The Detection Gap in Supply Chain Security

▶ Watch (02:14)

SolarWinds dwell time exceeded a year. The affected organizations had SOC analysts, vulnerability scans, and regular pentests. None of it helped because all those controls sit before the “use” phase. Once software is deployed on user devices, almost nothing watches whether it behaves as expected. BEAM targets that gap. It monitors deployed applications’ network traffic, flags deviations from their established communication patterns, and explains what triggered the alert.

BEAM: Behavioral Profiling from 56 Billion Transactions

▶ Watch (07:24)

BEAM analyzes pcap and HAR files, attributes each HTTP transaction to a specific application, and scores it against that app’s behavioral model. It shipped today with eight pre-built models covering the most common enterprise apps Netskope sees across 2,000 customer organizations. Those models were trained on 56 billion transactions from 4.2 million devices. No learning period is required: download the repo, point it at a traffic capture, and detection starts immediately. The eight bundled models cover Spotify, Box, and six other widely deployed native clients.

Attribution and the 185-Signal Feature Set

▶ Watch (11:12)

Attribution is the first problem. BEAM reads user agent strings and maps them to app names using an embedded Llama model or an optional Gemini connector. User agents are unstructured and unstandardized, but at enterprise scale most users never modify them, so the signal holds. Once traffic is attributed, BEAM extracts 185 features per observation: request latency, inter-request timing, HTTP method sequences, URL entropy, and server response size. Each app gets its own XGBoost model trained on 500,000 observations, and SHAP values explain which features pushed a prediction toward anomalous.

Red Team Validation: Spotify as C2 Cover

▶ Watch (20:40)

The team gave internal red teamer Mohan Raj a list of the eight modeled apps and told him to compromise one, stand up a C2 server, and reveal nothing. He picked Spotify and hosted his C2 on GitHub Codespaces. To a passive observer, a Spotify user agent talking to superduper-chains.github.dev looks like a developer listening to music while coding. BEAM isolated the Spotify-attributed transactions and flagged the connection at 94% confidence. Mohan Raj ran low and slow; transaction count matched normal Spotify behavior, but client byte sizes, request timing, and the unfamiliar hostname all pushed the anomaly score up.

Live Demo, Custom Models, and Open Problems

▶ Watch (25:27)

BEAM’s demo ships in the repo. It feeds a 300-transaction HAR file into the detector, identifies seven apps, and reports a critical compromise for Box talking to dagmaui.io, with the top-five SHAP contributors printed inline. See the BEAM live demo (25:37). For apps outside the eight bundled models, an unsupervised pipeline (isolation forest, one-class SVM, autoencoder) trains a new model from any pcap or HAR file with at least 100 transactions. Browsers remain hard to profile because individual usage patterns vary too widely for a shared model.

Q&A

Could BEAM be implemented at the EDR level instead of at the network layer? Not currently integrated with any EDR, but the team is interested in consuming EDR data out of band as an additional attribution and signal source. ▶ 38:24

Could EDR telemetry keyed by process ID replace user agent string attribution? Not natively supported today, but the open-source codebase has no barrier to adding process-based signals, and ETW on Windows was suggested as a way to do this without depending on a specific EDR. ▶ 39:15

Was the traffic analyzed encrypted or plaintext? Plaintext HTTP: BEAM assumes traffic has already been decrypted (e.g., via a proxy) and takes pcap or HAR files as input; it does not decrypt traffic itself. ▶ 40:45

Notable Quotes

Is it always 10 seconds? Is it robotic Dagmawi Mulugeta · ▶ 15:32

with 94% confidence. So, we were Colin Estep · ▶ 23:35

chain compromises are too terrifying to Colin Estep · ▶ 37:09

Key Takeaways

  • BEAM detects compromised apps from network traffic alone, using 185 behavioral signals and per-app XGBoost models trained on 56 billion transactions.
  • An internal red team exercise confirmed 94% detection confidence against Spotify masking C2 traffic to GitHub Codespaces, even with low-and-slow exfiltration.
  • BEAM ships open-source with eight built-in app models and an unsupervised pipeline for adding custom models from any pcap or HAR file.