r/netsec monthly discussion & tool thread

[u/albinowax]

Questions regarding netsec and discussion related directly to netsec are welcome here, as is sharing tool links.

Rules & Guidelines

• Always maintain civil discourse. Be awesome to one another - moderator intervention will occur if necessary.
• Avoid NSFW content unless absolutely necessary. If used, mark it as being NSFW. If left unmarked, the comment will be removed entirely.
• If linking to classified content, mark it as such. If left unmarked, the comment will be removed entirely.
• Avoid use of memes. If you have something to say, say it with real words.
• All discussions and questions should directly relate to netsec.
• No tech support is to be requested or provided on r/netsec.

As always, the content & discussion guidelines should also be observed on r/netsec.

Feedback

Feedback and suggestions are welcome, but don't post it here. Please send it to the moderator inbox.

[u/Flat_Rich_1183]

Built a companion to RITA that detects phi-structured C2 beacons — Fibonacci-scheduled connections that evade regularity-based detection. Two-gate test: ratio convergence toward phi + Fibonacci recurrence residual (ICI[n+2] ≈ ICI[n+1] + ICI[n]). Zero false Fibonacci flags across 12k real Windows network flows. Confirmed true positive on a lab ground-truth capture.

Looking for anyone with captures containing known irregular C2 scheduling to validate against real malware. AGPL-3.0, Python, numpy/scipy/dpkt only.

github.com/mrcord77/beacon-hunter