FIELD DISPATCH — HIGH-SPEED NETWORKING & SECURITY

CipherPulse

The X-Ray Security Scanner for Encrypted Traffic That Catches Hidden Malware Without Invading Privacy

C++17 POSIX Threads Lock-Free Queue eBPF / AF_PACKET JA4+ Fingerprinting Welford CoV

GITHUB REPOSITORY

github.com/AJ1312/CipherPulse ↗
PROJECT MOTIVATION

Why I Built CipherPulse

Most of the internet's traffic is encrypted now, and newer TLS features like Encrypted Client Hello are starting to hide even the destination hostname that used to be visible during the handshake. I wanted to explore how much you can still infer about a connection — what kind of application it is, whether it's malicious — using only signals that remain visible even under full encryption: how a client negotiates its handshake, DNS lookups that precede a connection, and the shape and timing of the encrypted traffic itself. CipherPulse is a multi-threaded C++ engine built around that constraint.

REAL-WORLD USE CASE

Catching Encrypted Hacker Signals at Line-Rate Speed

Picture a network security appliance sitting at a company's edge, watching gigabit traffic in real time. Malware on an internal machine tries to phone home to its command-and-control server over a fully encrypted connection with no recognizable hostname. CipherPulse can't decrypt the traffic — it doesn't need to. It fingerprints the way the malware's TLS client negotiates its handshake and matches it against known C2 signatures, notices that the packets checked in at suspiciously regular intervals, and flags the flow as likely C2 beaconing — all while processing packets from thousands of other simultaneous connections without a single thread ever waiting on another.

SYSTEM ARCHITECTURE DIAGRAM

Lock-Free Fast-Path Traffic Inspection Pipeline

CipherPulse System Architecture Diagram
INTERACTIVE CONSOLE

Live Encrypted Traffic X-Ray Inspection Workbench

Select a network stream to observe real-time JA4+ fingerprint extraction and threat classification:

CIPHERPULSE // FORENSIC X-RAY CONSOLE ENGINE: C++17 FAST-PATH RING BUFFER
[SYSTEM READY] CipherPulse Fast-Path Workers active across CPU cores. Select a stream button above...
Timestamp Network Connection JA4+ Fingerprint Hash Traffic Rhythm Security Verdict Action Taken
18:56:01 192.168.1.45 → Google:443 t13d151600_8daaf6152702 Random human interaction timing SAFE (BENIGN) Allowed
DETAILED WALKTHROUGH

7-Stage Packet Inspection Pipeline

01 RAW Packet Ingestion

Captures raw ethernet frames directly from network sockets using eBPF or high-speed AF_PACKET for zero-copy memory speed.

Tools: eBPF / AF_PACKET, POSIX threads · Why: Captures line-rate headers directly at kernel ingress without socket buffer copy overhead.

02 Consistent 5-Tuple Hashing

Hashes the 5-tuple (source/dest IP, ports, protocol) so all packets of a single flow land on the exact same worker thread queue.

Tools: std::hash, custom ThreadSafeQueue · Why: Eliminates cross-thread locks because one thread owns a flow's lifecycle.

03 Lock-Free Fast Path Processing

Worker threads execute inside dedicated loops with isolated flow tables, enabling 100% lock-free lookups on the hot path.

Tools: C++17 STL, std::thread · Why: Eliminates mutex contention on core packet loops during high traffic bursts.

04 JA4+ Fingerprint Extraction

Parses TLS ClientHello handshakes, sorts ciphers, filters GREASE noise extensions, and hashes into a stable JA4 signature using FNV-1a.

Tools: Pure C++17, FNV-1a Hash · Why: Identifies client applications (Cobalt Strike, Sliver) even when hostname is encrypted.

05 Active DNS Correlation Cache

Maintains an in-memory cache of IP-to-domain mappings from plaintext DNS responses, automatically expiring entries via TTL timestamps.

Tools: Custom DNS Correlator · Why: Labels encrypted IP connections with human-readable domain names.

06 Welford Flow Periodicity Check

Calculates running packet inter-arrival statistics using Welford's algorithm to compute Coefficient of Variation (CoV < 0.12) for beaconing.

Tools: Welford Online Variance Engine · Why: Computes exact numerical variance in constant O(1) time per packet.

07 Structured Audit Log Output

Outputs filtered PCAPs and streams structured JSON threat alerts detailing matched JA4 signatures and recommended eBPF drop rules.

Tools: C++ File I/O, nlohmann::json · Why: Structured audit logs easily consumed by enterprise SIEM modules.

EMPIRICAL BENCHMARKS

System Performance

ZERO
Lock Contention
100% thread-isolated flow tables via deterministic 5-tuple consistent hashing.
JA4+
TLS Fingerprinting
Extracts ClientHello ciphers & extensions while filtering GREASE noise.
< 0.12
C2 Beaconing Threshold
Welford Coefficient of Variation (CoV) threshold flagging automated malware pulses.
ZERO
External Dependencies
Built in pure C++17 STL for maximum portability and zero library bloat.

*Note on throughput: CipherPulse targets fast-path lock-free design limits. Throughput figures reflect PCAP offline benchmarks and multi-thread ring queue tests, pending full hardware-in-the-loop 10GbE NIC validation.

KEY DESIGN DECISION

Lock-Free Multi-Threading via 5-Tuple Consistent Hashing

Instead of using a global shared flow table protected by slow mutex locks, CipherPulse hashes every packet's 5-tuple to pin it to a single dedicated worker CPU core. Because one worker thread owns 100% of a flow's lifecycle inside an isolated std::unordered_map, processing runs 100% lock-free with zero mutex overhead on the hot path.

Explore the Project Source Code

What I'd improve next: If I were building this for production next, I would implement AF_XDP (XDP socket) zero-copy kernel driver bindings and hardware NIC offloading to achieve line-rate 10GbE packet processing without CPU ring buffer drops.