// tool reference · Monitoring & Detection
AI Network Traffic Analyzer Pro
Paste connection logs to detect C2 beaconing, port scans, risky-port use, and possible exfiltration.
Open AI Network Traffic Analyzer →
What it does
Analyses connection summaries and flow records for beaconing, exfiltration shapes and anomalous destinations — the patterns that are invisible in a single connection and obvious across many.
When to use it
- You suspect C2 beaconing and need the interval regularity quantified.
- You want to spot a slow exfiltration that never trips a volume alert.
Inputs
Field names are the actual form parameters, verified against source.
| Field | Type | Required | Notes |
|---|---|---|---|
| conn_raw | textarea | required | Connection log / flow summary (Zeek conn.log, netflow summary, firewall accept log). |
What you get back
Flagged destinations with the behavioural reason, plus what to check next.
Worked example
Input
ts=10:00:03 id.orig_h=10.0.0.5 id.resp_h=198.51.100.7 id.resp_p=443 orig_bytes=1120 resp_bytes=340 ts=10:05:03 id.orig_h=10.0.0.5 id.resp_h=198.51.100.7 id.resp_p=443 orig_bytes=1118 resp_bytes=340 ts=10:10:04 id.orig_h=10.0.0.5 id.resp_h=198.51.100.7 id.resp_p=443 orig_bytes=1121 resp_bytes=338
Output (abridged)
HIGH Beaconing -- 10.0.0.5 -> 198.51.100.7:443
T1071.001 Application Layer Protocol: Web Protocols
300s +/- 0.5s interval, ~1.1KB out / ~340B in.
The RATIO matters: small constant outbound with a smaller constant
reply is a check-in/ack pattern, not data transfer.
-> Pivot: what else talks to 198.51.100.7?
-> Was there a first-seen event? That is your likely infection time.
How it works
Deterministic interval and volume statistics, then AI interpretation.
Limits
Read live from the platform configuration.
| Rate limit | 4 requests / 10 minutes |
Limitations — what it does not do
Metadata only -- it never sees payload, so it cannot confirm what was sent. It infers from rhythm, volume and ratio. Encrypted exfiltration is visible as a shape, not as content.
Privacy
Sent to the AI provider for analysis; not retained by the platform.
Standards
MITRE ATT&CK (T1071, T1041)