Algorithmic C2 Profiling: Why Timing Audits are Dead in the Era of Persistent WebSockets

For the better part of a decade, detection engineering has relied heavily on timing-interval analysis to uncover command-and-control (C2) beaconing. The logic was straightforward: calculate the time delta between HTTPS handshakes, flag periodic connections, and alert on the automated implant.

Today, this assumption is dangerously outdated. Modern adversaries, including advanced state-nexus groups like Lazarus and SideCopy, have abandoned periodic polling in favor of persistent WebSockets, HTTP/2, and HTTP/3 streams. By maintaining a single, long-lived socket and injecting heavy, randomized jitter into their keep-alive packets, they completely nullify traditional timing audits. To expose modern C2 architectures, threat hunting must shift its focus to Algorithmic Ratio Analysis and Cryptographic Mismatches.

The Mutation: Asymmetric Transfer and Protocol Camouflage

In a persistent WebSocket session, the data transfer is fundamentally asymmetric. A typical beaconing session involves an implant sending periodic system metadata (small packets) and receiving empty acknowledgment replies. Over a 24-hour period, this creates a highly symmetric, low-volume byte profile where the bytes-sent to bytes-received ratio hovers near 1.0.

Conversely, standard user web browsing exhibits massive asymmetry. A legitimate browser downloads megabytes of rendering data while sending minimal request headers, resulting in a ratio below 0.1. When an adversary shifts from beaconing to exfiltration, this ratio abruptly flips, with bytes-sent astronomically outstripping bytes-received.

Furthermore, attackers disguise these persistent sockets by hardcoding legitimate browser User-Agent strings (e.g., mimicking Google Chrome). However, because the implant is compiled in Go, Rust, or .NET, its underlying cryptographic negotiation, the TLS Client Hello, will never match a true Chrome browser engine.

The Strategy: Ratio Thresholds and JA3/JA4 Fingerprinting

Instead of tracking timing intervals, we deploy a localized mathematical calculation at the endpoint boundary.

We define the network volume ratio, R_v, for a persistent socket as the sum of bytes sent divided by the sum of bytes received, plus a small smoothing constant epsilon to prevent division by zero.

We continuously calculate the coefficient of variation, CV, of this ratio over a rolling 12-hour window. CV is the standard deviation of R_v divided by its mean.

If an active process exhibits a consistently symmetrical ratio (R_v near 1.0) with low variance (CV below 0.15), we have isolated an automated beaconing signature, regardless of the attacker's timing jitter.

We then cross-reference this finding with TLS JA3/JA4 fingerprinting. If the process asserts a Chrome User-Agent but produces a JA3 hash corresponding to a Golang TLS library, the cryptographic camouflage is broken.

The Entity-Relationship LLM Detection Loop

We convert this telemetry into our localized Entity-Relationship (ER) Graph to leverage LLM reasoning without exposing raw packet data.

1. Entity Extraction: [Process: svchost.exe], [Network Socket: TCP/443], [Destination IP].
2. Relationship Mapping: MAINTAINS_PERSISTENT_CONNECTION_TO.
3. Statistical & Cryptographic Enrichment: [Volume Ratio R_v: 0.98], [Ratio CV: 0.04], [User-Agent: Chrome/114.0], [JA3_Mismatch: True (Golang Standard Library)].

System Prompt Directive: "You are an autonomous network threat hunter. Analyze this ER sub-graph. The process is maintaining a long-lived connection with a highly symmetric data transfer ratio (R_v = 0.98) and mathematically negligible variance. Furthermore, the cryptographic TLS handshake (JA3) contradicts the declared User-Agent. Evaluate the probability that this is a persistent WebSocket C2 implant versus a misconfigured corporate API agent. Output your confidence score and recommend an immediate socket termination protocol."

Strategic Implementation Matrix

Phase	Strategic Implementation
Preventive	Enforce zero-trust outbound network policies, dropping non-standard TLS handshakes at the perimeter gateway.
Detective	Deploy edge-level analytics to compute rolling byte-ratios (R_v) and JA3 mismatches directly on the endpoint, bypassing centralized SIEM ingestion limits.
Corrective	Automate the termination of the parent process and immediate closure of the anomalous socket when R_v symmetry aligns with a JA3 mismatch.
Compensative	Route suspicious high-ratio streams dynamically to a TLS-decryption inspection gateway for deep payload analysis.