diff --git a/Thesis_Docs/Nikkhah_Nasab-Aida-Mastersthesis.pdf b/Thesis_Docs/Nikkhah_Nasab-Aida-Mastersthesis.pdf index 48d7ce8fc22e2914f4a9bcb83689ca097a43969f..08bd32a6299ff392f58260f1186e60c7308b419c 100644 Binary files a/Thesis_Docs/Nikkhah_Nasab-Aida-Mastersthesis.pdf and b/Thesis_Docs/Nikkhah_Nasab-Aida-Mastersthesis.pdf differ diff --git a/Thesis_Docs/main.tex b/Thesis_Docs/main.tex index 67cdc8a4a704e29b8aa0da7477c7978b3286bfe3..d1b595947f5ee134679fb378b5ca432571b15f66 100644 --- a/Thesis_Docs/main.tex +++ b/Thesis_Docs/main.tex @@ -668,7 +668,7 @@ This table provides an overview of beacon transmission characteristics, highligh } \end{table} -Figure \ref{fig:ABGraph} illustrates the synthetic beacon candidates with varying jitter levels. The x-axis represents the time intervals frequencies between beacon transmissions, while the y-axis shows the amplitude of the signals. The graph demonstrates how different jitter levels affect the periodicity and amplitude of beacon signals. Beacons with low jitter exhibit clear periodic patterns, making them easier to detect, while those with high jitter show more irregularity, complicating identification. The figure presents the results obtained after applying all stages of the detection algorithm to the selected beacon URLs. Each URL exhibits distinct candidate points where periodic behavior has been detected. The analysis reveals a significant variation in the number of candidate points across different beacon URLs. Specifically, some beacons, such as "beacon1.example.com" through "beacon4.example.com", exhibit only a single candidate point, indicating that their periodic signals are either weak or occur over long intervals, making them more challenging to detect. This suggests that beaconing behaviors with longer intervals are inherently more difficult to detect, as their signals appear less frequently in the analyzed data. On the other hand, the algorithm performs more effectively in detecting beacons with shorter intervals. Other beacons, such as "beacon5.example.com" and "beacon6.example.com", show a substantially stronger periodicity. +Figure \ref{fig:ABGraph} illustrates the synthetic beacon candidates with varying jitter levels. The x-axis represents the time intervals frequencies between beacon transmissions, while the y-axis shows the amplitude of the signals. The graph demonstrates how different jitter levels affect the periodicity and amplitude of beacon signals. Beacons with low jitter exhibit clear periodic patterns, making them easier to detect, while those with high jitter show more irregularity, complicating identification. The figure presents the results obtained after applying all stages of the detection algorithm to the selected beacon URLs. Each URL exhibits distinct candidate points where periodic behavior has been detected. The analysis reveals a significant variation in the number of candidate points across different beacon URLs. Specifically, some beacons, such as "beacon1.example.com" through "beacon4.example.com", doesn't have any candid in output, indicating that their periodic signals are either weak or occur over long intervals (here every 300 seconds), making them undetectable. This suggests that beaconing behaviors with longer intervals are inherently more difficult to detect, as their signals appear less frequently in the analyzed data. On the other hand, the algorithm performs more effectively in detecting beacons with shorter intervals. Other beacons, such as "beacon5.example.com" and "beacon6.example.com", show a substantially stronger periodicity. A clear example of this can be seen in "beacon7.example.com", where a detected frequency of 0.05 Hz corresponds to a periodic beaconing behavior every 20 seconds. The detection of this short-interval beacon illustrates the algorithm’s strength in identifying high-frequency periodic transmissions, as their repetition leads to more pronounced spectral features in the output. Overall, the figure demonstrates that while long-interval beacons pose detection challenges, the algorithm excels in identifying shorter-interval beacons with strong periodicity. diff --git a/Thesis_Docs/media/artificialbeacons.png b/Thesis_Docs/media/artificialbeacons.png index 8d2f3f70161bff1bfbccba5e9a57bd5ae8ec7b2f..54a76ba9f629faba87c16778836ef90218ac2438 100644 Binary files a/Thesis_Docs/media/artificialbeacons.png and b/Thesis_Docs/media/artificialbeacons.png differ diff --git a/Thesis_Docs/media/candidates.png b/Thesis_Docs/media/candidates.png index d788041af7fbd52e020b543043ffa20c661bf1bc..619cbeedb6d81d8df84d3cfcb040d92e251b75a2 100644 Binary files a/Thesis_Docs/media/candidates.png and b/Thesis_Docs/media/candidates.png differ