WP-19: Pure-Rust Socket Attribution & C2 Entropy Hunter: Driverless Process-to-Wire Forensics via Win32 FFI

Executive Abstract

Modern command-and-control (C2) frameworks and advanced persistent threats (APTs) actively bypass network security controls by blending traffic into legitimate HTTPS/TLS streams, using domain fronting, and orchestrating jittered communication cycles. Detecting these threats traditionally required intrusive network packet inspection drivers (such as Npcap or WinPcap) or heavy kernel-level network filter drivers (WFP callout drivers). These legacy solutions degrade system throughput, risk kernel crashes, and complicate endpoint deployment.

This white paper details the architecture of alaskanet, a 100% pure Rust network socket attribution and threat detection engine. We demonstrate how direct Win32 FFI bindings (GetExtendedTcpTable / GetExtendedUdpTable) achieve real-time process-to-socket attribution down to the exact executable image name and Windows Process ID (PID) without third-party drivers. Furthermore, we explore alaskanet's real-time Shannon Entropy Engine and Beacon Jitter Scoring Algorithm, which uncover encrypted C2 channels, DNS tunneling, and covert exfiltration directly from user space.

1. Process-to-Wire Attribution Without Kernel Drivers

Traditional packet analyzers inspect raw packet bytes but lack host-level context: they observe an outbound TCP connection to an external IP, but cannot determine which Windows process created it. Conversely, alaskanet establishes an immediate, direct correlation between network sockets and process lifecycles:


[ Outbound Network Traffic ] ──► [ alaskanet Win32 FFI Engine ]
                                            │
               ┌────────────────────────────┴──────────────────────────┐
               ▼                                                       ▼
  GetExtendedTcpTable() FFI                             Shannon Entropy & Jitter Engine
  • Exact PID Attribution                                • Payload Randomness H(X)
  • Executable Name (e.g. svchost.exe)                  • Inter-arrival timing variance
  • Local/Remote IP & Port Mapping                       • Detection of Covert C2 & Exfil

By querying Windows internal connection tables via safe Rust wrappers, alaskanet avoids installing network miniport or filter drivers entirely.

2. Mathematical Detection: Shannon Entropy & Timing Jitter

2.1 Shannon Entropy Calculation

Adversaries exfiltrating compressed or encrypted payloads across standard protocols (such as DNS TXT records or HTTP cookie headers) produce distinct byte distribution anomalies. alaskanet computes the Shannon Entropy H(X) over stream byte windows:

H(X) = - SUM [ P(x_i) * log2(P(x_i)) ]

Where:

P(x_i) is the probability of occurrence of byte value x_i in the payload buffer.
Payloads exhibiting H(X) >= 7.80 bits/byte are immediately flagged as cryptographically dense, identifying encrypted exfiltration or tunneling within seemingly benign protocols.

2.2 Beacon Timing Jitter Analysis

Adversarial C2 implants (such as Cobalt Strike or Mythic) employ sleep timers with artificial jitter percentages to evade static interval alarms. alaskanet tracks inter-packet delta timestamps and evaluates their coefficient of variation: CV = sigma / mu. Low variance across connection bursts indicates automated polling behavior, triggering immediate socket alerts before large-scale exfiltration can commence.

3. Integrated Threat Isolation & Stealth Administration

alaskanet does not merely observe; it equips operators with instantaneous containment capabilities:

Port Termination: Terminating rogue sockets directly through Win32 socket table manipulation.
Stealth Passkey Verification: Remote command and status monitoring is gated behind the cryptographic anvaya-admin challenge-response protocol, ensuring that local threat actors cannot discover or disable the monitoring daemon.