Botnet C2 Beacon Jitter, DGA Entropy & Netstat Zombie Hunter (2026)

A naive botnet checks in with its Command-and-Control server at an exact fixed interval (for example, every 60.0 seconds), creating a trivial spike in discrete Fourier transform (DFT) or delta-variance analysis. Setting a 20% jitter instructs the implant to sleep for a uniform random duration between 48 and 72 seconds (`60 ± 20%`). However, because uniform jitter stays tightly bounded around the mean compared to Pareto-distributed human web browsing, statistical periodicity tests still expose it.

Instead of hardcoding a single C2 IP or domain that defenders can sinkhole, the malware uses a deterministic pseudo-random seed (such as the current UTC date or Bitcoin block hash) to generate thousands of candidate domains daily. The botmaster only needs to register one of those domains on the day they wish to issue commands.

Natural human language domains (like `cloud-storage-portal.com`) reuse common English vowels and bigrams (`th`, `in`, `er`, `co`), resulting in lower character randomness (Shannon entropy typically 2.5–3.4 bits/character). Pseudo-random DGA strings (`q7x9zk2m8v4p1n.biz`) distribute characters much more uniformly, pushing Shannon entropy above 3.8 bits/character with abnormal consonant clusters.

Fast-Flux DNS hides the true C2 origin server behind a revolving layer of compromised residential zombie hosts acting as reverse proxies. The botnet's authoritative DNS returns A records with ultra-short TTLs (60–180 seconds), rotating the IP address across hundreds of infected home routers every few minutes.

Dozens of outbound connections stuck in `SYN_SENT` state point to an active TCP SYN flood attack. Persistent `ESTABLISHED` connections on non-standard ports (4444, 6667, 9001) or port 443 owned by non-browser system binaries (`rundll32.exe`, `regsvr32.exe`, `wscript.exe`, `powershell.exe`) strongly indicate an active C2 beacon.