uses a different randomly selected tunneling protocol from the above options, simulating a more complex attack chain. Each dataset contains network traffic captures for stepping stone chains with different numbers of intermediate hosts and varying latencies between hosts. This variety ensures that the dataset can be used to evaluate the effectiveness of stepping-stone detection methods under different conditions. The inclusion of covert protocols (DNS and ICMP) further challenges detection methods by introducing tunnels that are traditionally harder to detect.
V. S TEPPING -S TONE D ETECTION E XPERIMENTS A. Experimental Setup
Fig. 6: Illustration of the network traffic correlation scenarios considered in our evaluations. Our experimental evaluation uses five distinct datasets, each containing stepping-stone intrusion traffic generated through tunneling protocols: SSH-only, SOCAT-only, ICMP-only, and DNS-only. The datasets include 9,000 stepping-stone chains for training and 1,000 chains for testing. Each chain represents a sequence of relayed traffic through one or more intermediary hosts (stepping stones) between an attacker and a target, utilizing one of the selected tunneling protocols. Correlated pairs are traffic flows that are present on the same chain. Uncorrelated pairs are traffic flows from different chains. We evaluate the detection performance of our models in two modes, depicted in Figure 6: • Host-mode detection: The model is trained and tested to correlate traffic flows on the same host. In this mode, correlated flow pairs must exist within the same machine. In real environments, this mode of detection can work alongside traditional host and system logging tools, but it is also uniquely capable of defending devices without robust on-device logging capabilities (such as IoT devices) where external traffic sensors must be relied on. • Network-mode detection: The model is trained and tested to correlate traffic that leaves a host with incoming traffic into the network, enabling the detection of stepping-stone chains that span multiple hosts in a network. In real environments, this strategy will be most valuable when applied to detect when traffic from specific sensitive devices or regions of the network are exiting the organization’s network at the boundary. Networkmode detection is considerably more difficult but has considerable utility in practice, so most of our evaluation focuses on this setting. The evaluation metrics used in our experiments are consistent with those applied in the Tor correlation evaluation in Appendix A. For flow correlation performance, we measure the maximum True Positive Rate (TPR), partial Area Under the Receiver Operating Characteristic curve (pAUC), and present full ROC curves for comparison. We compare against the performance of the DeepCoFFEA [19] (DCF) correlation method as a baseline. Additionally, we performed a limited exploration of window size and model structure; details are reported in Appendix B, Section B-A. From this exploration, we include a tertiary baseline in Table III that
we call “Modified DCF,” which represents a variant of the ESPRESSO framework that uses a DCF network architecture adapted to ingest complete traffic sequences (in ESPRESSO’s time-interval representation) and return features with a window dimension. B. Baseline Stepping Stone Correlation Results The results from our completed experiments benchmarking ESPRESSO against the DCF baseline are presented in this section. The overall correlation performance for both models is visualized as ROC curves in Figure 7 for the host-mode scenario and Figure 8 for the network-mode scenario. A detailed breakdown of performance metrics, including maximum TPR and pAUC at three low FPR thresholds, is provided in Table II for host-mode and Table III for network-mode.
(a) ESPRESSO host-mode ROC
(b) DCF host-mode ROC
Fig. 7: ROC curves presenting correlation efficacy of (a) ESPRESSO and (b) DCF on datasets in the host-mode detection scenario. Analysis. The primary finding from these experiments is that ESPRESSO substantially outperforms the DCF baseline
FPR ≤ 10−3 TPR pAUC
FPR ≤ 10−4 TPR pAUC
FPR ≤ 10−5 TPR pAUC
DCF ESPRESSO
0.536 0.996
0.339 0.990
0.110 0.986
0.057 0.986
0.032 0.918
0.015 0.790
SOCAT-only
DCF ESPRESSO
0.986 1.000
0.952 0.995
0.890 1.000
0.803 0.959
0.722 1.000
0.685 0.599
ICMP-only
DCF ESPRESSO
0.984 1.00
0.938 0.988
0.862 0.998
0.776 0.890
0.614 0.966
0.446 0.909
DNS-only
DCF ESPRESSO
0.052 0.916
0.027 0.757
0.006 0.414
0.003 0.245
0.002 0.064
0.002 0.034
Mixed Protocols
DCF ESPRESSO
0.568 0.992
0.384 0.977
0.180 0.962
0.118 0.883
0.080 0.790
0.038 0.576
Dataset
Model
SSH-only
TABLE II: Host-mode: Maximum TPR and pAUC for FPR thresholds of 10−3 , 10−4 , and 10−5 across five stepping stone datasets. FPR ≤ 10−3 TPR pAUC
FPR ≤ 10−4 TPR pAUC
FPR ≤ 10−5 TPR pAUC
DCF ESPRESSO Modified DCF
0.320 0.992 0.922
0.210 0.975 0.855
0.102 0.962 0.848
0.056 0.8905 0.699
0.02 0.710 0.484
0.012 0.535 0.392
SOCAT-only
DCF ESPRESSO Modified DCF
0.956 1.00 1.00
0.823 0.989 0.997
0.628 1.00 0.996
0.507 0.989 0.978
0.346 1.00 0.976
0.285 0.989 0.880
ICMP-only
DCF ESPRESSO Modified DCF
0.582 0.992 1.00
0.487 0.972 0.985
0.314 0.956 0.984
0.232 0.877 0.874
0.104 0.714 0.60
0.090 0.559 0.445
DNS-only
DCF ESPRESSO Modified DCF
0.086 0.132 0.110
0.056 0.067 0.066
0.012 0.020 0.026
0.008 0.012 0.013
0.002 0.004 0.002
0.002 0.002 0.000
Mixed Protocols
DCF ESPRESSO Modified DCF
0.334 0.748 0.404
0.244 0.640 0.310
0.126 0.456 0.492
0.086 0.302 0.431
0.034 0.174 0.172
0.024 0.133 0.130
Dataset
Model
SSH-only
TABLE III: Network-mode: Maximum TPR and pAUC for FPR thresholds of 10−3 , 10−4 , and 10−5 across five stepping stone datasets.
across all evaluated datasets and in both detection modes. The performance gap is evident in the ROC curves (Figures 7 and 8) and is quantified in the metrics tables. For instance, in the host-mode scenario against the challenging mixed-protocol dataset (Table II), ESPRESSO achieves a TPR of 0.992 at an FPR of 10−3 , whereas DCF reaches only 0.568. This margin of improvement underscores the superior feature representation learned by ESPRESSO. As expected, correlation performance is generally higher in the host-mode setting compared to the network-mode setting for both models. However, ESPRESSO demonstrates greater resilience to the challenges of network-mode detection. For example, while performance on the mixed-protocol dataset drops in network-mode, ESPRESSO still maintains a TPR of 0.748 (at FPR ≤ 10−3 ), more than double DCF’s TPR of 0.334 (Table III). Interestingly, for SOCAT-tunneled traffic, ESPRESSO shows no performance degradation between modes, achieving a perfect TPR of 1.00 in both scenarios. This suggests that the traffic patterns within SOCAT connections are exceptionally stable between hops, making them equally
correlatable from either a host or network vantage point. When examining the impact of the tunneling protocol, DNSbased tunnels prove to be the most difficult to correlate for both models, particularly in network-mode. We attribute this to the polling-based communication mechanism of the dnscat2 tool [60], which disrupts typical traffic timing patterns. Despite this challenge, ESPRESSO’s performance in host-mode against the DNS dataset is remarkably strong, achieving a TPR of 0.916 (FPR ≤ 10−3 ), while DCF’s performance is near zero. Among the other protocols, performance is consistently high. In host-mode, ESPRESSO achieves a perfect TPR on both SOCAT and ICMP traffic, though the higher pAUC for ICMP at an FPR of 10−5 (0.909 vs. 0.599) suggests that ICMP correlations are slightly more robust at extremely low FPRs. In network-mode, SOCAT connections are the most reliably correlated by ESPRESSO, further highlighting the stability of that tunneling protocol. To isolate the factors driving ESPRESSO’s performance gains, we also evaluated a “Modified DCF” variant which adapts the CNN-based DCF backbone to process full-traffic
C. Exploring Loss Enhancements for Improved Feature Representation
(a) ESPRESSO network-mode ROC
Motivation and Rationale. The ESPRESSO method has so far demonstrated robust performance for stepping-stone intrusion detection. However, two key limitations of the current approach hinder its ability to achieve optimal performance: 1) The standard triplet loss function does not enforce temporal alignment of features, which may lead to suboptimal correlations across traffic windows, especially in noisy or variable network conditions. 2) The amplification strategy relies on diverse information being present between different windows to enhance the overall correlation performance. However, under the current loss scheme, no mechanism encourages information represented within different time windows to be uncorrelated. Addressing these limitations aims to enhance ESPRESSO’s ability to generalize across diverse network conditions, improve robustness to false positives, and effectively capture both local and global traffic correlations. 1) Amplification with Temporal Alignment: Motivation. The ESPRESSO framework independently computes window-based similarities without explicitly aligning temporal patterns across samples. This lack of alignment may fail to capture the sequential nature of network traffic, reducing the robustness of similarity calculations.
(b) DCF network-mode ROC
Fig. 8: ROC curves presenting correlation efficacy of (a) ESPRESSO and (b) DCF on datasets in the network-mode detection scenario. Fig. 9: Diagram that visually represents the feature vectors used for temporal feature similarity. sequences. While the per-packet feature variant suffered from misalignment issues, the time-interval feature variant achieved performance competitive with ESPRESSO, particularly at low FPRs, as highlighted in Table III. This result suggests that the primary driver of correlation efficacy is the combination of full-sequence context and time-aligned feature representation, rather than the specific choice of the Transformer architecture over a CNN. Notably, this modified architecture matched ESPRESSO’s performance across most protocols, with the exception of DNS-tunneled traffic, which appears to benefit uniquely from the original DCF’s windowed, packet-level representation (see Appendix B). In the remainder of this section, we explore several different strategies to further improve the performance and functionality of ESPRESSO on the SSID correlation task. Given the increased challenge presented by the network-mode detection, further methods will be evaluated in this setting solely.
Our Approach. Traditional DCF computed cosine similarity between traffic samples along the feature dimension, focusing on how individual features extracted from packet windows compare. While this approach effectively captured local feature similarities, it limited the model’s ability to generalize to traffic variations and overlooked possible temporal patterns across windows. Recent experimental results showed an unexpected performance improvement when similarity was calculated along the window dimension rather than the feature dimension. This approach, which we refer to as temporal similarity, captures temporal structure in the evolution of traffic flows over time. Based on these insights, we propose a hybrid similarity strategy, which incorporates both feature-based and windowbased similarity to better capture correlations between traffic samples.
The core computation in DCF involves calculating the cosine similarity for each window: fi · fj Simwindow (i, j) = ∥fi ∥∥fj ∥ where fi and fj are the feature vectors for traffic windows i and j. This method measures feature similarity for individual windows within a singular slice of time, with no consideration of the temporal behavior of the features. An alternative and complementary strategy is to change the dimension across which feature similarity is calculated. We illustrate this visually in Figure 9. By computing the cosine similarity across the window dimension, we capture correlations based on how the traffic evolves over time: wi · w j Simtemporal (i, j) = ∥wi ∥∥wj ∥ where wi and wj represent the traffic sequences across windows for samples i and j, respectively. This method measures the similarity of a singular feature across all windows of time between samples. This simple adjustment provides an additional mechanism to encourage the model to produce features that are explicitly aligned both within a window and temporally across all windows during training. To incorporate both dimensions into a hybrid learning strategy, we propose a new loss function: Ltriplet = α · Lwindow + (1 − α) · Ltemporal , where α is a hyperparameter that controls the balance between feature-based and window-based similarity.6 This Amplification with Temporal Alignment ensures that correlations are identified within the intrinsic feature space of each window (as done in DCF) and across the temporal progression of traffic patterns. By combining both similarities, ESPRESSO may produce richer embeddings that reflect local and global traffic correlations, making it more robust to noise and traffic variability. 2) Feature Diversity and Decorrelation: Motivation. When features between windows are highly correlated, the model’s ability to amplify meaningful signals diminishes, as overlapping information replaces novel perspectives. This lack of diversity weakens discrimination between correlated and non-correlated samples, reducing the robustness of the amplification process. In contrast, embedding spaces with independent, decorrelated features enable the model to leverage diverse and complementary information, enhancing the system’s ability to identify correlations across dimensions. Our Approach. Correlated feature dimensions within embeddings reduce the diversity of learned representations, introducing redundancy and inefficiency in similarity calculations. To mitigate this, we augment the triplet loss function to encourage feature decorrelation: • Orthogonality. This regularization term imposes a direct geometric constraint on the embedding space, forcing 6 To simplify hyperparameter selection, we use α = 0.5, effectively taking the average of the two losses.
the feature dimensions to be perpendicular and thus minimizing their correlation: Lorth = ∥F⊤ F − I∥2F , where F ∈ Rd×n is the embedding matrix, I is the identity matrix, and ∥ · ∥2F is the Frobenius norm. By penalizing the deviation of the Gram matrix from the identity, this loss encourages a basis of feature vectors that are structurally independent. This strategy is inspired by the Orthogonal Projection Loss (OPL) [61]. • Covariance. This loss component promotes a broader and more expressive coverage of the embedding space by maximizing the determinant of the feature covariance matrix: Lcov = − log det(Cov(F)), where Cov(F) is the covariance matrix of the feature embeddings. Maximizing the determinant incentivizes high variance for each individual feature and low covariance between features, ensuring that the embeddings are spread out while reducing redundancy. By incorporating these regularization terms, the goal is to guide the model toward learning a more efficient and expressive feature representation. When primary correlation signals are weak or obfuscated, a diverse set of features offers more independent sources of information, increasing the chance that a stable, meaningful signal will be amplified. 3) Experimental Results: a) Temporal Alignment.: The results of incorporating the temporal alignment loss are presented in Table IV. Overall, this loss enhancement provides a tangible, albeit modest, improvement to correlation performance, particularly for the SSH and Mixed-protocol datasets. For SSH traffic, the model with temporal loss achieved a max TPR of 0.946 at an FPR of 10−5 , a significant increase from the baseline’s 0.710. Similarly, for the mixed-protocol data, the max TPR improved from 0.174 to 0.413. The improvement is less pronounced for SOCAT and ICMP traffic, which already exhibited nearperfect performance with the baseline model. Unfortunately, the temporal alignment loss offered no benefit for DNS traffic, where correlation remains a significant challenge. This indicates that while temporal alignment is beneficial for protocols with more consistent traffic patterns, it is not sufficient to overcome the fundamental timing disruptions inherent in the polling mechanism of DNS-based tunnels. b) Feature De-correlation: The results of our benchmarks are presented in Table V, and full ROC curves for selected experiments are presented in Figure 10. Our investigation of feature decorrelation losses found that these augmentations generally do not yield consistent or significant improvements in correlation performance. While the training process successfully optimized for these auxiliary objectives— for example, the orthogonality loss on SSH data converged from an extremely high initial value to as low as 35.1, and the covariance loss decreased from 708 to 550 without any explicit weight—this did not translate into improved TPR or pAUC.
Model
AUC
FPR ≤ 10−3
FPR ≤ 10−4
FPR ≤ 10−5
pAUC
max TPR
pAUC
max TPR
pAUC
max TPR
SSH Traffic ESPRESSO + Temporal Loss
0.998 0.998
0.975 0.984
0.992 0.992
0.891 0.955
0.962 0.972
0.535 0.861
0.710 0.946
SOCAT Traffic ESPRESSO + Temporal Loss
1.000 1.000
0.989 0.992
1.000 1.000
0.989 0.992
1.000 1.000
0.989 0.992
1.000 1.000
ICMP Traffic ESPRESSO + Temporal Loss
0.999 0.999
0.972 0.971
0.992 0.991
0.877 0.875
0.959 0.958
0.558 0.573
0.714 0.731
DNS Traffic ESPRESSO + Temporal Loss
0.959 0.953
0.067 0.060
0.132 0.121
0.012 0.011
0.020 0.019
0.002 0.002
0.004 0.004
Mixed Traffic ESPRESSO + Temporal Loss
0.988 0.991
0.640 0.781
0.748 0.852
0.302 0.553
0.456 0.689
0.133 0.291
0.174 0.413
TABLE IV: Benchmark performance of baseline models across various traffic protocols. We compare our standard ESPRESSO model and its variant with a temporal alignment loss. Performance is evaluated using overall AUC, as well as partial AUC (pAUC) and max true positive rate (TPR) at low false positive rate (FPR) thresholds.
The covariance loss, in particular, appears not to correlate with performance, as it decreased naturally during standard training. There was one notable edge case: the model trained on SSH data with all loss functions combined achieved the highest performance in that specific setting, with a pAUC of 0.928 and a max TPR of 0.950 at an FPR of 10−5 . However, this result did not generalize. When the same combined-loss configuration was applied to the Mixed-protocol dataset, the model using only the temporal loss outperformed it. This suggests that explicitly enforcing feature decorrelation is not a primary factor for improving ESPRESSO’s performance and may even be counterproductive for more diverse datasets. Additionally, we plot the cosine similarity of window features within a single sample in Figure 11. We observe that the model trained with orthogonality loss exhibits a clear decrease in overall feature similarity between traffic windows. The covariance loss exhibits a similar trend, albeit with a lesser impact. The temporal loss shows higher similarity magnitudes in comparison and looks to have more spatial clustering of window similarity (perhaps a natural result of temporal alignment). Supplemental experiments benchmarking these losses when applied to the Modified DCF model are included in Appendix B, Section B-B. While loss augmentation provided distinct gains in the Mixed-protocol scenario—improving the baseline TPR from 0.360 to over 0.620 at 10−4 FPR—results on single-protocol data were largely stagnant or unstable, suggesting that the benefits of these strategies are inconsistent and do not strictly generalize to the CNN-based backbone. These loss augmentations have a very slight impact on computational efficiency. With none of the strategies applied, it takes 253.3 ms on average to complete an optimization step on a single batch.7 With temporal loss the computation time 7 Training is performed on an NVIDIA RTX 2080ti with a batch size of 64.
is increased by 1.3% (to 256.6 ms). When orthogonality loss is used time is increased by 1.9% (to 258.7 ms). And finally, covariance loss has the greatest impact of 2.8% (to 260.5 ms). With this low cost in mind, the temporal loss augmentation seems to be a worthwhile strategy to include. D. Investigating Performance Factors in Mixed-Protocol Environments The results presented in the prior sections demonstrate that correlation performance in mixed-protocol environments lags behind single-protocol baselines. To understand the drivers of this degradation and explore potential remedies, we investigate two hypotheses: (1) that a single shared feature extraction network lacks the capacity to represent diverse protocols simultaneously, and (2) that specific protocols with unique statistical properties (specifically DNS) act as performance bottlenecks that skew the aggregate results. 1) Multi-Model Architecture Strategy: To improve efficacy in the multi-protocol setting, we also explore a simple adjustment to the model structure. Rather than constrain learning to a single set of network weights to learn all types of protocol traffic, we initialize dedicated model weights for each protocol that are optimized simultaneously during triplet learning. Although this strategy notably increases training computational costs and the memory footprint, the training process is otherwise identical to the single-model strategy. The performance of this strategy when applied with ESPRESSO is presented in Figure 12. As the ROC curves show, the performance of the two strategies is neck-and-neck. The multi-model strategy outperforms the single-model strategy slightly in maximum TPR at 10−5 FPR, but performance degrades somewhat sharper than the single-model strategy soon after. Given the increased computational cost presented by the multi-model strategy, the trade-off would appear poor. We do not explore this strategy further.
Protocol
SSH
DNS
Mixed
Model Configuration
Loss Weight (λ)
AUC-ROC
pAUC-ROC
Max TPR
Standard ESPRESSO + Temporal Loss
-
0.998 0.998
0.535 0.861
0.710 0.946
+ Lorth
0.1 0.01 0.001 0.0001
0.994 0.996 0.998 0.997
0.043 0.677 0.656 0.727
0.074 0.680 0.856 0.870
+ Lcov
0.01 0.001 0.0001 0.00001
0.917 0.998 0.996 0.997
0.001 0.058 0.421 0.793
0.004 0.126 0.502 0.908
+ Lorth + Lcov
(0.01, 0.01) (0.001, 0.001) (0.0001, 0.0001)
0.999 0.999 0.999
0.211 0.599 0.519
0.278 0.644 0.658
+ All Losses Combined
(0.001, 0.0001)
0.999
0.928
0.950
Standard ESPRESSO + Temporal Loss
-
0.960 0.893
0.064 0.178
0.124 0.248
+ Lorth
0.01 0.001 0.0001
0.963 0.877 0.840
0.075 0.164 0.140
0.138 0.238 0.192
+ Lcov
0.001 0.0001 0.00001
0.954 0.954 0.884
0.081 0.076 0.119
0.152 0.013 0.162
+ All Losses Combined
(0.001, 0.0001)
0.955
0.074
0.13
Standard ESPRESSO + Temporal Loss
-
0.988 0.998
0.640 0.749
0.748 0.804
+ Lorth
0.01 0.001 0.0001
0.997 0.981 0.965
0.432 0.386 0.468
0.562 0.512 0.646
+ Lcov
0.001 0.0001 0.00001
0.989 0.984 0.992
0.113 0.040 0.209
0.202 0.068 0.316
(0.001, 0.0001)
0.994
0.673
0.816
+ All Losses Combined
TABLE V: Performance of ESPRESSO with feature decorrelation loss augmentations across various traffic protocols. The detailed breakdown of loss augmentation experiments was performed on the SSH dataset. The SSH-only model is compared on key detection metrics at an FPR threshold of 10−5 , while the DNS-only and Mixed-protocols models are compared at an FPR threshold of 10−3 .
2) Impact of DNS Traffic on Detection Efficacy: Our second investigation focuses on the composition of the dataset itself. We previously observed that the specific tool used for DNS tunneling in our dataset, dnscat2, employs a unique messaging strategy to regulate data transmission rates and ensure reliability over the connectionless DNS protocol. We hypothesized that the resulting traffic patterns—driven by this distinct application-layer behavior—present a unique correlation challenge that differs fundamentally from the bursty dynamics of TCP-based protocols like SSH and SOCAT, thereby disproportionately impacting the aggregate metrics of the mixed-protocol dataset. To assess this, we applied a filter to the multi-protocol dataset to remove all samples from any chain that utilized the DNS protocol for at least one hop. This curation yielded a dataset of approximately 4,900 samples, which we partitioned into 3,900 for training, 500 for validation, and 500 for testing. Using this filtered data, we benchmarked four model config-
urations: ESPRESSO, ESPRESSO with Temporal Loss, the baseline DCF model, and the modified DCF model utilizing time-interval features.
Figure 13 presents the results from these benchmarks. These results confirm that, as anticipated, DNS traffic is a primary factor in performance degradation. With DNS excluded, detection efficacy improved substantially across all evaluated models. Most notably, ESPRESSO trained with Temporal Loss achieved a True Positive Rate (TPR) exceeding 95% at a False Positive Rate (FPR) below 10−5 (0.001%). These findings validate that the core correlation capabilities of ESPRESSO remain robust across standard bursty protocols (HTTP, HTTPS, SSH), even when mixed, and that future improvements should focus on handling the unique “polling” behavior of protocols such as DNS.
E. Chain Length Prediction for Stepping Stone Detection
(a) SSH-only ROC
(b) DNS-only ROC
While identifying the presence of a stepping-stone is a critical first step, a network defender’s ultimate goal is to assess intent: is this connection relay benign or part of an attack? Not all instances of pivoting are malicious. System administrators routinely use SSH jump hosts to securely manage internal systems, and NAT gateways inherently relay connections. These legitimate use-cases, however, are typically characterized by operational simplicity and efficiency. As such, they almost always involve very short connection chains, often just a single hop. In contrast, a malicious actor’s primary motivation for using stepping-stones is to obfuscate their origin and hinder forensic investigation. Each additional hop in a connection chain, particularly across different administrative domains, exponentially increases the difficulty of tracing the attack back to its source. This provides a strong incentive for attackers to construct longer, more convoluted chains. This discrepancy makes chain length a powerful heuristic for distinguishing between benign and malicious steppingstones. While a single stepping-stone might be legitimate administrative traffic, a five- or six-hop chain is highly indicative of a sophisticated attempt at evasion and is far more likely to be malicious. Accurately predicting the length of a stepping-stone chain is therefore not just an academic exercise; it provides network defenders with a crucial tool for risk assessment and alert triage. Building on this premise, we explore two approaches to predict the number of hosts in a stepping-stone chain. Both approaches treat the problem as a regression task, predicting the number of hosts as a floating-point value. 1) Standalone Chain Length Prediction with a CNN Model: The first approach involves training a deep learning model to predict the number of hosts in upstream and downstream directions. We based this model on a CNN architecture originally designed for website fingerprinting tasks [62]. The model takes per-packet feature representations of the traffic as input, leveraging features such as packet size, direction, and interpacket timings to infer the chain length. The model outputs two floating-point numbers representing the predicted number of upstream and downstream hosts, with the learning objective being to minimize the mean squared error (MSE) between the predicted value and the actual number of hosts. The value is rounded to a discrete representation of the predicted host counts when measuring accuracy. N
MSE = (c) Mixed Protocol ROC
Fig. 10: ROC curves demonstrating correlation performance on (a) SSH-only, (b) DNS-only, and (c) Mixed protocol datasets.
1 X (yˆi − yi )2 N i=1
(1)
where yˆi is the predicted number of hosts for a given sample and yi is the true number of hosts. 2) Joint Flow Correlation and Chain Length Prediction with ESPRESSO: The second approach is to directly integrate chain length prediction into the ESPRESSO flow correlation model, enabling it to simultaneously perform flow
Dataset
Up Acc.
Down Acc.
Avg. Acc.
SSH SOCAT ICMP DNS Mixed
0.950 0.800 0.925 0.798 0.814
0.890 0.710 0.963 0.797 0.770
0.920 0.755 0.944 0.798 0.792
TABLE VI: Performance of the standalone chain-only prediction model across various datasets.
correlation and chain length prediction in a multi-task learning setup [63]. This has two potential benefits: This can save on computation compared with training a separate model for each task. Furthermore, at inference time, only one model is needed. • Additionally, it may boost overall performance, as the model needs to learn a more robust representation of the features that can work in all problems. •
Researchers have demonstrated the effectiveness of this strategy in domains such as computer vision [64], [65] and NLP [66], [67]. Due to the transformer-based design of ESPRESSO, extending the model for multiple outcomes is relatively straightforward. We propose the addition of a special token to the input sequence whose final output will be used for chain length prediction. This is similar to the class token used in the original ViT construction [68]. This token can be connected to a Multi-Layer Perceptron (MLP) that performs the upstream and downstream host count prediction. The chain length prediction is treated as a regression task with mean squared error (MSE) as the loss function. The MSE loss for chain length prediction is added to the triplet loss used for flow correlation, allowing the model to optimize both objectives simultaneously. A weight hyperparameter λ controls the relative strength of the chain length prediction error compared to the flow correlation objective: L = Ltriplet + λ · LMSE-chain-length
(2)
3) Experimental Results: a) Chain-length Prediction: The performance of the two chain-length prediction approaches is detailed in Table VI and Table VII. A key observation is the superior performance of the standalone CNN model, which is trained exclusively for length prediction using packet-level features. As shown in Table VI, this model achieves significantly higher average accuracy on the SSH (0.950), ICMP (0.925), and DNS (0.798) datasets compared to the best results from the jointlearning model. The performance is more comparable for the SOCAT and mixed-protocol datasets. We speculate that the availability of richer, packet-level features, particularly perpacket timestamps, provides the standalone model with more granular timing information that is crucial for accurately inferring chain length. Effectively, the chain-only model operates at a higher resolution of timing features than ESPRESSO,
possibly enabling improvements in prediction accuracy against difficult samples. In the joint learning approach (Table VII), the results show a complex trade-off between chain-length prediction and flow correlation. No single value of λ consistently emerges as the ideal choice across all datasets. Furthermore, increasing the weight of the chain-length prediction loss does not reliably lead to better prediction accuracy either. Encouragingly, the integration of the chain-length prediction task appears to have a minimal overall impact on the primary task of flow correlation, with performance neither significantly degrading nor improving across the different weights. This suggests that multi-task learning is a viable approach, though the standalone model demonstrates that a specialized architecture with more granular features currently offers the best performance for this specific task. b) Inferring Chain Length via Full-Path Correlation.: An alternative to predicting chain length directly is to infer it by reconstructing the entire connection path. This approach leverages the underlying pair-correlation model to determine if every link in a stepping-stone chain can be successfully identified. Instead of treating length prediction as a regression task, this method reframes it as a test of complete recall across all nodes in the chain. A chain is considered successfully traced only if every constituent stepping-stone pair is correlated above a given confidence threshold, and accuracy is calculated as the percentage of chains for which every single stepping-stone pair was correctly identified. The results of this experiment are summarized in Table VIII and in Figure 14. The performance patterns observed unsurprisingly mirror those of the standard network-mode correlation task. The model achieves near-perfect chain accuracy for the SOCAT and ICMP datasets, and very high accuracy for SSH, particularly at an FPR of 10−3 . However, performance drops significantly for the more challenging datasets. The DNS protocol results in zero correctly identified full chains. Similarly, the Mixed protocol dataset shows a steep decline in performance as the FPR threshold becomes more restrictive, failing to identify any complete chains at an FPR of 10−5 . This indicates that while this method is highly effective for protocols with strong correlation signals, its utility as a reliable chain-length counter is limited in scenarios with more diverse or ambiguous traffic patterns, where even a single missed link results in failure. Comparing the two strategies reveals a clear trade-off between robustness and certainty. The direct prediction models, particularly the standalone CNN, provide a reasonable estimate of chain length, even in challenging scenarios such as DNS, where the full-chain correlation method fails entirely. In contrast, the full-chain correlation method, when successful, provides not just the length but the complete composition of the chain with high confidence, but requires extensive network-level monitoring. Therefore, the two approaches are complementary: direct prediction serves as a robust tool for general assessment, while full-chain correlation offers a highfidelity reconstruction method for traffic where correlation
Chain-Length Prediction
Correlation Performance FPR ≤ 10−5
FPR ≤ 10−4
Protocol
λ
Up Acc.
Down Acc.
Avg. Acc.
AUC
pAUC
max TPR
pAUC
max TPR
SSH
0.1 0.5 1.0
0.808 0.814 0.812
0.790 0.838 0.832
0.799 0.826 0.822
0.998 0.998 0.998
0.702 0.702 0.554
0.898 0.914 0.914
0.929 0.928 0.930
0.972 0.970 0.976
SOCAT
0.1 0.5 1.0
0.810 0.820 0.804
0.806 0.808 0.810
0.808 0.814 0.807
0.999 0.9999 1.000
0.888 0.6190 1.000
1.000 1.000 1.000
0.888 0.6190 1.000
1.000 1.000 1.000
ICMP
0.1 0.5 1.0
0.748 0.770 0.800
0.790 0.786 0.810
0.769 0.778 0.805
0.999 0.999 0.999
0.826 0.772 0.802
0.980 0.988 0.988
0.969 0.968 0.977
0.988 0.992 0.998
DNS
0.1 0.5 1.0
0.674 0.658 0.656
0.654 0.624 0.628
0.664 0.641 0.642
0.960 0.957 0.958
0.002 0.002 0.002
0.004 0.004 0.004
0.012 0.011 0.012
0.020 0.020 0.020
Mixed
0.1 0.5 1.0
0.788 0.790 0.784
0.794 0.816 0.814
0.791 0.803 0.799
0.991 0.991 0.990
0.252 0.231 0.222
0.379 0.354 0.339
0.501 0.499 0.490
0.685 0.680 0.664
TABLE VII: Performance of the jointly learned model for direct stepping-stone chain-length prediction and flow correlation. The weight λ balances the contribution of the chain-length prediction loss against the primary correlation loss. Dataset SSH SOCAT ICMP DNS Mixed
FPR ≤ 10−3
FPR ≤ 10−4
FPR ≤ 10−5
Avg. TPR
Chain Acc.
Avg. TPR
Chain Acc.
Avg. TPR
Chain Acc.
0.993 ± 0.080 1.000 ± 0.000 1.000 ± 0.000 0.000 ± 0.000 0.842 ± 0.307
0.992 1.000 1.000 0.000 0.758
0.983 ± 0.123 1.000 ± 0.000 0.996 ± 0.055 0.000 ± 0.000 0.310 ± 0.414
0.980 1.000 0.994 0.000 0.220
0.947 ± 0.214 1.000 ± 0.000 0.994 ± 0.070 0.000 ± 0.000 0.000 ± 0.000
0.938 1.000 0.992 0.000 0.000
TABLE VIII: Performance of correlation-based (full-chain) prediction at various FPR thresholds. The table shows the average True Positive Rate (TPR) with standard deviation, and the full chain accuracy for each dataset.
signals are strong. F. Impact of Padding Obfuscation and Delays To evaluate the robustness of our correlation model, we investigate its performance against standard traffic obfuscation techniques that an adversary might employ to evade detection. This section details our experiments applying two fundamental noising strategies (packet padding and timing perturbations) to a standard protocol where such manipulations would be feasible, such as SSH. By systematically increasing the intensity of these defenses, we can measure the resilience of both ESPRESSO and the DCF baseline and identify their breaking points. 1) Obfuscation Strategies: We implemented two distinct obfuscation methods designed to disrupt the statistical features that correlation systems rely on. Varying-Rate Padding Adding dummy (or chaff) packets is a foundational technique to defend against traffic analysis by masking the true volume and burst patterns of a connection [69]. Simple, constant-rate padding can be trivial to identify and filter. To create a more sophisticated and less predictable defense, we developed a varying-rate injection strategy that introduces dummy packets in bursts.
A correlation model must evaluate a vast number of potential incoming-outgoing flow pairings. A sophisticated padding defense should therefore generate chaff that not only masks the original flow’s patterns but also creates new, plausible-looking patterns. A varying-rate strategy creates dummy streams that can exhibit a higher degree of coincidental correlation with uncorrelated flows, forcing the detection model to disambiguate the true correlated pair from a multitude of compelling, but false, alternatives. The padding algorithm begins by determining the number of dummy packets to inject, Nd′ , by sampling from a normal distribution centered on a target overhead percentage. The total duration of the traffic, T , is then divided into K temporal segments, where K is uniformly sampled from {Kmin = 5, Kmax = 15}. To create a bursty traffic pattern, the Nd′ packets are distributed unevenly across these segments using a Dirichlet distribution: (w1 , . . . , wK ) ∼ Dir(α) nk = round(wk · Nd′ )
where α = (1, . . . , 1)
such that
K X
nk = Nd′
(3) (4)
k=1
Within each segment k of duration Tk = T /K, the inter-packet arrival times for its nk allocated dummy packets are modeled
as a Poisson process by sampling from an exponential distribution with rate λk = nk /Tk . Finally, to make the dummy traffic statistically similar to the real traffic, the sizes of the injected packets are sampled from the empirical distributions of the original flow’s incoming and outgoing packet sizes. Timing Perturbation The second strategy directly targets the fine-grained timing features that are often the most powerful signal for traffic correlation [44], [70]. By introducing random, artificial latency (jitter), this method aims to desynchronize the temporal relationship between an incoming and outgoing flow. For each packet pi in a flow with an original timestamp ti , a random delay di is introduced with a set probability, Pdelay . The delay is drawn from a uniform distribution up to a maximum value, Dmax . The new timestamp, t′i , is calculated as: ( U(0, Dmax ) with Pdelay where di = 0 with 1 − Pdelay (5) After applying these delays to all packets in the flow, the entire sequence is re-sorted by the new timestamps to maintain chronological order. We tested this strategy at several intensities by varying the parameters (Pdelay , Dmax ), corresponding to “light” (two variants) and “heavy” obfuscation profiles. The first light variant delays packets with a 25% probability up to a maximum of 1.0 second. The second light variant increases the likelihood to 50% but reduces the maximum delay to 0.5 seconds. The “heavy” profile uses a 75% probability with a 1.0-second maximum delay. 2) Experimental Results: The following analysis evaluates the impact of these obfuscation techniques on the SSH dataset in the network-mode detection scenario. The performance degradation for ESPRESSO and DCF is shown in Figures 15 through 18. Our results demonstrate that ESPRESSO is highly resilient to padding-only defenses. As shown in Figure 15, even with a 200% padding overhead (tripling the number of packets), correlation performance sees only a modest decrease. For instance, at 100% overhead, ESPRESSO’s max TPR at an FPR of 10−5 is 0.496, a noticeable but not catastrophic drop from the baseline of 0.710. DCF, with its lower initial performance, is more significantly impacted by padding alone. The introduction of timing perturbations, however, proves to be a far more effective countermeasure. The “light delays (v1)” profile (25% probability) combined with padding already causes significant performance degradation for both models, as seen in Figure 16. At 100% padding overhead, ESPRESSO’s max TPR at FPR 10−5 falls to 0.168. The “light delays (v2)” profile (50% probability) degrades performance even further (Figure 17), reducing ESPRESSO’s max TPR to 0.054 under the same conditions. The “heavy delays” profile (75% probability) is devastatingly effective, as illustrated in Figure 18. When combined with 100% padding overhead, this strategy almost completely nullifies ESPRESSO’s correlation capabilities, reducing its t′i = ti + di ,
max TPR at an FPR of 10−5 to just 0.004. This dramatic performance collapse under severe timing jitter provides insight into why the DNS-tunneled traffic is so difficult to correlate. The heavy delays artificially recreate the disruptive effect of the DNS tunnel’s polling-based communication, confirming that radical timing alterations are the most effective method for breaking traffic correlation systems like ESPRESSO. VI. D ISCUSSION Key Findings. Our experiments establish several clear conclusions about the application of deep learning flow correlation to stepping-stone intrusion detection. First, ESPRESSO substantially and consistently outperforms the DCF baseline across all five tunneling protocols and in both detection modes, demonstrating that the combination of full-sequence context and time-aligned interval features is the primary driver of correlation performance—rather than any specific architectural choice. Second, the nature of the tunneling protocol has an outsized impact on detectability: standard bursty protocols (SSH, SOCAT, ICMP) are highly correlatable, while the pollingbased behavior of DNS tunneling fundamentally disrupts the temporal patterns that correlation methods rely on. Third, chain length prediction is feasible and operationally useful, with the standalone CNN model offering robust estimates even in the DNS case where flow correlation fails entirely. Fourth, and most critically, timing-based perturbations are far more effective at defeating correlation than volume-based padding, pointing to a specific and actionable vulnerability that defenders and future researchers must address. The Dominance of Timing Features. Our obfuscation experiments revealed a critical insight: ESPRESSO’s performance is far more sensitive to timing perturbations than to volumebased padding. Even a massive 200% increase in packet count had a less detrimental effect than modest, probabilistic delays. This finding, combined with the poor performance on DNS-tunneled traffic, strongly suggests that ESPRESSO relies heavily on timing patterns. An adversary aware of this could focus their efforts on introducing jitter to evade detection effectively. Future work should explore architectures that are inherently more robust to timing noise or that can explicitly model and filter out such perturbations. Practical FPR Implications. The introduction motivated the stringent FPR requirements for stepping-stone detection with a concrete scenario: in a network observing one million connection pairs per hour with only ten true stepping-stone chains, a 1% FPR would produce approximately 10,000 false alarms. It is worth closing the loop by examining what the FPR levels achieved in our experiments mean in this context. At the FPR threshold of 10−5 —the tightest threshold in our tables— ESPRESSO achieves a TPR of 0.710 on SSH traffic and 0.790 on the mixed-protocol dataset in network-mode detection. At this FPR, the same one-million-pair gateway would generate only approximately 10 false positives per hour while catching the majority of true intrusions. For well-structured bursty protocols, the situation is even more favorable: the SOCAT
and ICMP datasets yield perfect TPR at 10−5 FPR, and the DNS-excluded mixed-protocol setting achieves TPR > 0.95. These results suggest that for networks where attackers use standard tunneling protocols, the system is operationally viable. The DNS case remains a meaningful gap: at any FPR threshold below 10−3 in network-mode, detection collapses. A realistic deployment would therefore benefit from combining ESPRESSO with protocol-aware pre-filtering that routes DNS traffic to specialized detection logic. Limitations of the Synthetic Dataset. The most significant limitation of this work is its exclusive reliance on synthetic data. While our collection tool was carefully parameterized using empirical distributions derived from real-world traffic, several important gaps remain. Most critically, all negative examples in our training and evaluation sets are drawn from other stepping-stone chains generated by the same simulator. In a real network, the vast majority of traffic is benign background activity—web browsing, file transfers, video streams, database queries—and the model has never been trained to distinguish correlated attack traffic from this diverse population. It is plausible that benign flows exhibiting bursty, interactive patterns (e.g., SSH administrative sessions, database connections) could produce spuriously high correlation scores, inflating the effective FPR in deployment beyond what our controlled experiments suggest. A rigorous evaluation in a realistic environment would require capturing true benign negative traffic alongside synthetic attack chains, which we leave as an important direction for future work. A secondary concern is the fidelity of the traffic generation model itself. Our simulator parameterizes burst sizes and inter-burst intervals from a capture-the-flag competition dataset, which may not fully represent the range of behaviors exhibited by sophisticated, longrunning intrusion campaigns (e.g., slow-and-low exfiltration, automated lateral movement, or C2 beaconing). The Dockerbased simulation also abstracts away network effects present in real deployments, such as asymmetric routing, variable MTU, and real-stack TCP retransmissions. Comparison Scope. Our primary deep learning baseline is DCF [19], and our ablation introduces a Modified DCF variant. We did not benchmark against traditional passive SSID methods such as Poisson-based approaches [12], [22] or wavelet-based methods [11]. The rationale is twofold. First, these methods were not designed for the low-FPR operating regime that is the focus of this work; they typically report TPR and FPR at a single threshold rather than across a continuous ROC curve, making a direct comparison of their performance in our evaluation setting difficult to construct fairly. Second, the prior literature has already established that deep learning methods substantially outperform classical statistical approaches on flow correlation tasks [19], [45], and DCF is the strongest published representative of the deep learning family. Benchmarking against classical methods would be informative for completeness but is unlikely to change the qualitative conclusions. We acknowledge this as a limitation and encourage future work to establish a broader comparison, particularly in
settings where dataset or computational constraints may favor simpler baselines. Scalability and Deployment. Deploying a neural flow correlation system on a live network raises practical scalability concerns that our experiments do not fully address. The core challenge is that the number of candidate flow pairs grows quadratically with the number of concurrent connections observed at a network monitor. ESPRESSO’s embeddingbased architecture partially mitigates this: flows are encoded into fixed-size vectors in a single forward pass, and correlation is then reduced to a distance computation in embedding space, which is much cheaper than running the FEN on every pair. Nevertheless, the FEN itself is a 9-layer transformer that processes sequences of 1,200 time bins; embedding a single flow requires a non-trivial amount of computation. In our training setup, an optimization step over a batch of 64 samples takes approximately 253 ms on an NVIDIA RTX 2080 Ti. A careful analysis of throughput, latency, and memory requirements in a realistic deployment environment—and the potential use of quantization or knowledge distillation to reduce model size [71], [72]—is an important direction that we leave to future work. Limitations of Loss Enhancements. While the exploration of temporal alignment and feature decorrelation losses was an interesting exercise, the results were mixed. Temporal alignment provided a small benefit, but none of the loss augmentation strategies fundamentally solved the challenges posed by complex protocols like DNS. This suggests that simply encouraging different feature properties through auxiliary loss terms may not be sufficient. A more promising direction could be to design network architectures that are structurally biased towards the properties of each protocol, rather than relying on the loss function to guide the learning process. Further development and refinement of the multimodel strategy is another direction of exploration; however, this strategy will still be fundamentally limited by the poor single-model performance against DNS-tunneled traffic. Beyond Per-Connection Correlation. Our findings suggest that some protocols and sophisticated obfuscation techniques may render per-connection correlation practically impossible in isolation. This reality calls for a strategic shift from a narrow focus on individual correlated pairs to a broader, more holistic detection framework. Such a system would treat correlation scores as just one of many signals in a larger analytical model. Future systems should aim to integrate data streams across longer timescales and diverse protocols, looking for patterns of attacker behavior rather than just traffic similarities. For example, correlating a suspicious DNS C2 channel with a subsequent SSH login from an unexpected IP could provide a much stronger signal of intrusion than either event would alone. This approach moves toward modeling attacker tactics, techniques, and procedures (TTPs) directly, where flow correlation serves as a crucial but not solitary piece of evidence. Modeling Advanced Attacker Behavior. A key limitation of
this project lies in our benchmark dataset. Our dataset contains stepping-stone intrusion chains with relatively simplistic simulations of attacker behavior. In the current experiments, stepping stone chains are created statically. However, sophisticated attackers are likely to engage in more dynamic behaviors, such as incrementally extending or shrinking the chain over time by adding or removing intermediate hosts. Additionally, the activities within a tunnel may vary significantly based on the phase of the attack (e.g., reconnaissance, data exfiltration). Future work must focus on simulating these more complex and dynamic attacker behaviors to create more realistic and challenging benchmarks. Robustness Against Adaptive Adversaries. A critical challenge in deploying learning-based correlation systems is the threat of an adaptive adversary who possesses a copy of the detection model (white-box access) or a reasonable proxy of it (black-box access). In this scenario, the adversary can utilize the model as an oracle, iteratively modifying their traffic shaping strategy (e.g., altering packet timing and sizing) to maximize the embedding distance between the attacker and target flows. Our experimental results in Section V clearly indicate the strategy an adversary would likely adopt. We observed that ESPRESSO struggles to correlate traffic from DNS tunnels (specifically dnscat2) compared to bursty protocols like SSH or SOCAT. We hypothesized that this performance gap is driven by the “polling” nature of the DNS tunneling protocol, which transmits data in highly periodic, non-bursty intervals. An adaptive adversary, therefore, need not invent entirely new obfuscation techniques; they could simply reshape their traffic to mimic these high-regularity, periodic patterns to evade detection. While the defender could attempt to build adversarial training strategies to gain some robustness, such an adversary is likely to be exceptionally difficult to detect using traffic correlation methods, as evidenced by our DNS results. Instead, these advanced obfuscation techniques are perhaps better addressed by anomaly detection methods. The distribution of traffic produced by standard usage of protocols like SSH and DNS is likely to appear distinctively different than what is produced when a layer of regularizing traffic obfuscation is applied. This suggests that a holistic defense strategy must pair flow correlation with statistical anomaly detection to effectively cover the blind spots created by highly regularized traffic shaping. VII. C ONCLUSION Stepping-stone intrusions remain one of the most effective and underappreciated evasion techniques available to network attackers. By routing malicious sessions through chains of compromised intermediary hosts, adversaries can make forensic attribution extremely difficult—yet the problem has received comparatively little attention from the deep learning community. A key reason is the absence of suitable large-scale datasets and the demanding operational requirement that any practical detector must achieve extremely low false positive rates to avoid burying true alerts in noise.
In this paper, we addressed both obstacles. We developed a flexible synthetic data collection tool that simulates steppingstone attack chains across five tunneling protocols—SSH, SOCAT, ICMP, DNS, and mixed multi-protocol chains—using traffic distributions derived from real-world captures, producing the largest labeled dataset for this problem to date. We then applied ESPRESSO, a transformer-based deep learning flow correlation model that combines time-aligned interval features, full-sequence context, and online triplet learning, to the stepping-stone detection task. Our baseline experiments demonstrated that ESPRESSO substantially outperforms the state-of-the-art DeepCoFFEA (DCF) method across all five protocols and in both host-mode and network-mode detection settings, establishing a new performance benchmark for this domain. In the most challenging network-mode setting, ESPRESSO achieves a TPR exceeding 0.99 at an FPR of 10−3 for SSH, SOCAT, and ICMP traffic, and remains competitive on the more difficult mixed-protocol dataset. Beyond flow correlation, we demonstrated that chain length prediction is both feasible and operationally meaningful, providing defenders with a tool for distinguishing benign administrative pivoting from multi-hop attack chains. A standalone CNN trained on packet-level features proved most effective for this task, while a full-chain reconstruction approach offered high-confidence path tracing for protocols where correlation signals are strong. Our investigation into adversarial robustness revealed that ESPRESSO is highly resilient to packet padding but is significantly degraded by timing-based perturbations— a vulnerability that mirrors its difficulty with DNS-tunneled traffic and confirms that fine-grained temporal features are both the primary strength and the primary attack surface of the model. Temporal alignment loss augmentation provided modest but consistent improvements in the most challenging settings at negligible computational cost. The central challenge limiting further progress in this domain is the absence of real-world traffic to validate synthetic benchmarks and guide robust model development. Our evaluations operate entirely in a closed world of synthetic attack traffic; in realistic deployments, the model must distinguish stepping-stone flows from a rich background of benign interactive sessions that have never been seen during training. Closing this gap—through longitudinal captures in monitored research networks, collaboration with operational security teams, or advances in privacy-preserving data sharing—is the most impactful step the community can take. We hope that the dataset generation tools, model, and evaluation framework introduced here serve as a foundation for that work. R EFERENCES [1] I. C. of Investigative Journalists, “The panama papers: Exposing the rogue offshore finance industry,” 2016. [2] R. Lee, M. J. Assante, and T. Conway, “Tlp: White-analysis of the cyber attack on the ukrainian power grid-defense use case,” in Proc. Electr. Inf. Sharing Anal. Center (E-ISAC), 2016, pp. 1–29. [3] L. Ayala, “Active medical device cyber-attacks,” in Cybersecurity for hospitals and healthcare facilities. Springer, 2016, pp. 19–37. [4] Mcafee, “Global energy cyberattacks: Night dragon,” 2011.
[5] C. Tankard, “Advanced persistent threats and how to monitor and deter them,” Network security, vol. 2011, no. 8, pp. 16–19, 2011. [6] E. U. A. for Cybersecurity, Baseline security recommendations for IoT in the context of critical information infrastructures. European Network and Information Security Agency, 2017. [7] S. Staniford-Chen and L. T. Heberlein, “Holding intruders accountable on the internet,” in Proceedings 1995 IEEE Symposium on Security and Privacy. IEEE, 1995, pp. 39–49. [8] Y. Zhang and V. Paxson, “Detecting stepping stones.” in USENIX Security Symposium, vol. 171, 2000, p. 184. [9] K. Yoda and H. Etoh, “Finding a connection chain for tracing intruders,” in European Symposium on Research in Computer Security. Springer, 2000, pp. 191–205. [10] X. Wang, D. S. Reeves, and S. F. Wu, “Inter-packet delay based correlation for tracing encrypted connections through stepping stones,” in Proceedings of ESORICS 2002, October 2002, pp. 244–263. [11] D. L. Donoho, A. G. Flesia, U. Shankar, V. Paxson, J. Coit, and S. Staniford, “Multiscale stepping-stone detection: Detecting pairs of jittered interactive streams by exploiting maximum tolerable delay,” in International Workshop on Recent Advances in Intrusion Detection. Springer, 2002, pp. 17–35. [12] A. Blum, D. Song, and S. Venkataraman, “Detection of interactive stepping stones: Algorithms and confidence bounds,” in International Workshop on Recent Advances in Intrusion Detection. Springer, 2004, pp. 258–277. [13] J. Yang and D. Woolbright, “Correlating tcp/ip packet contexts to detect stepping-stone intrusion,” Computers & Security, vol. 30, no. 6, pp. 538–546, 2011. [Online]. Available: https://www.sciencedirect.com/ science/article/pii/S0167404811000721 [14] R. Kumar and B. Gupta, “Neural network based approach for stepping stone detection under delay and chaff perturbations,” Procedia Computer Science, vol. 85, pp. 155–165, 2016, international Conference on Computational Modelling and Security (CMS 2016). [Online]. Available: https://www.sciencedirect.com/science/article/pii/ S187705091630552X [15] X. Wang, D. S. Reeves, S. F. Wu, and J. Yuill, “Sleepy watermark tracing: An active network-based intrusion response framework,” in IFIP International Information Security Conference. Springer, 2001, pp. 369–384. [16] X. Wang and D. S. Reeves, “Robust correlation of encrypted attack traffic through stepping stones by manipulation of interpacket delays,” in Proceedings of the 10th ACM Conference on Computer and Communications Security, ser. CCS ’03. New York, NY, USA: Association for Computing Machinery, 2003, p. 20–29. [Online]. Available: https://doi.org/10.1145/948109.948115 [17] A. Houmansadr, N. Kiyavash, and N. Borisov, “Rainbow: A robust and invisible non-blind watermark for network flows.” in Network & Distributed System Security Symposium (NDSS), 2009. [18] L. Mo, G. Lv, B. Wang, G. Qiao, and J. Tan, “The design and implementation of an efficient quaternary network flow watermark technology,” in 2021 17th International Conference on Mobility, Sensing and Networking (MSN), 2021, pp. 746–751. [19] S. E. Oh, T. Yang, N. Mathews, J. K. Holland, M. S. Rahman, N. Hopper, and M. Wright, “Deepcoffea: Improved flow correlation attacks on tor via metric learning and amplification,” in 2022 IEEE Symposium on Security and Privacy (SP). IEEE, 2022, pp. 1915–1932. [20] T. Chawla, S. Mittal, N. Mathews, and M. Wright, “Espresso: Advanced end-to-end flow correlation attacks on tor,” in Proceedings of the 8th Asia-Pacific Workshop on Networking, ser. APNet ’24. New York, NY, USA: Association for Computing Machinery, 2024, p. 219–220. [Online]. Available: https://doi.org/10.1145/3663408.3665824 [21] L. Wang and J. Yang, “A research survey in stepping-stone intrusion detection,” EURASIP Journal on Wireless Communications and Networking, vol. 2018, no. 1, p. 276, Dec 2018. [Online]. Available: https://doi.org/10.1186/s13638-018-1303-2 [22] T. He and L. Tong, “Detecting encrypted stepping-stone connections,” IEEE Transactions on Signal Processing, vol. 55, no. 5, pp. 1612–1623, 2007. [23] J. Yang, B. Lee, and S. S. Huang, “Monitoring network traffic to detect stepping-stone intrusion,” in 22nd International Conference on Advanced Information Networking and Applications - Workshops (aina workshops 2008), 2008, pp. 56–61. [24] J. Yang, L. Wang, S. Shakya, and M. Workman, “Identify encrypted packets to detect stepping-stone intrusion,” in Advanced Information
Networking and Applications, L. Barolli, I. Woungang, and T. Enokido, Eds. Cham: Springer International Publishing, 2021, pp. 536–547. [25] J. Yang, L. Wang, A. Lesh, and B. Lockerbie, “Manipulating network traffic to evade stepping-stone intrusion detection,” Internet of Things, vol. 3-4, pp. 34–45, 2018. [Online]. Available: https: //www.sciencedirect.com/science/article/pii/S254266051830057X [26] H. Clausen, M. S. Gibson, and D. Aspinall, “Evading stepping-stone detection with enough chaff,” in Network and System Security, M. Kutyłowski, J. Zhang, and C. Chen, Eds. Cham: Springer International Publishing, 2020, pp. 431–446. [27] K. H. Yung, “Detecting long connection chains of interactive terminal sessions,” in International Workshop on Recent Advances in Intrusion Detection. Springer, 2002, pp. 1–16. [28] J. Yang and S.-H. S. Huang, “A real-time algorithm to detect long connection chains of interactive terminal sessions,” in Proceedings of the 3rd international conference on Information security, 2004, pp. 198– 203. [29] L. Wang, J. Yang, M. Mccormick, P.-J. Wan, and X. Xu, “Detect stepping-stone intrusion by mining network traffic using k-means clustering,” in 2020 IEEE 39th International Performance Computing and Communications Conference (IPCCC). IEEE, 2020, pp. 1–8. [30] L. Wang, J. Yang, X. Xu, and P.-J. Wan, “Mining network traffic with the-means clustering algorithm for stepping-stone intrusion detection,” Wireless Communications and Mobile Computing, vol. 2021, 2021. [31] J. Yang and S.-H. S. Huang, “Mining tcp/ip packets to detect stepping-stone intrusion,” Computers & Security, vol. 26, no. 7, pp. 479–484, 2007. [Online]. Available: https://www.sciencedirect.com/ science/article/pii/S0167404807000934 [32] F. Rezaei and A. Houmansadr, “Finn: Fingerprinting network flows using neural networks,” in Annual Computer Security Applications Conference, ser. ACSAC. New York, NY, USA: Association for Computing Machinery, 2021, p. 1011–1024. [Online]. Available: https://doi.org/10.1145/3485832.3488010 [33] L. Yu, L. Zhang, Y. Zhang, W. Wen, X. Du, and F. Cao, “Dynamic interval-based watermarking for tracking down network attacks,” in 2021 IEEE 21st International Conference on Software Quality, Reliability and Security (QRS), 2021, pp. 52–61. [34] X. Gong, M. Rodrigues, and N. Kiyavash, “Invisible flow watermarks for channels with dependent substitution, deletion, and bursty insertion errors,” IEEE Transactions on Information Forensics and Security, vol. 8, no. 11, pp. 1850–1859, 2013. [35] F. Rezaei and A. Houmansadr, “Tagit: Tagging network flows using blind fingerprints,” Proceedings on Privacy Enhancing Technologies, vol. 2017, no. 4, pp. 290–307, 2017. [Online]. Available: https: //doi.org/10.1515/popets-2017-0050 [36] A. Houmansadr and N. Borisov, “Botmosaic: Collaborative network watermark for the detection of irc-based botnets,” Journal of Systems and Software, vol. 86, no. 3, pp. 707–715, 2013. [Online]. Available: https://www.sciencedirect.com/science/article/pii/S0164121212003068 [37] A. Iacovazzi, S. Sarda, D. Frassinelli, and Y. Elovici, “Dropwat: An invisible network flow watermark for data exfiltration traceback,” IEEE Transactions on Information Forensics and Security, vol. 13, no. 5, pp. 1139–1154, 2018. [38] A. Houmansadr, N. Kiyavash, and N. Borisov, “Non-blind watermarking of network flows,” IEEE/ACM Transactions on Networking, vol. 22, no. 4, pp. 1232–1244, 2013. [39] X. Wang, S. Chen, and S. Jajodia, “Network flow watermarking attack on low-latency anonymous communication systems,” in IEEE Symposium on Security and Privacy (S&P), 2007, pp. 116–130. [40] W. Jia, F. P. Tso, Z. Ling, X. Fu, D. Xuan, and W. Yu, “Blind detection of spread spectrum flow watermarks,” Security and Communication Networks, vol. 6, no. 3, pp. 257–274, 2013. [Online]. Available: https://onlinelibrary.wiley.com/doi/abs/10.1002/sec.540 [41] Z. Lin and N. Hopper, “New attacks on timing-based network flow watermarks,” in 21st USENIX Security Symposium (USENIX Security 12). Bellevue, WA: USENIX Association, Aug. 2012, pp. 381–396. [Online]. Available: https://www.usenix.org/conference/ usenixsecurity12/technical-sessions/presentation/zin [42] P. Peng, P. Ning, and D. S. Reeves, “On the secrecy of timing-based active watermarking trace-back techniques,” in Proceedings of the 2006 IEEE Symposium on Security and Privacy, ser. SP ’06. USA: IEEE Computer Society, 2006, p. 334–349. [Online]. Available: https://doi.org/10.1109/SP.2006.28
[43] X. Luo, P. Zhou, J. Zhang, R. Perdisci, W. Lee, and R. K. C. Chang, “Exposing invisible timing-based traffic watermarks with backlit,” in Proceedings of the 27th Annual Computer Security Applications Conference, ser. ACSAC ’11. New York, NY, USA: Association for Computing Machinery, 2011, p. 197–206. [Online]. Available: https://doi.org/10.1145/2076732.2076760 [44] N. Kiyavash, A. Houmansadr, and N. Borisov, “Multi-flow attacks against network flow watermarking schemes.” in USENIX security symposium. Berkeley, CA, 2008, pp. 307–320. [45] M. Nasr, A. Bahramali, and A. Houmansadr, “DeepCorr: Strong Flow Correlation Attacks on Tor Using Deep Learning,” in ACM Conference on Computer and Communications Security (CCS), 2018, p. 1962–1976. [46] A. Vaswani, N. Shazeer, N. Parmar, J. Uszkoreit, L. Jones, A. N. Gomez, Ł. Kaiser, and I. Polosukhin, “Attention is all you need,” in Proc. Advances in Neural Information Processing Systems, 2017. [47] H. Wu, B. Xiao, N. Codella, M. Liu, X. Dai, L. Yuan, and L. Zhang, “Cvt: Introducing convolutions to vision transformers,” in 2021 IEEE/CVF International Conference on Computer Vision (ICCV), 2021, pp. 22–31. [48] P. Sirinam, N. Mathews, M. S. Rahman, and M. Wright, “Triplet Fingerprinting: More practical and portable website fingerprinting with n-shot learning,” in ACM Conference on Computer and Communications Security (CCS), 2019, p. 1131–1148. [49] P. Sirinam, M. Imani, M. Juarez, and M. Wright, “Deep Fingerprinting: Undermining website fingerprinting defenses with deep learning,” ACM Conference on Computer and Communications Security (CCS), 2018. [50] V. Rimmer, D. Preuveneers, M. Juarez, T. Van Goethem, and W. Joosen, “Automated website fingerprinting through deep learning,” in Network and Distributed System Security Symposium (NDSS), 2018. [51] M. S. Rahman, P. Sirinam, N. Mathews, K. G. Gangadhara, and M. Wright, “Tik-Tok: The utility of packet timing in website fingerprinting attacks,” Proceedings on Privacy Enhancing Technologies (PETS), vol. 2020, no. 3, pp. 5–24, 2020. [52] S. Bhat, D. Lu, A. Kwon, and S. Devadas, “Var-CNN: A data-efficient website fingerprinting attack based on deep learning,” Proceedings on Privacy Enhancing Technologies (PETS), vol. 2019, no. 4, pp. 292–310, 2019. [53] M. Shen, K. Ji, Z. Gao, Q. Li, L. Zhu, and K. Xu, “Subverting website fingerprinting defenses with robust traffic representation,” in 32nd USENIX Security Symposium (USENIX Security 23). Anaheim, CA: USENIX Association, Aug. 2023, pp. 607–624. [Online]. Available: https://www.usenix.org/conference/ usenixsecurity23/presentation/shen-meng [54] N. Mathews, J. K. Holland, S. Oh, M. Rahman, N. Hopper, and M. Wright, “Sok: A critical evaluation of efficient website fingerprinting defenses,” in 2023 IEEE Symposium on Security and Privacy (SP). Los Alamitos, CA, USA: IEEE Computer Society, may 2023, pp. 969–986. [Online]. Available: https://doi.ieeecomputersociety.org/10. 1109/SP46215.2023.10179289 [55] S. Li, H. Guo, and N. Hopper, “Measuring information leakage in website fingerprinting attacks and defenses,” in ACM Conference on Computer and Communications Security (CCS), 2018. [56] Linux Foundation, “Netem.” [Online]. Available: https://www.linux.org/ docs/man8/tc-netem.html [57] D. C. 25, “Def con 25 ctf.” [Online]. Available: https://media.defcon. org/DEF%20CON%2025/DEF%20CON%2025%20ctf/ [58] dest-unreach.org, “socat - multipurpose relay.” [Online]. Available: http://www.dest-unreach.org/socat/ [59] Toni Uhlig, “ptunnel-ng.” [Online]. Available: https://github.com/utoni/ ptunnel-ng [60] Ron Bowes, “dnscat2.” [Online]. Available: https://github.com/iagox86/ dnscat2 [61] K. Ranasinghe, M. Naseer, M. Hayat, S. Khan, and F. S. Khan, “Orthogonal projection loss,” in Proceedings of the IEEE/CVF international conference on computer vision, 2021, pp. 12 333–12 343. [62] N. Mathews, J. K. Holland, N. Hopper, and M. Wright, “Laserbeak: Evolving website fingerprinting attacks with attention and multi-channel feature representation,” IEEE Transactions on Information Forensics and Security, vol. 19, pp. 9285–9300, 2024. [63] R. Caruana, “Multitask learning,” Machine learning, vol. 28, no. 1, pp. 41–75, 1997. [64] I. Kokkinos, “Ubernet: Training a universal convolutional neural network for low-, mid-, and high-level vision using diverse datasets and limited
memory,” in 2017 IEEE Conference on Computer Vision and Pattern Recognition (CVPR), 2017, pp. 5454–5463. [65] X. Yang, H. Sun, X. Sun, M. Yan, Z. Guo, and K. Fu, “Position detection and direction prediction for arbitrary-oriented ships via multitask rotation region convolutional neural network,” IEEE Access, vol. 6, pp. 50 839–50 849, 2018. [66] Z. Tang, L. Li, D. Wang, and R. Vipperla, “Collaborative joint training with multitask recurrent model for speech and speaker recognition,” IEEE/ACM Transactions on Audio, Speech, and Language Processing, vol. 25, no. 3, pp. 493–504, 2017. [67] R. Collobert and J. Weston, “A unified architecture for natural language processing: Deep neural networks with multitask learning,” in Proceedings of the 25th International Conference on Machine Learning, ser. ICML ’08. New York, NY, USA: Association for Computing Machinery, 2008, p. 160–167. [Online]. Available: https://doi.org/10.1145/1390156.1390177 [68] A. Dosovitskiy, L. Beyer, A. Kolesnikov, D. Weissenborn, X. Zhai, T. Unterthiner, M. Dehghani, M. Minderer, G. Heigold, S. Gelly, J. Uszkoreit, and N. Houlsby, “An image is worth 16x16 words: Transformers for image recognition at scale,” in International Conference on Learning Representations, 2021. [Online]. Available: https://openreview.net/forum?id=YicbFdNTTy [69] M. Juarez, M. Imani, M. Perry, C. Diaz, and M. Wright, “Toward an efficient website fingerprinting defense,” in Computer Security– ESORICS 2016: 21st European Symposium on Research in Computer Security, Heraklion, Greece, September 26-30, 2016, Proceedings, Part I 21. Springer, 2016, pp. 27–46. [70] K. P. Dyer, S. E. Coull, T. Ristenpart, and T. Shrimpton, “Peek-a-boo, i still see you: Why efficient traffic analysis countermeasures fail,” in 2012 IEEE symposium on security and privacy. IEEE, 2012, pp. 332–346. [71] Z. Shen, M. Zhang, H. Zhao, S. Yi, and H. Li, “Efficient attention: Attention with linear complexities,” in Proceedings of the IEEE/CVF winter conference on applications of computer vision, 2021, pp. 3531– 3539. [72] S. Wang, B. Z. Li, M. Khabsa, H. Fang, and H. Ma, “Linformer: Self-attention with linear complexity,” arXiv preprint arXiv:2006.04768, 2020.
A PPENDIX A ESPRESSO ON T OR T RAFFIC C ORRELATION ESPRESSO was originally developed and evaluated as a flow correlation attack against the Tor anonymity network, where the goal is to link a user’s ingress connection (entering a Tor guard node) with the corresponding egress connection (exiting toward the destination server) in order to deanonymize the user. This appendix documents that original evaluation, which established ESPRESSO’s performance characteristics and directly motivated its application to stepping-stone detection in the main body of this paper. The model architecture— including the time-interval feature representation, transformerbased FEN, post-FEN windowing, online triplet mining, and MLP classification head—is described in full in Section III. A. Evaluation Methodology 1) Metrics: Our primary metric for evaluating correlation performance is the True Positive Rate (TPR) vs. False Positive Rate (FPR) curve, also known as the Receiver Operating Characteristic (ROC) curve. To emphasize performance at extremely low FPR values, which are critical for practical flow correlation applications, we plot ROC curves using a logarithmic scale on the FPR axis. This visualization makes it easier to discern model performance in the low-FPR regime. In addition to the ROC curve, we use two specialized metrics:
Maximum TPR at a Maximum FPR Threshold: The maximum true positive rate the model achieves when the false positive rate is constrained to a predefined threshold. This metric is particularly useful for comparing models where minimizing FPR is of paramount importance. • Partial Area Under the Curve (pAUC): The area under the ROC curve for FPR values below a specified maximum threshold. By focusing on the low-FPR sections of the ROC, this metric allows more precise comparisons between models in scenarios where false positive rates must be kept extremely low. •
2) Dataset: We evaluate on the same dataset collected and used in the DCF paper [19]. This dataset consists of network traffic flows collected using a Tor client and an SSH proxy to capture both ingress and egress flows. From this dataset, we use the data collected in June 2022, using 8,662 flow pairs for training, 764 pairs for validation, and 811 pairs entirely unseen for testing. In addition to the original DCF dataset, we simulate the TrafficSliver defense with two splits applied to the ingress flows. This defense introduces a more challenging evaluation scenario by splitting the ingress traffic across two independent network paths, making it more difficult for the correlation model to accurately associate incoming and outgoing flows. By including this defense mechanism, we ensure that ESPRESSO is tested against both standard and adversarial network conditions. B. Results & Analysis We present the results of evaluating ESPRESSO compared to DCF and the architectural ablations GreenTea and HotWater. The results are demonstrated through ROC curves with a particular emphasis on performance at very low FPR rates, and summarized in Table IX. 1) ROC Curve Analysis: Comparison of ESPRESSO and DeepCoFFEA. Figure 19 shows the ROC curves comparing ESPRESSO (trained with online and offline mining) against DeepCoFFEA. The results demonstrate that ESPRESSO significantly outperforms DCF, particularly at very low FPRs (below 10−6 ). The online training strategy combined with hard triplet mining gives ESPRESSO an advantage in both efficiency and correlation accuracy. Notably, ESPRESSO achieves a TPR of over 0.9 at FPR values below 10−5 , while DCF lags behind in both the offline and online mining setups. Impact of Architecture. Figure 20 compares the architectures of ESPRESSO (transformer backbone), GreenTea (local convolutional mixing), HotWater (identity mixing), and DCF (CNN backbone, isolated windowing strategy). ESPRESSO outperforms all other architectures. Interestingly, GreenTea performs competitively at very low FPRs, achieving performance close to ESPRESSO below an FPR of 10−8 . HotWater and DCF perform similarly, with both models struggling to achieve a TPR of over 0.5 at very low FPR values. It is notable that the HotWater variant does as well as it does,
given the complete lack of spatial feature processing inside the transformer blocks. Effect of Loss Margins on ESPRESSO. Figure 21 shows the performance of ESPRESSO when trained using online mining with varying loss margins (0.1, 0.25, 0.5, and 0.75) compared to ESPRESSO trained in offline mode with a margin of 0.5. A margin of 0.5 yields the best overall performance. The smallest margin (0.1) performs significantly worse, highlighting the importance of selecting an appropriate margin for correlation tasks. ESPRESSO with a margin of 0.75 also shows strong results, suggesting that larger margins are generally more effective for this task. DCF Training Analysis. Given the significant impact that loss margin has on ESPRESSO, we re-evaluate DCF using variable loss margins in both the online and offline mining strategies (Figure 22). Online batch-hard mining was completely ineffective when training DCF, with the model unable to learn at all—likely because the selected triplets are too difficult at the per-window level. We therefore use the easier batch-all strategy for DCF. Both online and offline training perform similarly, though the smaller margin of 0.1 offers a slight advantage over 0.5, particularly at low FPR. This shows that DCF, which lacks the global context-awareness of ESPRESSO, benefits more from a tighter loss margin. We hypothesize that with the limited information available within any given window, DCF fails to effectively use the greater distance ranges possible with a larger embedding margin. TrafficSliver Defense Results. Figure 23 compares the ROC curves of ESPRESSO and DCF against the TrafficSliver dataset. The TrafficSliver defense significantly degrades correlation performance for both models. However, ESPRESSO demonstrates resilience, achieving a TPR of over 0.2 at an FPR of 10−6 , indicating that non-trivial vulnerability remains even when up to half of the network traffic is absent in the ingress flow. This result underscores the strength of ESPRESSO’s correlation model even under adversarial conditions. 2) Summary Table: Analysis of Max TPR and pAUC. From Table IX, ESPRESSO consistently outperforms DCF and other variants, particularly at very low FPR thresholds. ESPRESSO trained with a margin of 0.5 and online batchhard mining achieves the highest Max TPR values at all FPR levels. At an FPR threshold of 10−7 , ESPRESSO achieves a Max TPR of 0.811 and a pAUC of 0.678, while DCF (offline) only achieves a Max TPR of 0.076 and a pAUC of 0.034. The choice of margin significantly impacts performance. ESPRESSO with larger margins (0.5 and 0.75) consistently yields better results than with smaller margins, whereas DCF struggles to maintain performance at low FPR thresholds with a larger margin of 0.5. At an FPR threshold of 10−7 , a loss margin of 0.75 has a small advantage over 0.5 in the pAUC score, indicating that even higher loss margins may be useful when targeting the lowest possible FPR. The GreenTea variant performs competitively at lower FPR thresholds, achieving a Max TPR of 0.511 at 10−7 , but still
FPR ≤ 10−5 TPR pAUC
FPR ≤ 10−6 TPR pAUC
FPR ≤ 10−7 TPR pAUC
0.1 0.1 0.5 0.5
0.768 0.756 0.691 0.594
0.584 0.581 0.491 0.357
0.304 0.313 0.112 0.039
0.197 0.177 0.038 0.011
0.076 0.047 0.002 0.000
0.034 0.012 0.001 0.000
Online Online Online Online Offline
0.1 0.25 0.5 0.75 0.5
0.884 0.973 0.977 0.961 0.967
0.762 0.900 0.922 0.924 0.931
0.602 0.912 0.949 0.931 0.909
0.384 0.783 0.885 0.854 0.733
0.139 0.657 0.811 0.801 0.320
0.061 0.511 0.678 0.731 0.090
Online Online
0.5 0.5
0.865 0.668
0.805 0.538
0.728 0.359
0.630 0.238
0.511 0.066
0.425 0.030
Model
Training Mode
Loss Margin
DCF DCF DCF DCF
Offline Online Offline Online
ESPRESSO ESPRESSO ESPRESSO ESPRESSO ESPRESSO GreenTea HotWater
TABLE IX: Maximum TPR and pAUC for FPR thresholds of 10−5 , 10−6 , and 10−7 .
lags behind ESPRESSO. HotWater exhibits much lower performance across all metrics, confirming the benefit of global self-attention for capturing long-range dependencies in traffic sequences. These findings highlight the importance of both margin selection and mining strategy in optimizing the model’s performance in the low-FPR regime.
C. Discussion
Generalization Across Different Network Settings. While ESPRESSO has demonstrated strong performance in controlled experimental settings, its generalization to more diverse network conditions remains an open question. In real-world applications, network traffic can be affected by various factors such as mobile networks with higher latency, packet loss, or network jitter. These conditions introduce additional variability that may impact correlation efficacy. Collecting a more realistic dataset with samples from various network conditions and locations would be required to fully assess this. Impact of Larger Dataset Sizes. As with many machine learning models, the size and diversity of the training dataset has a significant effect on the model’s ability to generalize to new data. While the dataset used for this evaluation is substantial, real-world networks will generate far larger and more diverse data. It remains an open question how ESPRESSO will scale with even larger datasets with greater traffic variety. One possibility is that the model could plateau or encounter diminishing returns depending on the variety of traffic patterns encountered. Improving Model Efficiency. An important direction for further development of ESPRESSO is exploring lightweight versions of the architecture to improve computational efficiency. Linear attention mechanisms [71], [72] may offer a better balance between computational cost and efficacy, making ESPRESSO more suitable for large-scale deployment and real-time systems.
A PPENDIX B S UPPLEMENTAL E XPERIMENTS ON THE DCF A RCHITECTURE In Section V, we presented the performance of the Deep Correlation Framework (DCF) using a fixed input window dimension optimized for our primary dataset. However, a critical question regarding the deployment of such models is their sensitivity to window length—specifically, whether larger input contexts improve correlation accuracy or simply introduce latency and computational overhead. Furthermore, while ESPRESSO leverages a transformer-based Feature Extraction Network to process full-length traffic sequences, the original DCF relied on processing isolated windows using a standard Convolutional Neural Network inherited from the DeepFingerprinting method. This appendix explores these questions by expanding our experimental evaluation in two directions. First, we assess the impact of scaling the DCF input window size by factors of 2× and 3×. Second, we explore a structural variant of the DCF framework where we replace its window-based processing with a “whole-sequence” approach. In this experiment, we modify the DCF method and model—originally designed for fixed-length individual-window correlation—to serve as a sequential Feature Extraction Network capable of processing full traffic streams. This experiment allows us to isolate the impact of the backbone architecture (CNN vs. Transformer) from the input processing strategy (windowed vs. sequential). A. DeepCoFFEA Window and Framework Modifications 1) Experimental Setup: To rigorously evaluate the impact of windowing and backbone architecture, we devised two distinct experimental configurations. a) Input Window Scaling: In our baseline experiments, the DCF model operates on a fixed window size W , which we set to 8s by default. To test sensitivity to this hyperparameter, we retrained and evaluated the model on window sizes of 2W and 3W while keeping the remaining architecture (feature dimension, depth) constant. The input sequence length was increased by the same factor. The objective was to observe if a larger receptive field allows the model to capture long-range
dependencies missed by the shorter baseline window, or if the local burst structures captured by W are sufficient for robust correlation. b) Adapting Deep Fingerprinting as a Feature Extraction Network: The standard DCF approach processes traffic by slicing flows into independent windows before feature extraction. In this experiment, we modified the DCF pipeline to operate more like ESPRESSO: ingesting the entire traffic sequence at once and generating a corresponding sequence of feature vectors. To achieve this, we adapted the Deep Fingerprinting architecture [49] to serve as the backbone FEN. Architecture Modification. The standard DF architecture consists of a stack of convolutional blocks followed by a flattening layer and a dense classification head. To adapt this for flow correlation, we modified it as follows: 1) Removal of Prediction Head: We truncated the network by removing the final flattening operation and the subsequent dense classification layers. 2) Sequence Output: The model output is taken from the final convolutional layer, resulting in a sequence of feature maps (e.g., a shape of L × 256, where L is the sequence length determined by the input size and pooling ratios). 3) Dimensionality Reduction: We appended a timedistributed linear layer to project the 256-dimensional convolutional features down to our target embedding dimension of 64, allowing the modified DF backbone to output a sequence of 64-dimensional vectors and treating the convolutional stride as the windowing mechanism. Input Modalities. We evaluated this “Modified DCF” using two different input representations to test the importance of temporal alignment: 1) Per-Packet Features: The model was fed raw sequences of packet metadata with the standard DCF feature representation (e.g., sizes × direction and inter-arrival times). In this modality, the convolutional filters operate on indices of packets. Consequently, the output “windows” correspond to fixed counts of packets rather than fixed durations of time. This causes a lack of time alignment between windows when comparing different traces, which has severe performance repercussions. 2) Time-Interval Features: The model was fed traffic aggregated into fixed time intervals. In this modality, the convolutional filters operate on time bins just as in the standard ESPRESSO variants, ensuring temporal alignment. Using these configurations, we run benchmarks on the stepping-stone datasets within the more difficult network-mode detection setting for each protocol grouping, without any of the loss augmentation strategies discussed in Section V. 2) Experimental Results: Figure 24 presents the ROC curves for each dataset under each experimental setting, with the standard ESPRESSO configuration included as a reference.
The first observation is that the impact of window size is highly dataset-dependent. Increasing the window size of DCF yields significant performance improvements against DNS and ICMP tunneled traffic, a marginal improvement against SSH, and no improvement against SOCAT. For the mixed-protocol dataset, longer windows show improvement at higher TPR targets but are outperformed by the small default window at lower FPR targets. The most notable outcome is that the 32-second window size outperforms ESPRESSO against DNS-only traffic by a notable margin; however, the overall performance remains poor and is likely unsuitable for practical applications. The Modified DCF configuration with per-packet input features performs comparably to standard DCF on DNS-only traffic but is substantially degraded on SOCAT, ICMP, and mixed datasets. This is likely due to misaligned time windows when using per-packet features, preventing the model from learning robust representations. When we instead use timeinterval features, performance is significantly improved and is competitive with ESPRESSO across most protocols—at the low end of FPR, this configuration meets or slightly exceeds ESPRESSO’s performance. This indicates that the key drivers of ESPRESSO’s performance are the combination of fullsequence input and time-interval feature representation, rather than improvements in the backbone neural network architecture. These results also again highlight the distinctiveness of DNS tunneled traffic, in which large-window per-packet feature representations appear key to maximizing correlation efficacy. B. Evaluation of Loss Augmentation Strategies on the DCF Architecture In Section V, we introduced several auxiliary loss functions—specifically Temporal Alignment, Orthogonality, and Covariance Decorrelation loss—designed to regularize the feature space of ESPRESSO. While the efficacy of these losses was demonstrated on the transformer-based architecture of ESPRESSO, their impact on the CNN-based DCF architecture remains unclear. In this section, we provide an abbreviated benchmarking of the loss augmentation strategies on the Modified DCF architecture using the best-performing loss weights identified for ESPRESSO. 1) Results: Figure 25 shows the ROC curves for Modified DCF applied with various loss configurations on the SSH-only, DNS-only, and Mixed-protocol datasets. Similar to the results for ESPRESSO, the impact of the loss on correlation is highly variable. On SSH-only data, the combined loss augmentation outperforms other models at 10−5 FPR, achieving a TPR of 0.446 compared to the 0.350 TPR of the baseline model. It outperforms other loss augmentations at this FPR threshold but drops off steeply. Under the DNS-only traffic setting, all training losses perform nearly identically to one another, demonstrating minimal performance separation. Against the Mixed-protocol dataset, the baseline performed relatively poorly, leading most loss augmentation strategies to outperform it across a wide range of FPR targets. In these
trials, the temporal alignment and covariance losses came out ahead, scoring 0.620 and 0.626 TPR at 10−4 FPR, compared to 0.360 TPR achieved by the baseline. Overall, performance deviations among the different loss training strategies appear more spurious than indicative of any clear trend.
Fig. 11: Comparison of window feature similarity of ESPRESSO trained with different loss strategies on one randomly chosen traffic sample.
Fig. 12: ROC comparison of ESPRESSO trained using singlemodel and multi-model settings against the Mixed-protocol data in network-mode.
(a) ESPRESSO against padding (no delays)
Fig. 13: ROC results for additional benchmarks on the Multiprotocol dataset without chains that include DNS-tunneled traffic.
(b) DCF against padding (no delays)
Fig. 15: ROC curves for (a) ESPRESSO and (b) DCF on the SSH-only dataset under traffic padding obfuscation in the network-mode detection scenario.
Fig. 14: Full chain correlation accuracy as a function of FPR with ESPRESSO.
(a) ESPRESSO against light delays (v1)
(a) ESPRESSO against light delays (v2)
(b) DCF against light delays (v1)
(b) DCF against light delays (v2)
Fig. 16: ROC curves for (a) ESPRESSO and (b) DCF on the SSH-only dataset under padding with light delays (v1) in the network-mode detection scenario.
Fig. 17: ROC curves for (a) ESPRESSO and (b) DCF on the SSH-only dataset under padding with light delays (v2) in the network-mode detection scenario.
(a) ESPRESSO against heavy delays
Fig. 20: ROC curves comparing ESPRESSO, GreenTea, HotWater, and DeepCoFFEA models.
(b) DCF against heavy delays
Fig. 18: ROC curves for (a) ESPRESSO and (b) DCF on the SSH-only dataset under padding with heavy delays in the network-mode detection scenario. Fig. 21: ROC curves comparing ESPRESSO trained with different loss margins in the online mining scenario.
Fig. 19: ROC curves comparing ESPRESSO (online mining), ESPRESSO (offline mining), and DeepCoFFEA.
Fig. 22: ROC curves comparing DeepCoFFEA trained with various margins and mining strategies.
Fig. 23: ROC curves comparing ESPRESSO and DeepCoFFEA when benchmarked on the TrafficSliver dataset.
(a) SSH-only ROC
(b) SOCAT-only ROC
(c) ICMP-only ROC
(d) DNS-only ROC
(e) Mixed protocol ROC
Fig. 24: ROC curves presenting correlation efficacy across five datasets in the network-mode detection scenario for DCF window scaling and framework modification experiments. ESPRESSO is included as a reference.
(a) SSH-only ROC
(b) DNS-only ROC
(c) Mixed Protocol ROC
Fig. 25: ROC curves demonstrating correlation performance of Modified DCF with loss augmentation strategies on (a) SSHonly, (b) DNS-only, and (c) Mixed protocol datasets.