Making Your Network Calls Look Like Telemetry

The shape of expected traffic

Telemetry has a distinctive traffic shape, and that shape is the resource being mimicked. Heartbeats go out on a schedule to a fixed endpoint; metrics are POSTed in small, regular batches; error reports arrive at known collectors; update checks hit a pinned host. The destinations are few and stable, the volumes are low and predictable, and the payloads are boring — this is traffic that monitoring systems are configured to consider normal, and that humans are trained to skip over.

Mimicry starts from that observation: if a flow looks like a heartbeat to the metrics collector, it inherits the collector's exemption from scrutiny. The mechanics are unremarkable — send to the allowed destination, on the expected schedule, with a plausible content type — and the entire art is in matching the baseline closely enough that nothing trips.

What the mimic must contend with is the resolution of the observer. A coarse monitor checks destination and port; a content-aware one inspects payloads, pins the allowed endpoints precisely, and baselines volume and timing so that "telemetry" going somewhere new, or in the wrong shape, stands out. The same traffic that is invisible to the first is an anomaly to the second.