Standard deviation is the square root of variance. It expresses how spread out values are around their mean: a low value signals consistent timing, while a higher value signals greater variation. In network analysis, it turns repeated connection intervals into a compact measure of regularity. section 6.1.1
To hunt for beaconing, group connections by source IP, destination IP, and destination port; calculate the time between consecutive connections; then calculate standard deviation for each group. Prioritize groups with enough repeated events and low standard deviation, because their intervals are unusually consistent. section 6.1.1 section 6.1.5
A practical investigation workflow is:
- Collect timestamped network connections and retain the source address, destination address, and destination port. section 6.1.1
- Filter to connection groups with a meaningful repeat count before measuring their intervals. section 6.1.5
- Calculate consecutive time differences, standard deviation, variance, and count for every group. section 6.1.5
- Sort or filter by low standard deviation, then investigate the destination, traffic details, and processes behind the connection. section 6.1.5 section 7.1.1
Separating regular traffic from suspicious beaconing
One investigation reduced 667,827 connection records to 584 unique, high-repeat connection groups, then used low standard deviation to focus the review. Follow-up showed that some regular destinations were benign, while traffic to 34.125.188.180 included repeated /cm GET requests and /submit.php POST requests; endpoint querying identified powershell.exe connecting to that address. section 6.1.5
Listing 6.14 Calculating standard deviation, variance, and count
df['std1'] = df.groupby(['src_ip', 'dest_ip', \
'dest_port'])['time_diff_sec'].transform('std') #1
df['var1'] = df.groupby(['src_ip', 'dest_ip', \
'dest_port'])['time_diff_sec'].transform('var') #2
df['count1'] = df.groupby(['src_ip', 'dest_ip', \
'dest_port'])['time_diff_sec'].transform('count') #3
Use the grouped DataFrame calculation to attach standard deviation, variance, and event count to each connection pattern before filtering and sorting candidates. section 6.1.5
Standard deviation is a prioritization signal, not a verdict. Regular traffic can be legitimate, so validate candidates with destination context, event details, and endpoint evidence rather than relying on low variance or low standard deviation alone. section 6.1.5 section 7.1.1
