==============================================================
[1] BEACON DETECTION  (TCP SYN toi port 443, theo dich)
==============================================================
C2 candidate dst   : 10.0.0.200
so ket noi (SYN)   : 12
cac interval (s)   : [63.33, 62.98, 58.53, 61.77, 62.81, 56.14, 62.91, 57.46, 57.87, 56.58, 55.62]
interval trung binh: 59.64 s
jitter (stdev)     : 2.97 s
he so bien thien   : 0.050  -> BEACON (bien thien thap, nhip deu)

==============================================================
[2] DNS TUNNEL DETECTION  (theo domain cha)
==============================================================
domain cha                     queries  avg_len avg_entropy
t.evil-tunnel.test                   4     29.0        4.01 <== TUNNEL
www.google.com                       1      3.0        0.00
api.github.com                       1      3.0        1.58
update.microsoft.com                 1      6.0        2.58
cdn.jsdelivr.net                     1      3.0        1.58

==============================================================
[3] DECODE TUNNEL  (domain cha = t.evil-tunnel.test)
==============================================================
base32 ghep lai  : KNCVGU2JJ5HF6VCPJNCU4PJUMY4WGMTBGFRDOZJ3MNQXEZB5GQYTCMJRGEYTCMJRGEYTCMJRGE5WK6DGNFWC25TJMEWWI3TTFVWGCYTFNRZQ
secret giai ma   : SESSION_TOKEN=4f9c2a1b7e;card=4111111111111111;exfil-via-dns-labels
khop ground truth: True
