CSC 497/583 Advanced Topics in Computer Security
Modern Malware Analysis
2020-Spring Course Website
Instructor: Si Chen
About Maleware and Malware Analysis
Malware is a catch-all term for various malicious software, including viruses, adware, spyware, browser hijacking software, and fake security software.Once installed on your computer, these programs can seriously affect your privacy and your computer's security. For example, malware is known for relaying personal information to advertisers and other third parties without user consent. Some programs are also known for containing worms and viruses that cause a great deal of damage. As a result, the ability to detect, analyze, understand, control, and eradicate malware is an increasingly important issue of economic and national security.
Course Description
This course will introduce students to modern malware analysis techniques through lectures and hands-on interactive analysis of real-world samples, including explore various recent attacks. These examples and studies will help the students develop a foundation and a well-rounded view of cybersecurity research. Participants in the course will also read and discuss research papers, as well as conduct independent project in a topic related to cyber risk and malware analysis.After taking this course students will be equipped with the skills to analyze advanced contemporary malware using both static and dynamic analysis.
Syllabus is now available: [link]
Expected Background
No prerequisite for graduate students, although sufficient security background is expected. For undergraduate students, please make sure you completed CSC 242.My expected demographic for Malware Analysis was students with zero reverse engineering experience. That said, to be able to take this course you will probably need at least the following skills.
- Basic programming concepts
- Knowledge with the C programming language, including pointers, arrays, loops, function calls, etc.
- Familiar with Unix/Linux including the command-line shell and gdb
- Familiar with Intel x86 assembly language and architecture
- Familiar with web programming concepts (HTML, HTTP, TCP, network communications)
Textbook
No Textbook
Reference book:
- Monnappa K A, Learning Malware Analysis: Explore the concepts, tools, and techniques to analyze and investigate Windows malware , ISBN 978-1788392501
- Michael Sikorski, Andrew Honig, Practical Malware Analysis: The Hands-On Guide to Dissecting Malicious Software, 1st Edition, ISBN 978-1593272906
Course Content
| # | Date | Topic | Slides | Supporting Materials |
|---|---|---|---|---|
| Class 1 | Jan 27, 2020 | Introduction | ch01.pptx | |
| Class 2 | Jan 27, 2020 | Basic Concepts, DLL Injection (1) | ch02.pptx |
|
| Class 3 | Feb 03, 2020 | DLL Injection (2), Static Analysis, PE Format | ch03.pptx |
|
| Lab 0 (Non-graded) |
Feb 03, 2020 | Lab0: "Hello World" -- DLL Injection
Hint for Lab0: [Hint]
Due on: 02/10/2020
|
lab0.pdf |
|
| Class 4 | Feb 17, 2020 | PE Format (1), Static Analysis: Real-world Case Study | ch04.pptx |
|
| Lab 1 (10 points) |
Feb 17, 2020 | Lab1: Build a heuristic malware detection system
Hint for Lab1: [Hint]
Due on: 04/06/2020 23:59:59
|
lab1.pdf |
|
| Class 5 | Feb 24, 2020 | Assembly and disassembly primer, PE Format (2): IAT, EAT | ch05.pptx |
|
| R1 (6 points) |
March 6, 2020 | Reading Question 1
Due on: 04/06/2020 23:59:59
|
ReadingQuestion.pdf | |
| Class 6 | Mar 30, 2020 | Stack and Stack Frames [Video] | ch06.pptx | Stack.exe stack.py StackFrame.exe StackFrame.cpp HelloWorld.exe |
| Lab 2 (10 points) |
Mar 30, 2020 | Lab2: Stack and Stack Frame in Linux
Due on: 04/20/2020 23:59:59
|
lab2.pdf |
|
| Class 7 | April 6, 2020 | Lab 2 Hint, Stack Frame (Review), Dynamic Analysis [Video] | ch07.pptx | StackFrame.exe StackFrame.cpp hack_dll.zip |
| Class 8 | April 13, 2020 | Hooks [Video] | ch08.pptx |
|
| Lab 3 (10 Points) |
April 13, 2020 | Lab 3: Build a Dynamic Heuristic Analysis Tool for Detection of Unknown Malware
Due on: 04/27/2020 23:59:59
|
lab3.pdf |
|
| Class 9 | April 20, 2020 | IAT, IAT Hooks, Anti-virus Software, Dynamic Heuristic Analysis [Video] | ch09.pptx |
|
| Class 10 | May 4, 2020 | API Hook, Stealth process (Rootkit), Kernel Mode Rootkit | ch10.pptx |
|
| Lab 4 (Optional) |
May 4, 2020 | Lab 4: Stuxnet
Due on: 05/10/2020 23:59:59
|
lab4.pdf |