Detection of beaconing behavior in the ICS environment
The following activities are aimed at uncovering beaconing traffic. To support the efforts, let's first go over what malware beaconing actually entails.
Malware beaconing explained
Beaconing behavior is quite common with malware such as botnets. The bot will periodically "phone home" to its C2 or C&C server to see whether there are any updates to the botnet code or any command the bot master want the bot to perform.
From a detection perspective, beaconing attempts look like a series of connections that initiated in a steady interval, for example every 10 minutes. The following figure shows a depiction of beaconing (shorter bars) with some feedback or response activity (following longer bars):
Figure 11.1 – Typical beaconing pattern
The trick is going to be to generate a chart that makes detection of this pattern stand out among many other connections. We are going to...
