Signature-Based Detection Using Network Timing
Explores building detection signatures from network transaction timing intervals to identify malicious command-and-control communication.
Summary
Limitations of Static Network Signatures
Defenders traditionally identify malicious network traffic using byte patterns, domains, and IP reputations. However, payload encryption and dynamic infrastructure frequently render static signatures ineffective.
Timing Signatures in Packet Streams
Malware command-and-control channels exhibit distinct temporal patterns between network transactions. Measuring inter-packet timing intervals provides a robust telemetry dimension for behavioral fingerprinting.
Data Science and Python Packet Processing
Applying statistical analysis and Python packet processing pipelines to PCAP captures identifies timing signatures corresponding to known malware families and beaconing activity.
Practical Deployment in Threat Hunting
Integrating timing-based detection signatures into network monitoring tools enables security teams to detect encrypted command-and-control channels without inspecting payload content.
Related talks
Creator Stage·55 min
E Tahoun · L Hamida
Demonstrates how open-source data science models cluster heterogeneous security alerts to uncover coordinated multi-stage cyber attacks.
Main Stage·52 min
Patrick Wardle
Patrick Wardle provides an advanced guide to Apple's Endpoint Security framework, demonstrating how to build robust, kernel-level telemetry and macOS malware detection.
Creator Stage·26 min
Brandon Bailey
Applies offensive techniques from the SPARTA framework to generate behavioral indicators (IoBs) and design realistic intrusion detection systems for spacecraft.