raghava8/Network-Beconing-C2-Hunt

# 🛡️ 网络信标与 C2 检测 — 威胁狩猎     一个注重实战的威胁狩猎项目，专注于在企业网络流量日志中检测**网络信标行为 (network beaconing)** 和**命令与控制 (C2) 通信**。 ## 📌 本项目涵盖内容 | 狩猎技术 | 描述 | |---|---| | **抖动分析 (Jitter Analysis)** | 检测时间方差较小的规律性间隔回调 | | **信标周期性 (Beacon Periodicity)** | 识别每隔 N 秒/分钟进行回连的主机 | | **长连接检测 (Long Connection Detection)** | 标记 C2 典型的持续性低带宽会话 | | **域名生成算法 (DGA)** | 通过熵值和 n-gram 频率对域名进行评分 | | **DNS 隧道 (DNS Tunnelling)** | 检测异常长或异常频繁的 DNS 查询 | | **罕见域名分析 (Rare Domain Analysis)** | 识别新出现或流行度极低的外部域名 | | **User-Agent 异常** | 狩猎可疑或伪造的浏览器 User-Agent | | **JA3/JA3S 指纹识别** | 将 TLS 客户端指纹与已知的 C2 框架进行匹配 | ## 🗂️ 项目结构 ``` network-beaconing-c2-hunt/ │ ├── README.md ├── requirements.txt │ ├── data/ │ └── sample_logs/ │ ├── zeek_conn.log # Sample Zeek/Bro connection logs │ ├── zeek_dns.log # Sample DNS logs │ ├── zeek_http.log # Sample HTTP logs │ └── zeek_ssl.log # Sample TLS/SSL logs │ ├── detectors/ │ ├── beacon_detector.py # Core beaconing algorithm (MAD / std-dev scoring) │ ├── dga_detector.py # DGA detection via entropy + bigram scoring │ ├── dns_tunnel_detector.py # DNS tunnelling heuristics │ ├── long_conn_detector.py # Long-duration connection detector │ └── useragent_analyzer.py # HTTP user-agent anomaly detection │ ├── hunters/ │ ├── hunt_runner.py # Orchestrates all detectors in a single run │ └── ioc_enrichment.py # Enrich findings with IOC feed lookups │ ├── ioc_feeds/ │ ├── known_c2_domains.txt # Sample known-bad C2 domains │ ├── known_ja3_hashes.txt # Known malicious JA3 fingerprints │ └── feed_updater.py # Script to pull fresh IOC feeds │ ├── reports/ │ ├── report_generator.py # Auto-generate HTML hunt report │ └── sample_report.html # Example output report │ ├── dashboards/ │ └── beacon_dashboard.py # Interactive terminal dashboard (rich) │ ├── notebooks/ │ └── beaconing_analysis.ipynb # Jupyter walkthrough with visualisations │ ├── docs/ │ ├── hunt_methodology.md # Step-by-step hunt methodology │ ├── MITRE_mapping.md # MITRE ATT&CK technique mapping │ └── setup_zeek.md # How to set up Zeek for log collection │ └── tests/ ├── test_beacon_detector.py └── test_dga_detector.py ``` ## 🚀 快速开始 ### 1. 克隆仓库 ``` git clone https://github.com/raghava8/network-beaconing-c2-hunt.git cd network-beaconing-c2-hunt ``` ### 2. 安装依赖项 ``` pip install -r requirements.txt ``` ### 3. 针对示例日志运行全面狩猎 ``` python hunters/hunt_runner.py --log-dir data/sample_logs/ --output reports/ ``` ### 4. 运行单个检测器 ``` # 仅 Beacon 检测 python detectors/beacon_detector.py --input data/sample_logs/zeek_conn.log # 仅 DGA 检测 python detectors/dga_detector.py --input data/sample_logs/zeek_dns.log ``` ### 5. 启动仪表盘 ``` python dashboards/beacon_dashboard.py --results reports/hunt_results.json ``` ## 🔬 检测方法论 ### 信标检测算法 核心信标检测器对连接间隔使用**绝对中位差 (MAD)** 进行评分： ``` For each src_ip → dst_ip pair: 1. Extract all connection timestamps 2. Calculate delta_t between consecutive connections 3. Compute: median(delta_t) and MAD(delta_t) 4. Beacon Score = 1 - (MAD / median) [0 = random, 1 = perfect beacon] 5. Flag if score > 0.7 AND connection_count > 10 ``` 正常浏览网页的用户会产生**高度可变**的时间间隔。而每 60 秒 check in 一次的信标则会产生**极低的方差** —— 这正是我们要狩猎的目标。 ### DGA 评分 域名评分基于以下因素： - **Shannon 熵** —— 正常规域名的熵值低于算法生成的域名 - **Bigram 频率** —— DGA 域名会偏离预期的英文字母对分布规律 - **长度** —— DGA 域名通常比平均域名更长 ## 🎯 MITRE ATT&CK 覆盖范围 | 技术 ID | 技术名称 | 检测器 | |---|---|---| | T1071.001 | 应用层协议：Web 协议 | `beacon_detector.py`, `useragent_analyzer.py` | | T1071.004 | 应用层协议：DNS | `dns_tunnel_detector.py` | | T1090 | 代理 | `long_conn_detector.py` | | T1568.002 | 动态解析：DGA | `dga_detector.py` | | T1571 | 非标准端口 | `beacon_detector.py` | | T1105 | 入口工具传输 | `long_conn_detector.py` | ## 📊 狩猎输出示例 ``` [*] Hunt Run: 2024-01-15 14:32:01 [*] Log Directory: data/sample_logs/ [*] Total connections analysed: 48,291 === BEACONING DETECTIONS === [!] HIGH 192.168.1.45 → 185.220.101.12:443 Score: 0.97 Count: 288 Interval: 300s [!] HIGH 192.168.1.72 → 45.33.32.156:8080 Score: 0.91 Count: 144 Interval: 600s [!] MEDIUM 192.168.1.12 → 104.26.10.234:443 Score: 0.74 Count: 67 Interval: 900s === DGA DETECTIONS === [!] HIGH 192.168.1.45 queried: xvq7mrkp2a.com Entropy: 4.21 [!] HIGH 192.168.1.45 queried: b3kzwqr91lpx.net Entropy: 4.18 === DNS TUNNELLING === [!] HIGH 192.168.1.99 → dns.suspiciousdomain.com Avg query len: 68 chars === LONG CONNECTIONS === [!] HIGH 192.168.1.45 → 185.220.101.12:443 Duration: 14400s Bytes: 12,480 Total Findings: 3 HIGH, 1 MEDIUM Report saved: reports/hunt_2024-01-15.html ``` ## 🛠️ 环境要求 - Python 3.9+ - Zeek/Bro 网络日志（或使用内置的示例日志） - 有关 Python 依赖项，请参阅 `requirements.txt` ## 📚 学习资源 - [MITRE ATT&CK — 命令与控制](https://attack.mitre.org/tactics/TA0011/) - [Zeek 网络安全监控器](https://zeek.org/) - [狩猎信标 — ThreatHunter Playbook](https://threathunterplaybook.com/) - `docs/hunt_methodology.md` —— 本仓库中完整的方法论详解 ## 📄 许可证 MIT —— 详情请参阅 [LICENSE](LICENSE)

标签：NoSQL, 逆向工具