Beaconing detection via timing-based flow metadata analysis: implications for SCADA/ICS

Abstract

Supervisory Control and Data Acquisition (SCADA) and Industrial Control Systems (ICS) are critical to the continuity of modern industrial infrastructure. Cyberattacks targeting these systems can lead to serious consequences, including production losses, physical damage, and threats to human safety. In particular, detecting covert Command and Control (C2) beacon communications within encrypted network traffic poses a significant security challenge because the proposed method operates exclusively on flow-level timing metadata without payload inspection, making it inherently applicable to both plaintext and TLS-encrypted traffic. In this experimental study, a lightweight, hybrid beacon detection method is proposed that uses only connection metadata generated by Zeek, without requiring deep packet inspection or labeled datasets. The proposed approach combines Coefficient of Variation (CV)-based statistical periodicity analysis with an unsupervised anomaly detection method based on Isolation Forest to identify periodic communication patterns with low jitter that are characteristic of beacon behavior. As part of the experimental study, an isolated SCADA-like laboratory environment was provided in which web traffic mimicking human behavior and periodic beacon traffic were generated simultaneously. The hybrid detection process was applied by analyzing connection times, connection intervals, average duration, standard deviation, and periodicity metrics obtained from Zeek “conn.log” records. Additionally, the proposed method was evaluated in comparison with Long Short-Term Memory (LSTM) and Random Forest (RF) algorithms. Experimental results demonstrated that the proposed hybrid approach achieved a detection rate (recall) of 1.00 and a false positive rate of 0.056 (Precision=0.33, F1-Score=0.50) at the connection-group level, consistently ranking the true beacon first (anomaly score = 1.00) among all 37 evaluated connection groups and exhibited higher performance compared to LSTM and RF models. The findings reveal that metadata-based anomaly analysis can effectively detect beacon communications in encrypted SCADA/ICS networks without requiring content visibility. The method proposed in this study offers an effective solution for industrial network security in terms of scalability, explainability, low computational cost, and real-time applicability.