Beaconing detection via timing-based flow metadata analysis: implications for SCADA/ICS
International Journal of Information Security, cilt.25, sa.5, 2026 (SCI-Expanded, Scopus)
- Yayın Türü: Makale / Tam Makale
- Cilt numarası: 25 Sayı: 5
- Basım Tarihi: 2026
- Doi Numarası: 10.1007/s10207-026-01335-w
- Dergi Adı: International Journal of Information Security
- Derginin Tarandığı İndeksler: Science Citation Index Expanded (SCI-EXPANDED), Scopus, ABI/INFORM, Aerospace Database, Applied Science & Technology Source, Compendex, Criminal Justice Abstracts, INSPEC, Criminal Justice Periodical Index, Academic Search Ultimate (EBSCO), Social Science Premium Collection (ProQuest), Business Source Ultimate (EBSCO), Criminology Collection (ProQuest), Engineering Source (EBSCO), Pharma Collection (ProQuest), Technology Collection (ProQuest)
- Anahtar Kelimeler: Beacon detection, Command-and-control detection, Industrial control systems, Network security, SCADA security, Timing-based traffic analysis, Unsupervised anomaly detection
- Açık Arşiv Koleksiyonu: AVESİS Açık Erişim Koleksiyonu
- Gazi Üniversitesi Adresli: Evet
Özet
Supervisory Control and Data Acquisition (SCADA) and Industrial Control Systems (ICS) are critical to the continuity of modern industrial infrastructure. Cyberattacks targeting these systems can lead to serious consequences, including production losses, physical damage, and threats to human safety. In particular, detecting covert Command and Control (C2) beacon communications within encrypted network traffic poses a significant security challenge because the proposed method operates exclusively on flow-level timing metadata without payload inspection, making it inherently applicable to both plaintext and TLS-encrypted traffic. In this experimental study, a lightweight, hybrid beacon detection method is proposed that uses only connection metadata generated by Zeek, without requiring deep packet inspection or labeled datasets. The proposed approach combines Coefficient of Variation (CV)-based statistical periodicity analysis with an unsupervised anomaly detection method based on Isolation Forest to identify periodic communication patterns with low jitter that are characteristic of beacon behavior. As part of the experimental study, an isolated SCADA-like laboratory environment was provided in which web traffic mimicking human behavior and periodic beacon traffic were generated simultaneously. The hybrid detection process was applied by analyzing connection times, connection intervals, average duration, standard deviation, and periodicity metrics obtained from Zeek “conn.log” records. Additionally, the proposed method was evaluated in comparison with Long Short-Term Memory (LSTM) and Random Forest (RF) algorithms. Experimental results demonstrated that the proposed hybrid approach achieved a detection rate (recall) of 1.00 and a false positive rate of 0.056 (Precision=0.33, F1-Score=0.50) at the connection-group level, consistently ranking the true beacon first (anomaly score = 1.00) among all 37 evaluated connection groups and exhibited higher performance compared to LSTM and RF models. The findings reveal that metadata-based anomaly analysis can effectively detect beacon communications in encrypted SCADA/ICS networks without requiring content visibility. The method proposed in this study offers an effective solution for industrial network security in terms of scalability, explainability, low computational cost, and real-time applicability.