Relay pattern analysis identifies traffic that is being forwarded through one or more intermediaries rather than exchanged directly. Baseline normal relay chains, then look for repeated hand-offs, unusual hops, consistent timing signatures and sources that behave like forwarding nodes. Investigate unexpected relays because they can indicate covert routing, staging infrastructure or abuse of compromised hosts.
What relay pattern analysis should confirm first
Start by deciding whether the traffic is truly being forwarded, or whether an ordinary multi-hop path is being misread as a relay. The useful baseline is the normal chain of intermediaries for the protocol, environment, and business process, then comparing that baseline with the observed path, timing, and hop count.
A strong analysis separates expected relays from suspicious relays by looking for repeated hand-offs, stable timing signatures, and sources that behave like forwarding nodes rather than end destinations. In practice, that means comparing source, intermediary, and destination behaviour over time, not just at one moment.
How to spot suspicious relay behaviour
The most useful indicators are usually structural. Repeated hand-offs, unusual hop sequences, and relay nodes that appear across unrelated sessions are often more informative than any single packet or connection. A source that forwards traffic consistently, especially when it should not have that role, deserves closer inspection.
Timing is also a strong clue. Relay chains often leave rhythmic or highly consistent latency patterns, because the intermediary is adding an extra processing step. That can help distinguish a normal direct exchange from forwarded traffic, especially when the same pattern recurs across multiple sessions or targets.
Another useful test is whether the intermediary has a plausible operational reason to be in the path. If a host, proxy, gateway, or service is relaying traffic outside its expected role, that is a signal to validate routing, access policy, and ownership of the forwarding node.
Why relay patterns matter operationally
Unexpected relays can reveal covert routing, staging infrastructure, or abuse of compromised hosts. They may also show that an attacker is using a relay to obscure origin, blend into trusted infrastructure, or move through a path that would otherwise be blocked by direct access controls.
For analysts, the practical concern is that a relay can be both a transport mechanism and a concealment layer. If you only inspect the final destination, you may miss the node that is actually enabling the traffic flow. If you only inspect the relay node, you may miss the upstream source or the downstream target that forms part of the same chain.
Risk and Threat Considerations
Relay patterns can hide malicious traffic behind apparently legitimate intermediaries, which makes origin tracing, containment, and attribution harder. The risk increases when the relay node sits inside trusted infrastructure, because defenders may treat it as normal forwarding rather than as a sign of compromise or abuse.
Failure mechanism: Attackers or unauthorized operators abuse a forwarding node, proxy, or compromised host to create indirect paths that mask the true source, preserve access, or stage later activity.
Impact: Visibility drops, investigations take longer, and the relay can become a pivot point for covert routing, lateral movement, data movement, or repeated re-entry.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1090 — Proxy | Relay chains often indicate proxy-style intermediary routing used to hide origin. |
| Recommendation — Map suspicious forwarding nodes to proxy abuse and hunt for layered relay infrastructure. | ||
| NIST CSF 2.0 | DE.CM-01 — Monitoring for Anomalies and Events | Relay analysis depends on detecting unusual hop paths, timing signatures, and forwarding behaviour. |
| ID.RA-01 — Asset Vulnerabilities Are Identified and Documented | Unexpected relay nodes are often exposed because their role and trust assumptions were not documented. | |
| Recommendation — Monitor traffic paths for anomalous relays, repeated hand-offs, and unexpected intermediary nodes. Document expected relay paths so deviations can be triaged as potential abuse. | ||
| NIST SP 800-53 Rev 5 | AU-6 — Audit Record Review, Analysis, and Reporting | Relay pattern analysis requires reviewing logs and flow records to identify unusual intermediary behaviour. |
| Recommendation — Analyze logs and flow records to identify abnormal relay chains and repeated hop patterns. | ||
Practitioner Guidance
What to verify: Confirm whether the relay node is expected to forward traffic for that protocol, tenant, segment, or business function. If it is not, treat the node as suspicious until routing ownership, policy, and peer behaviour are explained.
Decision rule: If the same intermediary appears across multiple unrelated flows, prioritise node-level investigation over single-session triage. If the pattern is isolated and consistent with an approved relay function, focus on baseline maintenance rather than incident escalation.
What good looks like: You should be able to explain why each hop exists, which systems are allowed to relay, and what normal timing looks like for that chain. When those answers are missing, the pattern is not yet understood.
Practitioner takeaway: Treat relay analysis as a path-validation problem, not just a traffic-review exercise, because the most important signal is often the intermediary that should not have been there at all.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 18, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org