Command and Control (C2) beaconing, which provides early warning of potential cyber threats, plays a significant role in cybersecurity. However, detecting these hidden communications remains a major challenge for traditional security solutions. To address this issue, we conduct a comprehensive study of C2 beaconing detection using artificial intelligence (AI)-based solutions. We experiment with an existing traditional time series-based approach, propose a long short-term memory (LSTM) model to effectively identify periodic and anomalous communication patterns, and also experiment with transformer-based GPT models to effectively capture temporal dependencies and improve the detection accuracy. We utilize multiple publicly available intrusion detection datasets, and also tested these approaches using real-world anonymized customer data from the cybersecurity services company, achieving higher accuracy in detecting malicious beaconing devices in real-world traffic.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

C2 Beaconing Detection via AI-Based Time-Series Analysis

  • Jeetesh Gupta,
  • Jan Pfeifer,
  • Anum Talpur,
  • Mathias Fischer

摘要

Command and Control (C2) beaconing, which provides early warning of potential cyber threats, plays a significant role in cybersecurity. However, detecting these hidden communications remains a major challenge for traditional security solutions. To address this issue, we conduct a comprehensive study of C2 beaconing detection using artificial intelligence (AI)-based solutions. We experiment with an existing traditional time series-based approach, propose a long short-term memory (LSTM) model to effectively identify periodic and anomalous communication patterns, and also experiment with transformer-based GPT models to effectively capture temporal dependencies and improve the detection accuracy. We utilize multiple publicly available intrusion detection datasets, and also tested these approaches using real-world anonymized customer data from the cybersecurity services company, achieving higher accuracy in detecting malicious beaconing devices in real-world traffic.