Statistical Beacon and Jitter Analysis

The most durable C2 signal is temporal: a beacon checks in on a schedule, even with jitter, while human traffic is bursty and irregular. Statistical analysis of connection inter-arrival times, data-size consistency and periodicity exposes beacons regardless of protocol or encryption. This page covers the maths and the tooling.

Signals at a Glance

Measuring the Rhythm

Group connections by (source, destination) and analyse the series of inter-arrival deltas. A beacon with jitter still clusters tightly relative to its mean; RITA scores exactly this. A from-scratch version in KQL:

// KQL: beacon score from inter-arrival variance + size consistency
let conns = NetworkFlows
| order by SrcIp, DstIp, TimeGenerated asc
| serialize
| extend delta = datetime_diff('second', TimeGenerated, prev(TimeGenerated))
| where prev(SrcIp)==SrcIp and prev(DstIp)==DstIp;
conns
| summarize n=count(), meanDelta=avg(delta), sdDelta=stdev(delta),
            sizeModes=dcount(SentBytes)
          by SrcIp, DstIp
| where n > 20 and meanDelta > 20
| extend timeScore = 1.0 - (sdDelta / meanDelta)      // closer to 1 = tighter
| extend sizeScore = 1.0 / sizeModes                  // fewer sizes = more beacon-like
| extend beaconScore = (timeScore + sizeScore) / 2
| where beaconScore > 0.75
| order by beaconScore desc

For jitter that randomises within a window, autocorrelation or an FFT over the inter-arrival series reveals the underlying period even when raw variance looks loose — a peak at the beacon interval stands out from noise.

Operational Notes

• Allowlist legitimate periodic traffic: software update checks, telemetry, monitoring agents and NTP all beacon by design.
• Require a minimum connection count and duration so short sessions do not score.
• Rank, do not block: present the top beacon scores to an analyst with destination reputation and host context attached.
• Combine with JA3/JARM and newly-registered-domain enrichment to turn a timing lead into a confident detection.