Course Description
This unit equips learners with the skills and knowledge to analyse and respond to malware threats. Students will learn about the different types of malware that exist and how they spread, including viruses, worms, ransomware, and trojans. They will learn how to detect, analyse, and mitigate malware, gaining practical experience in identifying malware and analysing malicious executables through static analysis, dynamic analysis, and reverse engineering. Challenges concerning identification and analysis of malware are also introduced.
Course Objectives
This unit equips learners with the skills and knowledge to analyse and respond to malware threats. Students will learn about the different types of malware that exist and how they spread, including viruses, worms, ransomware, and trojans. They will learn how to detect, analyse, and mitigate malware, gaining practical experience in identifying malware and analysing malicious executables through static analysis, dynamic analysis, and reverse engineering. Challenges concerning identification and analysis of malware are also introduced.
Key Topics
- LO1: Understand the different types of malware that exist and how they spread.
- LO2: Understand how to detect malware and describe the challenges of doing so.
- LO3: Be able to perform malware analysis to identify and understand the function of malware.
- LO4: Understand strategies to protect from malware and recover from attacks.
Course Outline
| Week | Topics |
|---|
| 1 | Types of malware: viruses, worms, ransomware, trojans, spyware, adware, rootkits, keyloggers, botnets and backdoors |
| 2 | Infection methods (phishing, malicious attachments, drive-by downloads, software vulnerabilities, removable media) and malware motives: financial gain, espionage, sabotage, hacktivism |
| 3 | Malware identification: signature-based, heuristic and behaviour-based detection |
| 4 | Challenges in detection: obfuscation, packing, polymorphic and metamorphic malware, rootkits |
| 5 | Principles of malware analysis: x86 architecture and assembly, Windows internals, PE and ELF formats |
| 6 | Static analysis lab: reviewing PE headers, strings and imports of suspicious executables |
| 7 | Dynamic analysis lab: running samples in a sandboxed VM and debugging with OllyDbg |
| Midterm | Midterm evaluation |
| 9 | Reverse engineering lab: disassembly with IDA Free/Pro and Ghidra |
| 10 | Protection and recovery: firewalls, antivirus, IDS/IPS, endpoint protection |
| 11 | Containment (segmentation, access control, patch management, awareness training) and case studies: WannaCry, CryptoLocker, Emotet, Stuxnet |
| 12 | Applying Malware Analysis in practice: case studies |
| 13 | Assignment workshop: research, planning and referencing |
| 14 | Assignment workshop: drafting, feedback and improvement |
| 15 | Review and coursework completion |
| Final | Final assessment and submission |
Learning Outcomes
- LO1 Understand the different types of malware that exist and how they spread.
- 1.1 Identify the different kinds of malware.
- 1.2 Describe the different kinds of malware.
- 1.3 Analyse how malware can infect systems and spread across networks.
- 1.4 Evaluate the motives for the creation of malware.
- LO2 Understand how to detect malware and describe the challenges of doing so.
- 2.1 Explain the techniques used to identify malware.
- 2.2 Explain the characteristics of packed executables.
- 2.3 Critically analyse the challenges of detecting and analysing malware.
- 2.4 Evaluate the most effective methods of detecting malware.
- LO3 Be able to perform malware analysis to identify and understand the function of malware.
- 3.1 Explain the principles of malware analysis.
- 3.2 Explain the importance of sandboxing to analyse malware behaviour.
- 3.3 Implement malware analysis tools to perform static and dynamic analysis of suspicious executables.
- 3.4 Use tools to perform reverse engineering of malware.
- LO4 Understand strategies to protect from malware and recover from attacks.
- 4.1 Describe the most common techniques used to protect systems from malware infections.
- 4.2 Use recovery tools and techniques to restore systems compromised by malware.
- 4.3 Critically analyse the effectiveness of response strategies in real-world case studies.
- 4.4 Evaluate different methods of containing the spread of malware across networks of computers.
