« Phase 08

Lab 01 — Beacon Rhythm Analyzer

Cedar Lattice, Phase 08. The FIN-LATTICE implant running on Meridian Freight workstation mf-ws-042 is making outbound HTTPS connections. Sysmon EID 3 events have been collected into a synthetic connection list. Your job: determine whether the connection pattern constitutes beaconing, classify it, and identify any anomalous processes — all without payload inspection.

Safety. This lab analyzes synthetic NetFlow metadata only. No exploit, no shellcode, no working implant, no C2 server.

Learning Objectives

By completing this lab you can:

  1. Implement the median inter-connection gap formula and explain why median is preferred over mean for beacon interval estimation.
  2. Implement the coefficient of variation (CV) formula and explain the CV thresholds for beaconing vs interactive vs benign classification.
  3. Group connection records by process and classify each process's traffic independently.
  4. Generate Sysmon EID 3 detection strings from connection metadata.
  5. Explain why this analysis requires only NetFlow metadata — no TLS decryption needed.

Background

A C2 beacon checks in periodically with its team server. The sleep/jitter formula is:

effective_sleep = sleep_seconds × (1 ± jitter_percent/100)

With 60s sleep and 20% jitter, effective sleep is in [48s, 72s]. After collecting 10+ check-ins, the coefficient of variation (CV = stdev/mean of the inter-connection gaps) is approximately 0.12 — well below the detection threshold of 0.3.

The lab implements five functions over synthetic NetworkConnect records, each a dict with keys: timestamp (float, Unix epoch), process (str), dest_ip (str), dest_port (int), bytes_out (int).

Functions to Implement

FunctionWhat it computes
beacon_interval(connections)Median inter-connection gap in seconds
jitter_coefficient(connections)CV of inter-connection gaps
classify_rhythm(connections)'beaconing' / 'interactive' / 'benign'
anomalous_processes(connections, expected)Sorted list of beaconing processes not in expected list
detection_for_connection(conn)Sysmon EID 3 detection string

Classification Rules

ClassCondition
'beaconing'CV < 0.3 AND count >= 3 AND median gap < 3600s
'interactive'CV in [0.3, 1.0)
'benign'count < 3 OR median gap >= 3600s OR CV >= 1.0

Running the Lab

# Install dependencies
pip install pytest

# Run stubs (should fail — NotImplementedError expected)
pytest -q

# Run reference solution (should pass — 12/12 tests)
LAB_MODULE=solution pytest -q

Files

FilePurpose
lab.pyYour implementation (edit this)
solution.pyReference solution (do not read until done)
test_lab.py12 tests, imports from LAB_MODULE env var
requirements.txtpytest>=7.0

Cedar Lattice Connection

The output of this lab feeds directly into the Cedar Lattice Detection Map:

  • beacon_interval → reported as "median check-in interval" in the network findings section
  • jitter_coefficient → reported as "timing regularity (CV)" — CV < 0.3 is a finding
  • classify_rhythm → drives the detection-confidence rating (high/medium/inconclusive)
  • anomalous_processes → the list of flagged processes goes into the IOC table
  • detection_for_connection → generates the Sysmon query the SOC would have used

« Phase 08