What on This Network Is Calling Home on a Timer BEACON
Command and control is a heartbeat. Nothing a person does is regular to the second, and nothing a spreadsheet does will show you which of four thousand pairs has one.
The log
The time column takes an ISO timestamp, a date and time separated by a space, or a bare epoch in seconds or milliseconds. A connection log is a map of an entire organisation; this one is read by the browser on this device and is not sent anywhere.
What has the shape
Period is the median gap between connections. Jitter is how much the gaps vary, doubled — because an implant sleeping for a set time plus or minus a percentage produces gaps spread evenly over that range, whose median absolute deviation is exactly half the percentage. In band is the share of gaps landing close to the median. Size cv is how much the conversation size varies, where zero means every check-in is identical.
The gaps, drawn
The analysis
Questions people ask about BEACON