Fix false positives: high-confidence legitimate patterns no longer overridden by beacon indicators

c2sentinel.py

@@ -1711,25 +1711,32 @@ class C2Sentinel:
                     result.risk_factors.append(f"Probable C2 beacon pattern ({beacon_indicators}/5 indicators)")
 
         # ================================================================
-        # PHASE 5: Apply legitimate pattern discount (but respect strong beacon signals)
+        # PHASE 5: Apply legitimate pattern discount
+        # High-confidence legitimate patterns should NOT be overridden by beacon indicators
         # ================================================================
 
         if matched_pattern and pattern_confidence > 0.5:
-            # If strong beacon indicators present, skip or reduce the legitimate pattern discount
-            # This prevents false negatives when C2 mimics legitimate patterns
-            if beacon_indicators >= 4:
-                # Strong C2 signal - don't discount
-                result.mitigating_factors.append(f"Matches {matched_pattern.name} pattern but beacon indicators override")
+            # High-confidence legitimate patterns (> 0.75) always get full discount
+            # This prevents false positives on known good traffic
+            if pattern_confidence >= 0.75:
+                # Strong legitimate pattern match - apply full discount regardless of beacon indicators
+                discount = 1.0 - (pattern_confidence * 0.8)  # Up to 80% reduction
+                c2_prob *= discount
+                result.mitigating_factors.append(f"Strong {matched_pattern.name} pattern match (conf: {pattern_confidence:.0%})")
+                result.detection_method = DetectionMethod.WHITELIST.value
+            elif beacon_indicators >= 4 and pattern_confidence < 0.6:
+                # Strong beacon + weak pattern match - beacon wins
+                result.mitigating_factors.append(f"Weak {matched_pattern.name} match overridden by beacon indicators")
             elif beacon_indicators >= 3:
-                # Moderate C2 signal - apply reduced discount
-                discount = 1.0 - (pattern_confidence * 0.3)  # Max 30% reduction
+                # Moderate beacon + moderate pattern - apply reduced discount
+                discount = 1.0 - (pattern_confidence * 0.4)  # Max 40% reduction
                 c2_prob *= discount
-                result.mitigating_factors.append(f"Legitimate pattern match reduces probability by {(1-discount)*100:.0f}%")
+                result.mitigating_factors.append(f"{matched_pattern.name} pattern reduces probability by {(1-discount)*100:.0f}%")
             else:
-                # Weak C2 signal - apply full discount
+                # Weak/no beacon - apply full discount
                 discount = 1.0 - (pattern_confidence * 0.7)  # Up to 70% reduction
                 c2_prob *= discount
-                result.mitigating_factors.append(f"Legitimate pattern match reduces probability by {(1-discount)*100:.0f}%")
+                result.mitigating_factors.append(f"{matched_pattern.name} pattern reduces probability by {(1-discount)*100:.0f}%")
 
         # ================================================================
         # PHASE 6: Apply context inference (always check whitelist/blacklist)