Malware analysisSyllabus

Subject code

İFS-2227yn

Credits

6

Student workload

60

Semester

Autumn semester

Academic year

4

Subject type

Elective

Form of education

Full-time

Language of instruction

Azerbaijani

In-class hours

a) 30 saat - mühazirə b) 15 saat - seminar c) 15saat - laboratoriya

Out-of-class hours

a) 30 saat - TSİ b) 30 saat - MRTSİ

The subject provides students with the formation of fundamental theoretical knowledge and initial practical skills on the analysis of malicious software. within the scope of the subject, the main types, goals, characteristics and mechanisms of action of malicious programs, as well as the main approaches and tools used in their analysis, are studied. the principles of determining the behavior, functionality, and possible effects on a system of virus, worm, trojan, and other malware samples are reviewed. static and dynamic analysis methods for the detection and investigation of malicious programs, the main features of these methods and their application differences are studied. in particular, the analysis of malicious windows programs, examination of the structure of executable files, methods of packaging and unpacking, as well as the analysis of malicious behavior exhibited by the program during its execution, are investigated. the subject also focuses on the principles of working with the main tools and analysis environments used in malware analysis. the subject is aimed at developing students' abilities to determine the purpose and main characteristics of a malware sample, to choose an appropriate analysis method, to interpret static and dynamic analysis results, and to evaluate malicious behavior based on the obtained results.

• lecture
• laboratory work
• presentations
• seminar
• problem-based learning
• interactive discussion

No learning outcomes have been added.

1. 1.
   An introduction to malware analysisLecture

   The topic covers the basic concepts, types and functional features of malware. basic analysis methods used to determine the behavior of malicious programs and their impact on systems are explained. attack stages and the role of malware in the attack process are reviewed. the capabilities of online analysis platforms used for initial screening of malicious files are studied. it also explains the basic principles of setting up an isolated analysis environment for safely investigating malware.

2. 2.
   Basic level static analysis – 1Lecture

   The topic covers the methods of performing preliminary static analysis of malicious programs without execution. methods of performing an antivirus scan, determining the file type, calculating hash values, and detecting lines within a file are studied. the basic structure of the portable executable (pe) format and its importance in malware analysis are explained. the role of win32 API functions in defining malware functionality is reviewed. also analyzed are the evasion techniques that malware uses to complicate analysis, such as bundling and obfuscation.

3. 3.
   Basic static analysis – 2Lecture

   The topic covers initial file scanning and identification techniques as a continuation of entry-level static analysis of malware. conducting an antivirus scan and using the results in the initial analysis process is considered. the methods of searching for malware samples on internet resources based on hash values ​​and obtaining available information about them are studied. determining the potential functionality of a program by detecting lines in executable files and examining specified information is explained. methods for specifying the compiler and packager used to generate the executable file are also reviewed.

4. 4.
   Entry level dynamic analysis – 1Lecture

   The topic covers entry-level dynamic analysis techniques based on observing the behavior of malicious programs as they are executed in a controlled environment. explains the use and key features of sandbox environments to safely analyze malware. analysis approaches used for monitoring processes, file system changes, and registry access are reviewed. methods of monitoring the network behavior of malicious programs and identifying connection attempts are studied. it also explains the working principles of dynamic libraries (dlls) and their role in the behavior of malicious programs.

5. 5.
   Analysis of windows malwareLecture

   The topic covers the analysis of the behavior and functionality of malware targeting the windows operating system. the main windows API functions that malware uses when interacting with system resources and their importance in the analysis process are explained. the role of windows registry modifications and registry accesses in determining malware behavior is reviewed. analysis of communication and data exchange activities performed using network apis is studied. based on the obtained data, attention is paid to determining the behavior of the malicious program at the system and network level.

6. 6.
   Entry level dynamic analysis – 2Lecture

   The topic covers the practical analysis of the behavior of malware samples by executing them in a controlled and isolated environment. processes, file changes, registry activity, and network connections created by various malware programs are monitored. methods of collecting behavioral indicators obtained during the analysis and determining the functionality of the malicious program are studied. behavioral characteristics of different malware samples are compared and their impact on the system is analyzed. based on the obtained results, attention is paid to determining the main indicators of pest activity.

7. 7.
   Advanced level static analysis – 1Lecture

   The topic covers the computer architecture and low-level programming concepts required for advanced static analysis of malware. the principles of processor operation, CPU registers and mechanisms of data transfer between memory and registers are explained. in assembly language, data exchange (mov, xchg), calculation (add, sub) and execution flow control (jmp, loop, call, jxx) commands are considered. basic functions of other low-level commands such as in, out, and int are also studied. the main features of the x64 architecture and the application of this knowledge in the static analysis of executable files are explained.

8. 8.
   Reverse engineeringLecture

   The subject involves analyzing the internal structure, operation logic and functionality of software without source code. the main goals, stages and application of reverse engineering in malware analysis are explained. the principles of examining the structure of executable files, program code, and control flow are reviewed. determining the behavior and hidden functionality of the program is studied using static and dynamic analysis methods. emphasis is placed on using the results obtained in the reverse engineering process to assess malware performance and security risks.

1. M. sikorski, a. honig, practical malware analysis, first edition. 2012, 802 p.(opens in a new tab)
2. K. a. monnappa, learning malware analysis, 2018, 501 p.
3. D. yurichev, reverse engineering for beginners. 2013. 1084 p.(opens in a new tab)
4. A. kleymenov, a. thabet, mastering malware analysis. packt publishing, 2nd edition, 2019, 572 p.(opens in a new tab)
5. A.p. david, ghidra software reverse engineering for beginners. packt publishing, 2021, 322 p.