Effective Pivot Attack Detection via System and Network Information

Stitch: A Host-Based, Real-Time Pivot Detection System Using Programmable Kernel Process Tracing

Ava Powelson; Carson Kuzniar; Hyojoon Kim; Israat Haque· 2026· DOI 10.48550/arXiv.2608.23731

The core problem

Perimeter-based security appliances, such as firewalls and Intrusion Detection Systems (IDS), are ineffective against modern attacks that use pivoting. In pivoting, attackers relay traffic through compromised hosts to reach additional targets that would otherwise be inaccessible. Because the relayed traffic appears legitimate, pivoting is extremely difficult to detect. Although the consequences of these attacks are known to be severe, existing defenses suffer from drawbacks such as high processing delays, low accuracy, or reliance on network-wide participation, making them inconvenient or even ineffective. This work presents Stitch, a host-based system that uses the programmable kernel to detect pivoting in real time. By observing host-traversing flows, Stitch uses process tracing to effectively combine system and network-level information, connecting incoming and outgoing communications and identifying pivoting characteristics between them. Stitch covers the gap in current pivot detection solutions by providing accurate, lightweight, and independent coverage for vulnerable hosts in a network.

Stitch was evaluated in two separate real-world deployments. The results show 31% gains in accuracy over state-of-the-art pivoting defenses. Additionally, Stitch achieved a maximum false positive rate of 0.006% across both deployments. These results demonstrate that Stitch provides accurate and reliable pivot detection while maintaining a low false positive rate, which is critical for practical deployment. The high accuracy and low false positive rate indicate that Stitch effectively distinguishes between legitimate relayed traffic and malicious pivoting, addressing the limitations of existing solutions that suffer from high processing delays, low accuracy, or reliance on network-wide participation.

Perimeter-based security appliances, such as firewalls and Intrusion Detection Systems (IDS), are ineffective against modern attacks that use pivoting. In pivoting, attackers relay traffic through compromised hosts to reach additional targets that would otherwise be inaccessible. Because the relayed traffic appears legitimate, pivoting is extremely difficult to detect. Although the consequences of these attacks are known to be severe, existing defenses suffer from drawbacks such as high processing delays, low accuracy, or reliance on network-wide participation, making them inconvenient or even ineffective. This work presents Stitch, a host-based system that uses the programmable kernel to detect pivoting in real time. By observing host-traversing flows, Stitch uses process tracing to effectively combine system and network-level information, connecting incoming and outgoing communications and identifying pivoting characteristics between them. Stitch covers the gap in current pivot detection solutions by providing accurate, lightweight, and independent coverage for vulnerable hosts in a network.

Stitch is a host-based system that leverages the programmable kernel to detect pivoting in real time. The core methodology involves observing host-traversing flows and using process tracing to combine system-level and network-level information. Specifically, Stitch connects incoming and outgoing communications and identifies pivoting characteristics between them. This approach enables the detection of pivoting behavior by correlating process activity with network flows, thereby distinguishing legitimate relayed traffic from malicious pivoting. The system is designed to be lightweight and independent, requiring no network-wide participation, which addresses the drawbacks of existing defenses. The detection logic can be conceptualized as a function that maps incoming and outgoing flows to a pivoting likelihood score:

The results indicate that Stitch successfully fills the gap in current pivot detection solutions by offering accurate, lightweight, and independent coverage for vulnerable hosts. By using the programmable kernel and process tracing, Stitch combines system and network information in a way that existing defenses do not, enabling real-time detection without the need for network-wide participation. The 31% accuracy gain over state-of-the-art defenses and the maximum false positive rate of 0.006% highlight the effectiveness of this approach. The host-based nature of Stitch makes it particularly suitable for environments where deploying network-wide solutions is impractical or where perimeter defenses are insufficient. The following Mermaid diagram illustrates the high-level architecture and data flow of Stitch: In this architecture, incoming and outgoing flows are observed alongside process tracing data within the programmable kernel. The correlation engine combines these sources to detect pivoting characteristics. This design allows Stitch to operate independently on a single host, providing a lightweight and accurate defense against pivoting attacks. Future work may involve extending Stitch to detect more complex pivoting scenarios and integrating it with existing security infrastructures.

CS practitioners and researchers

Opening member content…