Project GhostNet: Build a Self-Contained Network Threat Detection, SIEM, and Beacon-Huntin

Project GhostNet brings together several widely used security tools to build a complete, self-contained threat detection and hunting environment inside an Ubuntu virtual machine.

The project starts by generating safe, simulated C2 beacon traffic on localhost. That traffic is captured as a PCAP using TCPDump, giving us raw network evidence that can be investigated later.

From there, Suricata analyzes the captured traffic and uses custom detection rules to identify the simulated beacon activity. Its alerts and network events are written as structured EVE JSON logs.

Those logs are then collected by Filebeat and sent to Elasticsearch, where they become centralized and searchable. Kibana sits on top of Elasticsearch and gives us an analyst-friendly interface for searching the events, investigating suspicious connections, and building visual dashboards.

Finally, a custom Python beacon detector analyzes the HTTP events from a behavioral perspective. Instead of only looking for a known URI or User-Agent, it examines repeated connection intervals and looks for low-jitter periodic communication that can resemble beaconing behavior.

The overall stack looks like this:

Ubuntu 24.04
     │
     ├── Fake C2 Server
     │       │
     │       ▼
     │   Beacon Traffic
     │       │
     │       ▼
     │     TCPDump
     │       │
     │       ▼
     │      PCAP
     │       │
     │       ▼
     │    Suricata
     │       │
     │       ▼
     │    EVE JSON
     │       │
     │       ▼
     │    Filebeat
     │       │
     │       ▼
     │  Elasticsearch
     │       │
     │       ▼
     │      Kibana
     │       │
     │       └── Threat Hunting & Dashboards
     │
     └── Python Beacon Detector

You will build a mini cyber defense lab that:

1. Simulates a malicious-looking “command-and-control” beacon safely on your own machine.
2. Captures network traffic as a PCAP file.
3. Runs Suricata IDS/IPS detection against the PCAP.
4. Ships detection logs into Elasticsearch.
5. Hunts the threat visually in Kibana.
6. Uses a custom Python beacon-detection script to find periodic beacon behavior.
7. Produces evidence, alerts, dashboards, and a mini incident report.

This project combines:

• Network security monitoring
• Intrusion detection
• SIEM
• Detection engineering
• Threat hunting
• Log analysis
• Python security analytics
• MITRE ATT&CK mapping
• Incident reporting

Important legal note:
Everything in this project must only be done on your own local lab machine or virtual machine. Do not scan, attack, monitor, or simulate malicious activity against systems you do not own or do not have written permission to test.

What Makes This Project Advanced?

This is not just “install a tool” or a “simple script.” You will combine several real-world security capabilities:

Network Detection

You will use Suricata, a real network intrusion detection engine used in enterprise security environments.

Custom Detection Rules

You will write your own Suricata rules to detect:

• A suspicious URI
• A suspicious HTTP User-Agent
• Beacon-like behavior

SIEM Integration

You will send logs into Elasticsearch and visualize them in Kibana, similar to how many SOC environments work.

Threat Hunting

You will not wait for alerts only. You will hunt for:

• HTTP requests
• Suspicious user agents
• Repeated beacon intervals
• Source and destination IPs
• URI patterns

Python-Based Behavioral Analytics

You will run a Python script that analyzes HTTP events and detects low-jitter repeated connections, which is a common sign of beaconing malware.

MITRE ATT&CK Mapping

You will map your simulated activity to MITRE ATT&CK techniques.

Final Project Outcome

By the end of this project, you will have:

• A working local cyber security detection lab.
• A simulated C2 beacon.
• A PCAP file containing network evidence.
• Suricata alerts.
• Elasticsearch indexed logs.
• Kibana dashboards and saved queries.
• A Python beacon-detection result.
• A final incident report.

This is excellent for:

• Final-year cyber security projects
• SOC analyst portfolio projects
• Detection engineering practice
• Blue team training
• Network security labs
• SIEM learning