About Malware and Malware Analysis
Malware, a term used to describe various types of malicious software, poses a significant threat to both personal privacy and computer security. ...
Course Description
This course aims to provide students with a comprehensive understanding of modern malware analysis techniques ...
Syllabus is now available:
[link]
Expected Background
No prerequisite for graduate students, although sufficient security background is expected. ...
- Basic programming concepts
- Knowledge with the C programming language, including pointers, arrays, loops, function calls, etc.
- Familiar with Unix/Linux including the command-line shell and gdb
- Familiar with Intel x86 assembly language and architecture
- Familiar with web programming concepts (HTML, HTTP, TCP, network communications)
Textbook
No Textbook
Reference book:
- Monnappa K A, Learning Malware Analysis: Explore the concepts, tools, and techniques ... ISBN 978-1788392501
- Michael Sikorski, Andrew Honig, Practical Malware Analysis: The Hands-On Guide to Dissecting Malicious Software, ISBN 978-1593272906
Course Content
| # | Date | Topic | Slides | Supporting Materials |
|---|---|---|---|---|
|
The password to the zip files is 'infected' (no quotes).
|
||||
| Class 1 | Jan 21, 2025 | Introduction | ch01.pdf | |
| Class 2 | Jan 23, 2025 | Basic Concepts, DLL Injection (1) | ch02.pdf | |
| Class 3 | Jan 28, 2025 | IA32 Registers & Byte Ordering | ch03.pdf | |
| Class 4 | Jan 30, 2025 | X86 ASM | ch04.pdf | |
|
Lab 1 (10 points) |
Feb 04, 2025 |
Lab1: OllyDbg and DLL Injection
Due on: 02/18/2025 23:59:59
|
lab1.pdf | |
| Class 5 | Feb 06, 2025 | Stack and Stack Frame （1） | ch05.pdf | |
| Class 6 | Feb 11, 2025 | Stack Frame (2) | ch06.pdf | |
| Lab 2 (10 points) |
Feb 13, 2025 |
Lab2: Stack, Stack Frame & CrackMe
Due on: 03/06/2025 23:59:59
|
lab2.pdf | |
| Class 7 | Feb 13, 2025 | Static Analysis & Dynamic Analysis (1) | ch07.pdf | |
| Class 8 | Feb 18, 2025 | Static Analysis & Dynamic Analysis (2): （De)Obfuscation | ch08.pdf | |
| Class 9 | Feb 20, 2025 | Windows Message Hooks | ch09.pdf |
|
| Class 10 | Feb 25, 2025 | Windows API Hooks | ch10.pdf |
|
| Class 11 | Feb 27, 2025 | PE Structure (1) | ch11.pdf | |
| Class 12 | Mar 4, 2025 | PE Structure (2) | ch12.pdf |
|
| Lab 3 (10 points) |
Mar 06, 2025 | Lab3: Build a heuristic malware detection system
Due on: 03/27/2025 23:59:59
|
lab3.pdf | |
| Class 13 | Mar 06 & 18, 2025 | Code Injection | ch13.pdf |
|
| Class 14 | Mar 25 & 27, 2025 | Worms (1 - 2): CVE-2008-4250 (MS08-067) | ch14.pdf |
|
| Class 15 | Apr 01, 2025 | Anti-virus Software, Dynamic Heuristic Analysis | ch15.pdf |
|
| Lab 4 (10 Points) |
Apr 01, 2025 | Lab 4: Build a Dynamic Heuristic Analysis Tool for Detection of Unknown Malware
Due on: 04/22/2025 23:59:59
|
lab4.pdf |
|
| Class 16 | Apr 03, 2025 | Worms (3): Conficker Worm | ch16.pdf |
|
| Class 17 | Apr 08, 2025 | Stealth process | ch17.pdf |
|
| Class 18 | Apr 10, 2025 | Kernel Rootkit (1): Introduction | ch18.pdf |
|
| Class 19 | Apr 15, 2025 | Kernel Rootkit (2): SSDT Hooking | ch19.pdf |
|
| Lab 5 (10 points) |
Apr 17, 2025 | Lab5: SSDT Hooking
Due on: 05/06/2025 23:59:59
|
lab5.pdf |
|
| Class 20 | Apr 17, 2025 | Volatility, Stuxnet | ch20.pdf |
|
| Final Project (25 Points) |
Apr 22, 2025 | Malware Analysis: Zeus
Due on: 05/10/2025 23:59:59
|
FinalProject.pdf |
|
Tutorials and Supporting Materials
Presentation Rubric (total 15%)
| Category | Percentage | Criteria |
|---|---|---|
| Content | 8% |
|
| Presentation | 5% |
|
| Q&A Session | 1% |
|
| Peer Engagement | 1% |
|