Jitter

As explained in Cyber Threat Hunting

Jitter is randomized variation added to an agent's sleep interval or the timing of repeated communications.

Jitter is randomized variation added to an agent’s sleep interval before repeated communication. In command-and-control beaconing, it turns a fixed callback cadence into an inconsistent one, helping activity blend in and making simple periodicity checks less reliable. section 7.1 section 7.1.5

A jittered beacon

An agent sleeping for 60 seconds with 20% jitter can select a uniformly random interval from 48 to 72 seconds before each HTTP call home. The resulting connection gaps no longer have the very low standard deviation expected from a fixed 60-second beacon. section 7.1

This variation can create a false negative when detection logic searches only for highly consistent network flows. Raising a standard-deviation threshold alone may still fail to identify the unknown activity, so timing analysis must account for noise, skew, and nonnormal distributions. section 7.1.1 section 7.1.2

Investigate suspected jittered beaconing with a timing-focused workflow:

• Group TCP and UDP events by source IP, destination IP, and destination port, then calculate the time difference between successive connections. section 7.1
• Calculate lower and upper quartiles for the connection intervals and use the interquartile range (IQR) to remove intervals outside those bounds. section 7.1.2
• Recalculate variance, standard deviation, and connection count on the retained intervals; then filter known benign destinations before prioritizing candidates. section 7.1.2
• Plot intervals over time and as histograms. A line chart may not reveal a clear pattern, while a right-skewed histogram can still show that many intervals retain some consistency. section 7.1.5

Figure 7.11 Distribution of time_diff_sec between 10.0.0.4 and 162.125.2.14 over port 443

Use the histogram to inspect the distribution of connection gaps after a time-series view fails to show an obvious recurring pattern. section 7.1.5

IQR does not prove that a flow is malicious. It narrows attention by reducing the effect of distant values before measuring remaining timing behavior, which is useful when an adversary’s jitter changes the apparent distribution of callback intervals. section 7.1.2 section 7.1.5

How Cyber Threat Hunting covers it

How deep it goes

Explains jitter through interval ranges, then operationalizes detection with IQR, statistics, filtering, plots, and histograms.

Examples

Uses 60-second sleep with 20% jitter and TCP or UDP flows grouped by source, destination, and port.

What it assumes

Builds from basic standard-deviation-based beacon detection and introduces quartiles and IQR for skewed or noisy timing data.

What you can do after

Diagnose/debug with it by adapting beaconing analysis for randomized connection intervals using IQR and distribution views.

How it connects

Connects jitter to beaconing, command-and-control, standard deviation, variance, quartiles, interquartile range, and histograms.

liveBookmanning.com

Read Cyber Threat Hunting on liveBook Get the book at manning.com

Related concepts

• exponential backoffused by · Exponential backoff is a retry strategy that progressively increases the delay between successive attempts after failures, typically by a multiplicative factor.
• retry stormaddresses · A retry storm is an overload condition caused when many clients or services simultaneously or repeatedly retry failed or slow operations, amplifying demand on a struggling system or dependency.
• uniform distributionproduces · A uniform distribution assigns equal probability to each outcome in a discrete support or constant probability density across a continuous interval.
• standard deviationproduces · Standard deviation is the nonnegative square root of variance and measures the typical dispersion of values around their mean in the original units.
• probability distributionproduces · A probability distribution is a mathematical specification assigning probabilities to the possible values or outcomes of a random variable, with total probability one.

This explainer was generated by Manning's knowledge graph from the text of Cyber Threat Hunting. The section links point to the parts of the book it draws on.