Detect a beacon by its regularity, not its content

short · 40 min · Objective 2.4

Task

Generate beacon-shaped traffic between two machines you own, then detect it from connection records alone — no payload inspection. Regularity is the signal, and this lab is what makes that concrete.

Steps

  1. On the Linux VM, start a plain listener: python3 -m http.server 8088 --bind 10.99.0.10.
  2. On the Windows VM — or a second shell on the Linux VM — run your own beacon: a loop that requests a URL every 30 seconds, with a small random jitter, for ten minutes. Write the loop yourself; it is three lines and contains nothing malicious.
  3. Alongside it, generate normal-looking traffic: a handful of bursty requests at irregular intervals.
  4. Collect connection records rather than payloads. The web server's own access log is enough: extract the timestamps for each source into /tmp/conns.txt.
  5. Write /tmp/beacon.py: read the timestamps per source, compute the intervals between consecutive connections, and report the mean and the standard deviation for each source.
  6. Rank the sources by the ratio of standard deviation to mean. The beacon is the one with the lowest ratio, and write that number into /tmp/beacon.md.

Verify

wc -l < /tmp/conns.txt
python3 /tmp/beacon.py | sort -k2 -n | head -3
python3 - <<'PY'
import subprocess
out=subprocess.run(['python3','/tmp/beacon.py'],capture_output=True,text=True).stdout
rows=[l.split() for l in out.strip().splitlines() if l.strip()]
vals=[(r[0],float(r[-1])) for r in rows]
vals.sort(key=lambda x:x[1])
print('lowest variability:',vals[0])
assert vals[0][1] < 0.5, 'no regular source found - let the loop run longer'
PY

The assertion requires a source whose interval variability is genuinely low, which is what a beacon looks like. If it fails, the loop has not run for long enough to establish the pattern — beaconing is detected over time, which is itself the lesson: a single connection tells you nothing, and thirty tell you everything.

Notes

Notice what you never looked at: the content. Everything here worked on timestamps and sources, which is why this detection survives encryption and why flow data is the primary tool for it. That is the argument the Domain 4 lesson makes for NetFlow over packet capture.

This is an independent study companion for CompTIA Security+ SY0-701 and is not produced by or endorsed by CompTIA.