C2 Beaconing Detection via AI-Based Time-Series Analysis
摘要
Command and Control (C2) beaconing, which provides early warning of potential cyber threats, plays a significant role in cybersecurity. However, detecting these hidden communications remains a major challenge for traditional security solutions. To address this issue, we conduct a comprehensive study of C2 beaconing detection using artificial intelligence (AI)-based solutions. We experiment with an existing traditional time series-based approach, propose a long short-term memory (LSTM) model to effectively identify periodic and anomalous communication patterns, and also experiment with transformer-based GPT models to effectively capture temporal dependencies and improve the detection accuracy. We utilize multiple publicly available intrusion detection datasets, and also tested these approaches using real-world anonymized customer data from the cybersecurity services company, achieving higher accuracy in detecting malicious beaconing devices in real-world traffic.