SSH-Tracker: Fine-grained SSH behavior analysis in encrypted tunnel traffic

Encrypted tunneling technologies provide privacy protection and secure communication while concealing fine-grained behavioral semantics within encapsulated traffic. When Secure Shell (SSH) traffic is transmitted through encrypted tunnels, multiple SSH behaviors are often executed sequentially within continuous sessions, producing implicit behavioral transitions that cannot be directly observed from traffic side-channel information. Existing encrypted traffic analysis methods mainly focus on protocol- or application-level classification and generally rely on fixed-window representations, limiting their ability to model sequential SSH behaviors with unknown transition boundaries. This paper presents SSH-Tracker, a multi-task learning framework for SSH behavior analysis in encrypted tunnels. SSH-Tracker jointly performs behavioral boundary localization and segment-level behavior classification within a shared representation space. The framework employs an attention residual hierarchical encoder with adaptive gating to capture long-range temporal dependencies and local transition patterns. A multi-scale window statistics module further identifies behavioral transitions by modeling contextual differences between adjacent temporal regions across multiple window sizes. Experiments conducted on tunnel traffic constructed from six tunneling technologies demonstrate improved performance of SSH-Tracker in behavior classification and boundary localization compared with the baselines.