hunting-for-beaconing-with-frequency-analysis

C2 beaconing is detected by statistically analyzing connection flows over 24 hours to identify regular intervals, applying jitter calculation and data-size consistency scoring to distinguish automated polling from legitimate traffic.

Zeek conn.log files provide the time-stamped flow data required to identify periodic beacon patterns across HTTP, DNS, and TLS protocols using statistical frequency analysis and jitter scoring.

Automated C2 traffic is distinguished from legitimate polling by calculating coefficient of variation for connection regularity, jitter, and data-size consistency to reveal covert channels hiding in standard network protocols.

Threat intelligence enrichment is optional for risk scoring, but the core detection of periodic beaconing patterns relies on basic statistical capabilities applied to time-stamped network flow data.

Frequency analysis works on DNS and TLS traffic logs by evaluating timestamped flow data to uncover periodic beacon patterns across multiple protocols within 24-hour or longer monitoring windows.

Jitter calculation limitations include requiring time-stamped flow data over 24 hours, as high jitter values can mask regular beaconing patterns if automated C2 channels intentionally randomize their connection intervals.