Add C2 beaconing detection

[Zious11]

Summary

Detect command-and-control beaconing patterns by analyzing periodic connection intervals.

Requirements

• Track connection timestamps per (src_ip, dst_ip, dst_port) tuple
• Compute inter-arrival time statistics (mean, stddev, jitter)
• Flag low-jitter periodic connections as potential beaconing (configurable thresholds)
• Score confidence based on: regularity, duration, packet count, known bad ports
• Map to MITRE ATT&CK T1071 (Application Layer Protocol) and T1573 (Encrypted Channel)

Acceptance Criteria

• Beaconing detector as a ProtocolAnalyzer or standalone analysis pass
• Tests with synthetic periodic connection patterns
• Generate findings with Verdict/Confidence scores
• Report: top beaconing candidates with interval stats

[Zious11]

Triage validation (2026-06-22) — codebase + research-agent. STILL-VALID. No beaconing detector exists; analyzers are arp/dnp3/dns/http/modbus/tls (src/analyzer/mod.rs:14-19); only a C2 ThreatCategory doc comment references beaconing. Research: RITA-style inter-arrival/jitter scoring on packet metadata is feasible and well-aligned (MITRE T1071/T1573). Caveats: (1) heavy FP control needed — NTP/DHCP/mDNS/updaters/telemetry beacon legitimately (prevalence/reputation/whitelisting); (2) simple interval-regularity is defeated by jitter (e.g. Cobalt Strike) — note FFT/Lomb-Scargle periodograms as the v2 upgrade. Scope simple jitter-stats as v1. Keep open.