// tool reference · Monitoring & Detection

Suspicious Pattern Analyzer Free + Pro

ログやペイロードを AI で採点し、シグネチャーに依存しない不審なパターンを見つけます。

What it does

Behavioural anomaly detection for activity that has no signature yet. Instead of matching known-bad, it looks for shapes that are wrong: timing regularity, entropy, sequence and volume anomalies.

When to use it

Something feels wrong but nothing matched a rule.
You suspect beaconing, living-off-the-land activity, or a novel pattern.

Inputs

Field names are the actual form parameters, verified against source.

Field	種類	Required	Notes
sample	textarea	required	The activity sample — logs, process lines, connection records.
source_type	select	任意	What the sample is, to guide parsing.
use_ai	checkbox	任意	Add AI interpretation over the deterministic findings.
authorized	checkbox	required	Confirm you are authorised to analyse this data.

What you get back

Ranked anomalies with the statistical reason each was flagged.

活用例

Input

2026-07-17T10:00:03Z host-a -> 198.51.100.7:443  bytes=1120
2026-07-17T10:05:03Z host-a -> 198.51.100.7:443  bytes=1118
2026-07-17T10:10:04Z host-a -> 198.51.100.7:443  bytes=1121
2026-07-17T10:15:03Z host-a -> 198.51.100.7:443  bytes=1119

Output (abridged)

HIGH  Beaconing -- host-a -> 198.51.100.7
      Interval: 300.3s +/- 0.5s (jitter 0.17%)
      Payload:  1,119 bytes +/- 1.5

      Human traffic is irregular. Machine traffic is not. 0.17% jitter
      over a 5-minute cycle with near-constant payload is a scheduled
      check-in, not browsing. TLS on 443 hides content, not rhythm.

  -> Identify the process owning the socket on host-a.
  -> Check 198.51.100.7 reputation and registration age.
  -> This is the shape of C2. Treat as suspected compromise.

How it works

Deterministic statistics first (entropy, interval regularity, frequency); optional AI narrative second.

Limits

Read live from the platform configuration.

Rate limit

30 requests / 60s (platform default)

Limitations — what it does なし do

It finds statistical outliers, not attribution. A backup agent and a beacon look identical to statistics -- you supply the context that separates them. Expect false positives from monitoring agents and cron.

プライバシー

Analysed in memory. Not persisted.

Standards

MITRE ATT&CKNIST CSF (DE.CM)