Abstract

This research records an early ThreatFade MVP validation experiment. The experiment evaluated whether behavioural statistics could distinguish a known Merlin QUIC C2 traffic population from the clean test populations used in the experiment.

Research question

Can behavioural statistical signals help identify Merlin QUIC C2 traffic when payload inspection is limited by encrypted transport?

Context

ThreatFade was developed to investigate deliberate operational silencing and evasive beaconing behaviour in encrypted network traffic. This page preserves the historical experiment without treating it as a universal production claim.

Methodology

  • Analyse packet-level traffic from a controlled Merlin QUIC C2 capture.
  • Derive rolling entropy and behavioural z-score signals from the observed traffic characteristics.
  • Compare the resulting signal against the clean/test populations used in the MVP experiment.
  • Record the observed z-score and false-positive result with the dataset scope attached.

Dataset and environment

Dataset: A test PCAP containing 490,847 packets of real Merlin QUIC C2 traffic, together with the clean/test populations used for the reported MVP false-positive evaluation.

Environment: ThreatFade MVP research environment; packet capture analysis rather than a general enterprise production deployment.

Results

  • The reported Merlin QUIC C2 population produced a z-score of 14.76 in the experiment.
  • The reported result was 0% false positives across the tested MVP populations.
  • The dataset and result demonstrate a useful research signal, but do not establish production-wide detection performance.

Limitations

  • The experiment does not establish performance across arbitrary enterprise networks, encrypted applications, or unseen malware families.
  • The clean/test populations are not equivalent to a representative enterprise background-traffic corpus.
  • The historical result should not be interpreted as a current universal false-positive or detection-rate guarantee.
  • Further validation is required against broader, independently constructed datasets and current engine releases.

Evidence classification

This page is classified as HISTORICAL VERIFIED with evidence levels: HISTORICAL, TINLANCE-MEASURED.

The 490,847-packet, Merlin QUIC C2, z-score 14.76 and 0% false-positive figures are historical MVP experiment results scoped to the tested populations. They are not a universal production guarantee.

References