When Agents Look Like Beacons: NIDS Evasion by Model Context Protocol Traffic

• MCP’s remote JSON-RPC requests create machine-speed bursts that can resemble C2 traffic to flow-level sensors.Source: §I · p. 1
• The study measures how existing IDS tools respond to MCP traffic because misclassification can create alert fatigue, while silent passage could leave a channel exploitable through prompt injection or tool poisoning.Source: §I · p. 1
• The research questions cover TLS visibility, Suricata alerts on legitimate MCP traffic, RITA differentiation of MCP from benign automation and simulated C2, and whether jitter or User-Agent spoofing changes sensor observations.Source: §I · p. 1

A. The Model Context Protocol (MCP)

• MCP provides a unified interface for foundation models to access external context and execute actions through a client-server architecture using JSON-RPC 2.0.HTTP uses POST requests to /mcp with structured envelopes, and multi-step reasoning can produce dozens of sequential requests.Source: A. The Model Context Protocol (MCP) · pp. 1–2

B. Threat Model

• The threat model includes compromised internal agents, malicious remote MCP servers, and benign agents mistakenly flagged as C2.The first two scenarios concern sensitive data leakage or unauthorized actions; the third risks alert fatigue.Source: B. Threat Model · p. 2
• All three scenarios depend on whether IDS tools can see MCP traffic, which the study measures across network deployment conditions.Source: B. Threat Model · p. 2

C. Deep Packet Inspection (DPI) and Suricata

• Suricata reassembles packet streams and matches them against signatures, but encrypted TLS limits payload inspection unless a middlebox performs TLS inspection.The ET Open ruleset supplies signatures targeting known malware and suspicious byte sequences.Source: C. Deep Packet Inspection (DPI) and… · p. 2

D. Temporal Beacon Analysis and RITA

• RITA analyzes Zeek flow logs for polling regularity using Bowley skewness and median absolute deviation, then normalizes results into a 0.0–1.0 beacon score.The passage states that CISA operational guidelines treat scores of at least 0.8 as actionable C2 signals.Source: D. Temporal Beacon Analysis and RITA · p. 2

E. TLS Fingerprinting (JA3 and JA4+)

• JA3 hashes fields from the unencrypted TLS ClientHello, while JA4+ sorts extensions and categorizes ALPN values for a more stable programmatic-traffic signature.Source: E. TLS Fingerprinting (JA3 and JA4+) · p. 2

A. Agent Communication Protocols and Standardization

• MCP standardizes tool invocation over JSON-RPC 2.0 on Streamable HTTP, while prior work characterizes its ecosystem and identifies network-level threat surfaces, [4], [6],.Source: A. Agent Communication Protocols and… · p. 2

B. Encrypted Traffic Classification and NTA

• Flow features such as inter-arrival gaps, session duration, and packet-size distributions support encrypted-malware classification and tracking across network boundaries,.Source: B. Encrypted Traffic Classification… · p. 2

C. C2 Detection and Temporal Beaconing Heuristics

• Cobalt Strike analyses identify inter-arrival distributions and packet counts as C2 attribution features, and Zeek with RITA operationalizes regularity scoring for low-variance polling,,,.Source: C. C2 Detection and Temporal Beaconing… · p. 2

D. Middlebox Architectures and the Base-Rate Fallacy

• TLS-inspection middleboxes intercept and re-encrypt selected traffic before passing it to a deep-packet-inspection engine.The section connects the base-rate fallacy and fragile closed-world assumptions in NIDS anomaly detection to the study’s measurement of MCP misclassification risk.Source: D. Middlebox Architectures and the… · p. 3

A. Experimental Architecture and Network Namespacing

• The Docker testbed separates traffic generation, proxy interception, and sensor observation into Linux network namespaces to prevent host-level traffic contamination.This setup is intended to correlate sensor throughput precisely with generated MCP traffic.Source: A. Experimental Architecture and… · p. 3
• The sensor stack pairs Suricata DPI with Zeek flow and TLS-fingerprint telemetry and RITA post-hoc beacon scoring.RITA scores range from 0.0 to 1.0, with scores at or above 0.8 treated as actionable C2 signals per CISA guidelines.Source: A. Experimental Architecture and… · p. 3
• Because Docker Desktop for Mac hides Linux bridge interfaces from the host, monitoring containers attach directly to the target server’s network namespace for packet capture.The setup uses Suricata, Zeek, and a tcpdump sidecar.Source: A. Experimental Architecture and… · p. 3

B. Sensor Visibility Conditions

• Opaque TLS exposes handshakes and flow metadata, TLS inspection restores cleartext HTTP for DPI, and cleartext HTTP provides a baseline for parser and rule behavior.The inspected condition uses mitmproxy, while opaque TLS represents a perimeter without decryption capability.Source: B. Sensor Visibility Conditions · p. 3

C. Traffic Profiles

• A Python traffic generator reproduces inter-arrival-time and payload-size distributions across eleven profiles spanning benign behavior, simulated malware, and MCP agent states.Mock MCP response sizes are drawn uniformly from 500 to 2000 bytes to avoid imposing an artificial size pattern.Source: C. Traffic Profiles · p. 3

D. Statistical Analysis Framework

• The 33 profile-condition combinations each ran five 60-second repetitions, with automated Python scripts extracting results from ClickHouse logs.The authors report that five repetitions establish the direction and reproducibility of binary outcomes, but acknowledge N = 5 is small for estimating continuous effect sizes.Source: D. Statistical Analysis Framework · p. 3

A. RQ1: Information Visibility under TLS Conditions

• Under opaque TLS, sensors saw TLS handshakes, IP addresses, ports, and flow metrics, while the client JA3 fingerprint had zero malicious associations in Abuse.ch SSLBL.The fingerprint identified the Python httpx client as programmatic rather than browser-originated, but carried no established threat reputation.Source: A. RQ1: Information Visibility under… · pp. 3–4
• TLS inspection exposed cleartext HTTP/1.1 and HTTP/2, including MCP JSON-RPC methods and nested parameters containing commands, queries, and file paths.The methods included initialize, tools/list, and tools/call.Source: A. RQ1: Information Visibility under… · p. 4

B. RQ2: Content-Based Detection and Signature Matching (Suricata)

• Suricata produced zero actionable alerts for MCP under opaque TLS and TLS inspection; no C2-category or data-exfiltration rule fired in any run.Under cleartext, P6 and P7 averaged 0.25 alerts per run, attributed to a missing request header rather than C2 or malware detection.Source: B. RQ2: Content-Based Detection and… · p. 4
• MCP JSON-RPC traffic lacked patterns matching existing ET Open malware signatures, leaving unauthorized tool calls and similar activity without alerts absent custom state-machine rules.The authors identify this as a detection gap despite the operational benefit of avoiding false positives.Source: B. RQ2: Content-Based Detection and… · p. 4

C. RQ3: Temporal Behavioral Evasion (Zeek and RITA)

• RITA assigned a beacon score of 0.0 to all eleven profiles across all TLS conditions, including highly periodic MCP Orchestrated P5 and synthetic C2 profiles P2 and P3.Source: C. RQ3: Temporal Behavioral Evasion… · p. 4
• MCP profiles P4 through P10 produce a genuine RITA detection gap because lognormal inter-arrival times yield high skewness and dispersion outside its periodic-malware calibration.The paper attributes P4’s lognormal timing to LLM inference latency and says high skewness and variance push normalized scores toward 0.0.Source: C. RQ3: Temporal Behavioral Evasion… · p. 5

D. RQ4: Evasion and Mitigation Techniques

• Neither Suricata nor RITA treated MCP traffic as anomalous within the testbed, and jitter or User-Agent spoofing produced no measurable change.The protocol’s default behavior already fell outside both tools’ detection scope in this configuration.Source: D. RQ4: Evasion and Mitigation… · p. 5, §VI · p. 5
• MCP’s lognormal inter-arrival distribution differs from strict periodic C2 polling, explaining why RITA’s quartile-based metrics do not flag it.Temporal smearing had no effect because the underlying distribution was already outside RITA’s detection range.Source: Figure 2 · p. 5, D. RQ4: Evasion and Mitigation… · p. 5

A. The Security Gap in Zero-Trust Agentic Workflows

• A compromised agent exfiltrating data over MCP would look identical to a benign agent at the network layer, with the tested stack producing no alert.The paper says dedicated monitoring rules are needed rather than reliance on heuristics tuned for traditional malware.Source: A. The Security Gap in Zero-Trust… · p. 5

B. Architectural Mitigations and Standards Proposals

• The proposed mitigations are an MCP-specific ALPN token and schema-aware inspection rules, with coordination between MCP maintainers and IDS vendors.ALPN could identify and policy-route agent flows without full payload decryption.Source: B. Architectural Mitigations and… · p. 5

VII. CONCLUSION

• The study measured Suricata alert rates and RITA beacon scores across eleven traffic profiles and three TLS conditions in a containerized testbed.The profiles were mathematically defined.Source: §VII · p. 5
• Default MCP tool-call patterns produced 0.0 RITA scores and near-zero Suricata alerts within the study’s scope.Broader validation across additional IDS configurations, rule sets, and real-world traffic volumes remains future work.Source: §VII · p. 5

APPENDIX

• No C2-category or data exfiltration rule IDs fired in any configuration.Alert counts are means over N = 5 runs.Source: APPENDIX · p. 6
• Table II summarizes Suricata alert counts across traffic profiles and sensor visibility conditions.The counts are means over N = 5 runs.Source: APPENDIX · p. 6, Table II · p. 6
• No C2 or malware rule IDs fired in any condition.Source: APPENDIX · p. 6