1. A system, comprising: one or more network taps configured to obtain a data set including times of arrival and flow identifying information for data units in a network; and a processor configured to receive the data set and further configured to: identify a plurality of flows in the data set other than a flow of interest, and for each of the plurality of other flows, identify a most recent data unit arrival event of the flow received before a data unit arrival time of a data unit associated with the flow of interest; calculate weights for each of the plurality of other flows based on respective time differences between the data unit arrival time associated with the flow of interest and the arrival time of the most recent data unit arrival event of the respective other flow; calculate probability vectors based on the weights to identify respective probabilities that the data unit associated with the flow of interest is a reaction to the most recent data unit arrival event of the respective other flow; and determine whether the flow of interest identifies a stepping stone in an attack path based in part on the probability vectors of the plurality of other flows.