Detect a beacon by its regularity, not its content

short · 40 min · Objective 2.5

Task

Generate beacon-shaped traffic between two machines you own, then detect it from connection records alone -- no payload inspection. Regularity is the signal, and this lab is what makes that concrete.

Steps

  1. On the Linux VM, start a plain listener: python3 -m http.server 8088 --bind 10.99.0.10.
  2. On the Windows VM -- or a second shell on the Linux VM -- run your own beacon: a loop that requests a URL every 30 seconds, with a small random jitter, for ten minutes. Write the loop yourself; it is three lines and contains nothing malicious.
  3. Alongside it, generate normal-looking traffic: a handful of bursty requests at irregular intervals.
  4. Collect connection records rather than payloads. The web server's own access log is enough: extract the timestamps for each source into /tmp/conns.txt.
  5. Write /tmp/beacon.py: read the timestamps per source, compute the intervals between consecutive connections, and print one line per source in the form <source> <mean> <stddev> <ratio>, where ratio is the standard deviation divided by the mean. The Verify reads that last column, so the ratio must be the final field on each line.
  6. Rank the sources by that ratio. The beacon is the one with the lowest ratio, and write that number into /tmp/beacon.md.

Verify

wc -l < /tmp/conns.txt
python3 /tmp/beacon.py | sort -k4 -n | head -3
python3 - <<'PY'
import subprocess
out=subprocess.run(['python3','/tmp/beacon.py'],capture_output=True,text=True).stdout
rows=[l.split() for l in out.strip().splitlines() if l.strip()]
vals=[(r[0],float(r[-1])) for r in rows]
vals.sort(key=lambda x:x[1])
print('lowest variability:',vals[0])
assert vals[0][1] < 0.5, 'no regular source found - let the loop run longer'
PY

The assertion requires a source whose interval variability is genuinely low, which is what a beacon looks like. If it fails, the loop has not run for long enough to establish the pattern -- beaconing is detected over time, which is itself the lesson: a single connection tells you nothing, and thirty tell you everything.

Notes

Notice what you never looked at: the content. Everything here worked on timestamps and sources, which is why this detection survives encryption, and why behaviour outlasts the hashes and addresses an attacker can change in minutes. Flow records and proxy logs are the primary tools for it in a real estate.

This is an independent study companion for CompTIA Security+ SY0-801 and is not produced by or endorsed by CompTIA.