skills.rest
KaiserWhoLearns
KaiserWhoLearnsCOMMUNITY
Explore all skills by this author →
Website𝕏@KaiserWhoLearnsGitHub

threat-detection

Detect port scans, DoS events, and beaconing using exact threshold rules.

Updated Jan 15, 2026
Search Tags:#beaconing#thresholds#port-scan#network-security#intrusion-detection#dos-detection
One-click install
npx skills add https://github.com/KaiserWhoLearns/skillsbench --skill threat-detection-kaiserwholearns
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: threat-detection
Source: https://github.com/KaiserWhoLearns/skillsbench/tree/main/tasks/dapt-intrusion-detection/environment/skills/threat-detection
Command: npx skills add https://github.com/KaiserWhoLearns/skillsbench --skill threat-detection-kaiserwholearns

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Exact detection thresholds for identifying malicious network patterns including port scans, DoS attacks, and beaconing behavior.

Core Features & Use Cases

  • Port Scan Detection: ALL THREE conditions must be true: Port Entropy > 6.0 bits, SYN-only Ratio > 0.7, Unique Ports > 100.
  • DoS Pattern Detection: DoS detected if Ratio of max to avg packets per minute > 20.
  • C2 Beaconing Detection: IAT CV < 0.5 indicates regular beaconing.
  • Benign Traffic Assessment: Benign traffic only if none of the above detections are true.

Quick Start

Configure your monitoring pipeline to apply these thresholds to traffic data and alert when all conditions are met.

Frequently Asked Questions about threat-detection

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect port scans in network traffic using exact thresholds?▼

To detect port scans, apply threshold-based rules requiring all three conditions: port entropy greater than 6.0 bits, SYN-only ratio above 0.7, and over 100 unique ports accessed.

What is the threshold for detecting DoS attacks in real-time monitoring?▼

DoS attack detection is triggered when the ratio of maximum to average packets per minute exceeds 20. This deterministic threshold can be applied directly to network traffic data.

How does C2 beaconing detection work using inter-arrival time?▼

C2 beaconing is detected by calculating the coefficient of variation for inter-arrival time (IAT). An IAT CV less than 0.5 indicates regular, automated beaconing behavior.

Can I implement these intrusion detection rules in Python for enterprise edge gateways?▼

Yes, these structured multi-condition detection thresholds are designed for implementation in Python or monitoring platforms to analyze edge gateway and internal segment traffic deterministically.

When is network traffic considered benign using threshold-based rules?▼

Network traffic is assessed as benign only when none of the specific threshold conditions for port scans, DoS patterns, or C2 beaconing are met during the monitoring period.

Related Skills

Explore More Data & Analytics Skills→
puyanguvicpuyanguvic
1

threat-detection

Detect port scans, DoS attacks, and C2 beaconing in network traffic.

Community
Advanced
zenobi-uszenobi-us
68

incident-responder

Coordinate incident response for security breaches and operational incidents.

Official
Advanced
zjunlpzjunlp
1.1k

scienceworld-threshold-evaluator

Evaluates numerical measurements against thresholds to determine binary outcomes for real-time monitoring systems.

Official
Basic
SafeAgent-BeihangSafeAgent-Beihang
50

clawguard-threat-detect

Detect and mitigate runtime threats in OpenClaw environments via real-time behavioral monitoring.

Official
Advanced