#!/usr/bin/env python3
"""Agent for detecting C2 beaconing through network traffic frequency analysis."""

import argparse
import json
import math
from collections import defaultdict
from datetime import datetime, timezone


def parse_zeek_conn_log(log_path):
    """Parse Zeek conn.log and extract connection timestamps per src-dst pair."""
    connections = defaultdict(list)
    try:
        with open(log_path, "r") as f:
            for line in f:
                if line.startswith("#"):
                    continue
                fields = line.strip().split("\t")
                if len(fields) < 7:
                    continue
                ts = float(fields[0])
                src, dst = fields[2], fields[4]
                dst_port = fields[5]
                key = f"{src}->{dst}:{dst_port}"
                connections[key].append(ts)
    except (FileNotFoundError, ValueError):
        pass
    return connections


def calculate_jitter(intervals):
    """Calculate jitter (standard deviation of intervals)."""
    if len(intervals) < 2:
        return 0
    mean = sum(intervals) / len(intervals)
    variance = sum((x - mean) ** 2 for x in intervals) / len(intervals)
    return math.sqrt(variance)


def detect_beaconing(connections, min_connections=10, max_jitter_percent=15):
    """Detect beaconing patterns based on interval regularity."""
    beacons = []
    for key, timestamps in connections.items():
        if len(timestamps) < min_connections:
            continue
        timestamps.sort()
        intervals = [timestamps[i+1] - timestamps[i] for i in range(len(timestamps)-1)]
        if not intervals:
            continue
        mean_interval = sum(intervals) / len(intervals)
        if mean_interval == 0:
            continue
        jitter = calculate_jitter(intervals)
        jitter_percent = (jitter / mean_interval) * 100

        if jitter_percent <= max_jitter_percent:
            parts = key.split("->")
            src = parts[0]
            dst_port = parts[1] if len(parts) > 1 else ""
            beacons.append({
                "flow": key,
                "connection_count": len(timestamps),
                "mean_interval_seconds": round(mean_interval, 2),
                "jitter_seconds": round(jitter, 2),
                "jitter_percent": round(jitter_percent, 2),
                "duration_hours": round((timestamps[-1] - timestamps[0]) / 3600, 2),
                "confidence": "HIGH" if jitter_percent < 5 else "MEDIUM",
            })
    return sorted(beacons, key=lambda x: x["jitter_percent"])


def parse_csv_log(csv_path):
    """Parse generic CSV log with timestamp, src, dst, port columns."""
    connections = defaultdict(list)
    try:
        import csv
        with open(csv_path, "r") as f:
            reader = csv.DictReader(f)
            for row in reader:
                ts = row.get("timestamp") or row.get("ts") or row.get("time")
                src = row.get("src") or row.get("source") or row.get("src_ip")
                dst = row.get("dst") or row.get("destination") or row.get("dst_ip")
                port = row.get("dst_port") or row.get("port") or ""
                if ts and src and dst:
                    try:
                        ts_float = float(ts)
                    except ValueError:
                        from datetime import datetime as dt
                        try:
                            ts_float = dt.fromisoformat(ts.replace("Z", "+00:00")).timestamp()
                        except ValueError:
                            continue
                    connections[f"{src}->{dst}:{port}"].append(ts_float)
    except (FileNotFoundError, KeyError):
        pass
    return connections


def main():
    parser = argparse.ArgumentParser(
        description="Detect C2 beaconing via frequency analysis"
    )
    parser.add_argument("--conn-log", help="Zeek conn.log path")
    parser.add_argument("--csv", help="CSV log with timestamp, src, dst columns")
    parser.add_argument("--min-connections", type=int, default=10)
    parser.add_argument("--max-jitter", type=float, default=15, help="Max jitter percent")
    parser.add_argument("--output", "-o", help="Output JSON report")
    args = parser.parse_args()

    print("[*] Beaconing Detection via Frequency Analysis")
    connections = {}

    if args.conn_log:
        connections = parse_zeek_conn_log(args.conn_log)
    elif args.csv:
        connections = parse_csv_log(args.csv)

    print(f"[*] Unique flows: {len(connections)}")
    beacons = detect_beaconing(connections, args.min_connections, args.max_jitter)

    report = {
        "timestamp": datetime.now(timezone.utc).isoformat(),
        "flows_analyzed": len(connections),
        "beacons_detected": len(beacons),
        "beacons": beacons[:50],
        "risk_level": "CRITICAL" if beacons else "LOW",
    }
    print(f"[*] Beacons detected: {len(beacons)}")

    if args.output:
        with open(args.output, "w") as f:
            json.dump(report, f, indent=2)
        print(f"[*] Report saved to {args.output}")
    else:
        print(json.dumps(report, indent=2))


if __name__ == "__main__":
    main()

#!/usr/bin/env python3
"""
Beaconing Frequency Analysis Script
Detects C2 beaconing patterns using statistical interval analysis,
jitter detection, and data size consistency scoring.
"""

import json
import csv
import argparse
import datetime
import math
from collections import defaultdict
from pathlib import Path


KNOWN_GOOD_DOMAINS = {
    "microsoft.com", "windowsupdate.com", "google.com", "googleapis.com",
    "gstatic.com", "amazonaws.com", "cloudflare.com", "akamai.net",
    "apple.com", "icloud.com", "adobe.com", "office365.com",
    "office.com", "live.com", "outlook.com", "github.com",
    "slack-edge.com", "teams.microsoft.com", "symantec.com",
    "crowdstrike.com", "sentinelone.com", "mcafee.com",
}

BEACON_THRESHOLDS = {
    "min_connections": 20,
    "max_cv": 0.25,
    "min_interval": 10,
    "max_interval": 86400,
    "max_data_cv": 0.30,
}


def parse_logs(input_path: str) -> list[dict]:
    """Parse connection logs from JSON, CSV, or Zeek format."""
    path = Path(input_path)
    events = []
    if path.suffix == ".json":
        with open(path, "r", encoding="utf-8") as f:
            data = json.load(f)
            events = data if isinstance(data, list) else data.get("events", [])
    elif path.suffix == ".csv":
        with open(path, "r", encoding="utf-8-sig") as f:
            events = [dict(row) for row in csv.DictReader(f)]
    elif path.suffix == ".log":
        with open(path, "r", encoding="utf-8") as f:
            headers = None
            for line in f:
                if line.startswith("#fields"):
                    headers = line.strip().split("\t")[1:]
                elif line.startswith("#"):
                    continue
                elif headers:
                    values = line.strip().split("\t")
                    if len(values) == len(headers):
                        events.append(dict(zip(headers, values)))
    return events


def normalize_event(event: dict) -> dict:
    """Normalize field names across different log formats."""
    field_map = {
        "timestamp": ["ts", "timestamp", "_time", "@timestamp", "Timestamp"],
        "src_ip": ["id.orig_h", "src_ip", "source_ip", "LocalIP"],
        "dst_ip": ["id.resp_h", "dst_ip", "dest_ip", "RemoteIP", "DestinationIp"],
        "domain": ["query", "domain", "host", "RemoteUrl", "server_name", "dest"],
        "bytes_sent": ["orig_bytes", "bytes_out", "SentBytes"],
        "bytes_recv": ["resp_bytes", "bytes_in", "ReceivedBytes"],
        "dst_port": ["id.resp_p", "dst_port", "dest_port", "RemotePort"],
    }
    normalized = {}
    for target, sources in field_map.items():
        for src in sources:
            if src in event and event[src] and event[src] != "-":
                normalized[target] = str(event[src])
                break
        if target not in normalized:
            normalized[target] = ""
    return normalized


def is_known_good(domain: str) -> bool:
    """Check if domain matches known-good allowlist."""
    domain_lower = domain.lower()
    return any(domain_lower.endswith(good) for good in KNOWN_GOOD_DOMAINS)


def calculate_entropy(text: str) -> float:
    """Calculate Shannon entropy of a string for DGA detection."""
    if not text:
        return 0.0
    freq = defaultdict(int)
    for char in text:
        freq[char] += 1
    length = len(text)
    return -sum((count / length) * math.log2(count / length) for count in freq.values())


def analyze_beaconing(connections: list[dict]) -> list[dict]:
    """Perform statistical frequency analysis on connection pairs."""
    pairs = defaultdict(list)
    for conn in connections:
        src = conn.get("src_ip", "")
        dst = conn.get("domain", "") or conn.get("dst_ip", "")
        if not src or not dst or is_known_good(dst):
            continue
        try:
            ts = float(conn.get("timestamp", 0))
        except (ValueError, TypeError):
            try:
                dt = datetime.datetime.fromisoformat(conn["timestamp"].replace("Z", "+00:00"))
                ts = dt.timestamp()
            except (ValueError, KeyError):
                continue
        pairs[(src, dst)].append({
            "timestamp": ts,
            "bytes_sent": int(conn.get("bytes_sent", 0) or 0),
            "bytes_recv": int(conn.get("bytes_recv", 0) or 0),
            "dst_port": conn.get("dst_port", ""),
        })

    findings = []
    for (src, dst), conns in pairs.items():
        if len(conns) < BEACON_THRESHOLDS["min_connections"]:
            continue
        conns.sort(key=lambda x: x["timestamp"])
        intervals = [conns[i]["timestamp"] - conns[i - 1]["timestamp"]
                      for i in range(1, len(conns))
                      if conns[i]["timestamp"] - conns[i - 1]["timestamp"] > 0]
        if len(intervals) < 10:
            continue

        avg_interval = sum(intervals) / len(intervals)
        if not (BEACON_THRESHOLDS["min_interval"] <= avg_interval <= BEACON_THRESHOLDS["max_interval"]):
            continue

        variance = sum((x - avg_interval) ** 2 for x in intervals) / len(intervals)
        stdev = math.sqrt(variance)
        cv = stdev / avg_interval if avg_interval > 0 else float("inf")

        if cv > BEACON_THRESHOLDS["max_cv"]:
            continue

        bytes_list = [c["bytes_sent"] for c in conns if c["bytes_sent"] > 0]
        data_cv = 0.0
        if bytes_list:
            avg_bytes = sum(bytes_list) / len(bytes_list)
            if avg_bytes > 0:
                data_var = sum((x - avg_bytes) ** 2 for x in bytes_list) / len(bytes_list)
                data_cv = math.sqrt(data_var) / avg_bytes

        risk = 0
        indicators = []
        if cv < 0.05:
            risk += 40
            indicators.append(f"Very regular interval (CV={cv:.4f})")
        elif cv < 0.15:
            risk += 30
            indicators.append(f"Regular interval (CV={cv:.4f})")
        else:
            risk += 20
            indicators.append(f"Moderately regular interval (CV={cv:.4f})")

        if data_cv < 0.10 and bytes_list:
            risk += 15
            indicators.append(f"Consistent payload size (data_CV={data_cv:.4f})")

        if len(conns) > 500:
            risk += 10
            indicators.append(f"High connection count: {len(conns)}")

        domain_parts = dst.split(".")
        if domain_parts:
            entropy = calculate_entropy(domain_parts[0])
            if entropy > 3.5:
                risk += 15
                indicators.append(f"High domain entropy: {entropy:.2f} (possible DGA)")

        risk_level = ("CRITICAL" if risk >= 70 else "HIGH" if risk >= 50
                      else "MEDIUM" if risk >= 30 else "LOW")
        jitter_pct = (stdev / avg_interval * 100) if avg_interval > 0 else 0

        findings.append({
            "src_ip": src,
            "destination": dst,
            "connection_count": len(conns),
            "avg_interval_sec": round(avg_interval, 2),
            "stdev_interval": round(stdev, 2),
            "cv": round(cv, 4),
            "jitter_pct": round(jitter_pct, 1),
            "data_size_cv": round(data_cv, 4),
            "first_seen": datetime.datetime.fromtimestamp(conns[0]["timestamp"]).isoformat(),
            "last_seen": datetime.datetime.fromtimestamp(conns[-1]["timestamp"]).isoformat(),
            "risk_score": risk,
            "risk_level": risk_level,
            "indicators": indicators,
        })

    return sorted(findings, key=lambda x: x["risk_score"], reverse=True)


def run_hunt(input_path: str, output_dir: str) -> None:
    """Execute beaconing frequency analysis hunt."""
    print(f"[*] Beaconing Frequency Analysis Hunt - {datetime.datetime.now().isoformat()}")
    connections = parse_logs(input_path)
    normalized = [normalize_event(c) for c in connections]
    print(f"[*] Loaded {len(normalized)} connections")

    findings = analyze_beaconing(normalized)
    print(f"[*] Beacon detections: {len(findings)}")

    output_path = Path(output_dir)
    output_path.mkdir(parents=True, exist_ok=True)

    with open(output_path / "beacon_findings.json", "w", encoding="utf-8") as f:
        json.dump({
            "hunt_id": f"TH-BEACON-{datetime.date.today().isoformat()}",
            "total_connections": len(normalized),
            "findings_count": len(findings),
            "findings": findings,
        }, f, indent=2)

    with open(output_path / "beacon_report.md", "w", encoding="utf-8") as f:
        f.write(f"# Beaconing Frequency Analysis Report\n\n")
        f.write(f"**Date**: {datetime.datetime.now().strftime('%Y-%m-%d %H:%M:%S')}\n")
        f.write(f"**Connections Analyzed**: {len(normalized)}\n")
        f.write(f"**Findings**: {len(findings)}\n\n")
        for bf in findings[:20]:
            f.write(f"## [{bf['risk_level']}] {bf['src_ip']} -> {bf['destination']}\n")
            f.write(f"- Interval: {bf['avg_interval_sec']}s (CV: {bf['cv']})\n")
            f.write(f"- Jitter: ~{bf['jitter_pct']}%\n")
            f.write(f"- Connections: {bf['connection_count']}\n")
            f.write(f"- Indicators: {', '.join(bf['indicators'])}\n\n")

    print(f"[+] Results written to {output_dir}")


def main():
    parser = argparse.ArgumentParser(description="Beaconing Frequency Analysis")
    parser.add_argument("--input", "-i", required=True, help="Path to connection logs")
    parser.add_argument("--output", "-o", default="./beacon_hunt_output", help="Output directory")
    args = parser.parse_args()
    run_hunt(args.input, args.output)


if __name__ == "__main__":
    main()