Enhancing Cybersecurity with Machine Learning - Beaconing Detection in PCAP Data - Bachelor Thesis

Aug 2, 2026

Upload by Ezra

This study enhances cybersecurity by applying machine learning to detect beaconing activity in network traffic stored as PCAP (packet capture). Beaconing is a discreet, repetitive malware communication pattern used to contact a Command and Control (C2) server, often blending into legitimate traffic and remaining hidden for long periods. A dual-model framework combines a Histogram Gradient Boosting Classifier (HGBC) for feature-based initial classification and an LSTM neural network to model temporal dependencies across consecutive packet flows. The combined approach achieves 99.37% accuracy on a tailored dataset, demonstrating strong potential for threat identification in PCAP analysis.

LanguageEnglish

CategoryResearch & Report

FormatPDF

Pages40

Reading Time1 h 41 min

AccessFree to download

Acknowledgements

Abstract

Management Summary

Overview

Objective of the Study

Key Findings

Approach

Implications and Recommendations

Enhancing Cybersecurity with Machine Learning: Beaconing Detection in PCAP Data Bachelor Thesis Department of Computer Science OST – Eastern Switzerland University of Applied Sciences Campus Rapperswil-Jona Spring Term 2024 Author Anastasiia Graftceva Advisor Nikolaus Heners External Expert Ludovico Bessi Internal Expert Stefan Kapferer Acknowledgements I would like to extend my gratitude to the following individuals for their contributions to this study: Firstly, I would like to thank Nikolaus Heners for allowing me to undertake this project, his unwavering support throughout the term, and his spot-on ideas. His belief in my abilities and selection of me for this topic, despite the competition, has been a signiﬁcant motivating factor throughout this journey. Secondly, my sincere thanks to Ludovico Bessi and Stefan Kapferer for their insightful questions, valuable inputs, and expert advice. Their critical feedback has been instrumental in reﬁning my research and improving the quality of this paper. Lastly, I am deeply grateful to my husband Marc for his constant support, cheer-ups, and motivation. His understanding and encouragement have provided me with the emotional strength and balance necessary to complete this work. Abstract This study explores the enhancement of cybersecurity through the application of machine learning techniques, speciﬁcally focusing on the detection of beaconing activity in network traﬃc (PCAP) data. PCAP, or packet capture, refers to the process of intercepting and logging traﬃc that passes over a computer network. Beaconing, a communication technique and a common indicator of malicious activity requires complex multilevel detection methods due to its discreet and repetitive nature. My approach involves the development of a dual-model framework with a combination of a Histogram Gradient Booster Classiﬁer (HGBC) and a Long Short-Term Memory (LSTM) neural network. The HGBC classiﬁes the initial features extracted from the PCAP data, while the LSTM model further reﬁnes the detection by capturing temporal dependencies between consecutive packet ﬂows. The combined model achieves an accuracy rate of 99.37%, demonstrating its eﬀectiveness in identifying beaconing patterns. This high level of accuracy illustrates the potential of a combination of machine learning and deep learning algorithms in advancing cybersecurity measures for unmasking threats in network traﬃc analysis. Management Summary Overview This study explores the application of advanced Machine Learning (ML) and Deep Learning (DL) methods for detecting malicious patterns in network captures (PCAP), focusing speciﬁcally on beaconing. Beaconing is a communication technique where malware intermittently sends signals to an external server, known as Command and Control (C2), often to receive instructions or exﬁltrate data. Detecting beaconing is challenging due to its low-frequency, regular communication patterns that blend in with legitimate traﬃc. This discreet behavior makes it a signiﬁcant threat, as the malware can remain undetected for long periods, facilitating extensive data breaches. Objective of the Study The goal of this project is to develop a dual-model framework that integrates a Histogram Gradient Boosting Classiﬁer (HGBC) and a Long Short-Term Memory (LSTM) neural network. The HGBC, an ML algorithm based on decision trees, is designed to identify presence of malicious periodic signals based on PCAP data features analysis, while the LSTM neural network detects temporal dependencies in sequential data for more accurate results. Key Findings • Model Accuracy: The dual-model framework achieves an accuracy rate of 99.37% on the tailor-made dataset • Performance: The model correctly identiﬁes beaconing patterns in ﬁles containing malicious content and accurately recognises benign ﬁles. • ML Classiﬁer Eﬃciency: The HGBC uses histograms to speed up training by considering unique values when loo

FAQs

What is beaconing and why is it hard to detect in PCAP data?

Beaconing is an intermittent malware communication pattern that signals an external Command and Control (C2) server. It is challenging because it follows low-frequency, regular behaviors that can resemble legitimate network traffic.

How does the proposed dual-model framework work?

The framework uses a Histogram Gradient Boosting Classifier (HGBC) to classify initial features extracted from PCAP-derived flow data, then an LSTM model to refine detection by capturing temporal dependencies between consecutive packet flows.

What performance results does the study report?

The combined model achieves an accuracy rate of 99.37% on a tailored dataset and correctly distinguishes beaconing patterns in malicious content from benign files.

Aug 2, 2026

Upload by Ezra