Methods and systems for improving beaconing detection algorithms

An apparatus, comprising:

• a memory device;
• and
• a processor having access to the memory device, the memory device storing a series of machine-readable instructions to execute a method of detecting beaconing behavior,
• wherein the method comprises:
• receiving, as input data into a computer-implemented processing procedure using the processor, at least one listing of at least one of time series data and candidate periods of potential beaconing activity;
• processing the input data, using a processor on a computer, to detect candidates of potential beaconing activity;
• and
• improving a performance of the detecting of potential beaconing activity to at least one of eliminate false positive indications of beaconing activity and provide indication of multiple interleaved periodicities of beaconing, by further evaluating the time series data by considering the input data as data points of an analog signal in a digital domain.

A method of deploying computer resources, the method comprising provisioning a memory device in a server accessible via a network with a set of computer-readable instructions for a computer to execute a method detecting beaconing behavior, wherein the method of detecting beaconing behavior comprises:

• receiving network records for a site being evaluated beaconing behavior;
• preprocessing the network records to identify candidate source and destination pairs for detecting beaconing behavior, each source and destination pair being associated with a specific time interval in a plurality of time intervals forming a time range, the time interval and time range having been predefined;
• receiving, as input data into a computer-implemented processing procedure using a processor, at least one listing of at least one of time series data and candidate periods of potential beaconing activity;
• processing the input data, using a processor on a computer, to detect candidates of potential beaconing activity;
• improving a performance of the detecting of potential beaconing activity to at least one of eliminate false positive indications of beaconing activity and provide indication of multiple interleaved periodicities of beaconing, by further evaluating the time series data using techniques used for evaluating an analog signal by considering the input data as data points of the analog signal in a digital domain;
• and
• after the further evaluating for improving the performance, determining candidate frequencies from the source and destination pairs as likely candidate frequencies/periodicities of beaconing activities,
• wherein the further evaluating for improving the performance of the detecting comprises one or more of:
• evaluating a listing of time series for statistical characteristics and times that fall outside a pre-set statistical measurement are eliminated;
• evaluating a listing of candidate periods and the listing is eliminated if more than a pre-set number of points of the candidate periods listing are non-zero at a specific granularity as failing a Nyquist Theorem sampling requirement;
• and
• evaluating the time series data for potential multiple interleaved periods, using a Gaussian Mixture Model (GMM) analysis and as selected using a minimum Bayesian Information Criterion (BIC).