Detect regular C2 beaconing

Challenge

Malware 'beacons' to its C2 on a regular interval. Given ascending connection timestamps:

int is_beaconing(const int *ts, int n, int jitter);

Return 1 if there are at least 3 timestamps, the first interval d0 = ts[1]-ts[0] is positive, and every consecutive interval is within +/- jitter of d0.

Input format

ts sorted ascending, count n, and a jitter tolerance (>=0).

Output format

1 if it looks like regular beaconing, else 0.

Constraints

n<3, non-positive d0, or negative jitter all return 0.

Starter code

#include <stddef.h>
/* ts is sorted ascending, n timestamps. Return 1 if it looks like regular beaconing:
   n>=3, first interval d0>0, and every consecutive interval is within +/-jitter of d0. */
int is_beaconing(const int *ts, int n, int jitter){ (void)ts;(void)n;(void)jitter; return 0; }

Common mistakes

Comparing each interval to the previous one instead of to d0; forgetting the n<3 guard.

Edge cases to handle

Two points aren't enough; a single out-of-tolerance gap disqualifies the whole series.

Background lessons

• Detect C2 beaconing