- Most malware that abuses channels (from my experience) includes some form of randomisation in connection timing. Even something as simple as
60 minutes + rand(-5,5) can defeat timing profilers. You will also find that people have some shockingly regular patterns in their browsing habits.
- From experience, frequency analysis will produce a lot of false positives in a large enterprise. Everyone's into their own thing and interests shift. Instead, analyse the domains for "infancy". Look up when the domain was registered and look for domains less than 3 months old. Then look for domains not owned by a
* Inc. or
* Ltd. or who have a "domain privacy shield" in place. Bubble those up for further investigation.
One thing you have not mentioned is comparing the domain with blacklists from a blacklist service. I assume you thought of that, but I wanted to mention it.
Remember that it is trivial for malware authors to adjust to any detection methods that you can devise (like timing analysis). The more robust detection processes require complex statistical analysis on both the destination and the requesting node compared the node's peers and general trends in the local environment (timing, time, frequency, content, bandwidth, mismatched peer profiles (a non-peer acting like a peer)). And even then, it will require further analysis to determine the true positives.
I have developed UEBA algorithms for just this sort of thing, and once you start, you will find yourself down a bit of a rabbit hole ("maybe I can tweak it this way and get better efficiency!"). For 80% effectiveness, focus on the "infancy" analysis that I mentioned above.