This master’s thesis proposes a systematic study of covert channel detection for modern red-teaming command-and-control (C2) frameworks — specifically analyzing beaconing and other lateral-movement activity generated by tools such as Cobalt Strike, Sliver, and comparable open- and closed-source C2s. The research will catalog common covert-channel techniques (periodic and randomized HTTP/HTTPS beacons, DNS tunneling, WebSocket/TLS encapsulation, protocol mimicry, timing and packet-size modulation, and file/metadata steganography), and reproduce them within a controlled lab environment to build a labeled corpus of benign and adversary traffic. Using this corpus, the study will evaluate detection signals across network-level (flow statistics, timing, packet sizes, protocol anomalies, JA3/SSL fingerprinting, DNS query patterns), host/endpoint telemetry (process behaviors, API usage, unusual parent-child relationships), and multi-source correlation (cross-host beacon synchronization, suspicious command patterns), comparing signature, rule-based, and machine-learning approaches.
The thesis will then quantify detection performance and resiliency by measuring precision/recall, false positive drivers, and robustness to simple evasion techniques (randomized intervals, protocol obfuscation, encrypted payload shaping). It will propose a layered detection framework combining lightweight network-flow heuristics for scalable triage, enriched telemetry collection for attribution, and adversary-aware ML models trained to prioritize explainability and provenance (linking alerts back to observable artifacts). Expected contributions include (1) an openly documented dataset of red-team C2 traces generated in a replicable lab, (2) a comparative evaluation of detection techniques against realistic evasion strategies, and (3) a practical detection architecture and operational guidance for SOCs and red teams seeking to both detect and evaluate covert C2 activity while preserving legal and ethical testing constraints.