pip install -r requirements.txt

# Run on a Zeek conn.log
python beacon_hunter.py /path/to/conn.log

# Reproduce all paper results
python run_full_evaluation.py --quick    # ~2 min, skips full evidence suite
python run_full_evaluation.py           # ~5 min, full pipeline

# Run unit tests
pytest tests/

# End-to-end validation (verifies paper claims)
python validate.py

beacon_hunter_github/
├── beacon_hunter.py          # CLI detector — entry point
├── detectors.py              # Pure stateless gate functions (556 lines)
├── validate.py               # 32-check end-to-end validation
├── run_full_evaluation.py    # One-command reproduction pipeline
├── requirements.txt          # Pinned dependencies
├── evidence/
│   ├── evidence_suite.py     # All 6 evaluation batteries (Experiments A-J)
│   ├── rita_comparison.py    # RITA-style periodicity baseline + real RITA comparison
│   ├── roc_and_ci.py         # ROC curve (AUC=0.900) + Wilson CI
│   ├── generate_figures.py   # Figures 1-7 (PNG + PDF)
│   └── *.json                # Pre-computed results
├── data/
│   ├── pcaps/                # Ground-truth PCAPs (see Dataset Notes below)
│   └── zeek/                 # Zeek conn.log files
├── figures/                  # fig1-fig8 PNG + PDF (sequential)
├── paper/                    # Full paper with appendices A-G
├── reports/                  # Beacon Hunter output reports + real RITA v5.1.2 output
├── tests/
│   └── test_detectors.py     # 34 unit tests (34/34 pass)
├── tools/
│   ├── fib_beacon_client.py  # Fibonacci beacon traffic generator
│   ├── fib_beacon_server.py
│   └── uwf_to_connlog.py     # UWF-ZeekData22 parquet → Zeek conn.log converter
└── archive/                  # Deprecated scripts (legacy_detectors.py, old scanners)

# Quick verification of all paper claims:
python validate.py

# Full pipeline (generates all outputs from scratch):
python run_full_evaluation.py

# Expected: 32/32 validation checks pass, ROC AUC=0.900, jitter 20%=100% detection