After reporting on the insights of a real-world research about a botnet takeover, students will learn about malicious software, with a particular glimpse at botnets and their detection to finally conlude brielfy with rootkits.<BR><BR><B>Lecture outline</B><BR>1. Should we care? A botnet takeover storytelling<BR>2. Admin blabbing<BR>3. Malicious software <BR>4. (a glimpse at)Botnets<BR>5. (a glimpse at) Botnets detection & Rootkits

Students will look at the malware landscape of the early days and what effort and challenges the AV industry was facing to fight malware threats. The lecture covers static analysis as a first technique to analyze and detect malware; (basic) assembly and reverse engineering notions are provided with a look at basic techniques to fool the state-of-the-art disassembly algorithm, quickly highlighting the limits of static analysis, especially when focused on analyzing malware. A walk-through to reverse engineer an example program concludes the lecture.<BR><BR>Given the complexity of the topic and the fact the course is a short and introductory class on a vast topic, the aim of the lecture is to provide a broad overview, with a few detailed insights wherever appropriate.<BR><BR><B>Lecture outline</b><BR><BR>1. Early days, AV industry<BR>2. (a glimpse at) Reverse engineering (part 1)<BR>3. (a glimpse at) Reverse engineering (part 2)<BR>4. (a glimpse at) Polymorphism, code obfuscation<BR>5. IDA Pro—a very simple example. . .

While looking at how the malware landscape has been evolving, students will be given an introduction at dynamic analysis, a complementary technique to static analysis to fight malware threats. Packing and algorithmic-agnostic unpacking is introduced as an initial step toward full dynamic analysis. The lecture quickly mentions sandboxes and limits of dynamic analysis and sandboxes, to finally conclude with a brief overview of a particular academic research state-of-the-art for malware protection.<BR><BR>Given the complexity of the topic and the fact the course is a short and introductory class on a vast topic, the aim of the lecture is to provide a broad overview, with a few detailed insights wherever appropriate.<BR><BR><B>Lecture outline</b><BR><BR>1. Toward dynamic analysis<BR>2. (a glimpse at) Dynamic analysis (part 1)<BR>3. (a glimpse at) Dynamic analysis (part 2)<BR>4. (a glimpse at) Limits of dynamic analysisM<BR>5. AccessMiner—system-centric models

The lecture introduces the students to mobile malware threats; in particular, the lecture focuses on Android malware, providing a quick overview of Android applications and describing a <A href= "http://copperdroid.isg.rhul.ac.uk/">virtual machine-based dynamic analysis research</a> carried out in the <a href= "http://www.isg.rhul.ac.uk/">ISG</a> at <a href= "http://www.rhul.ac.uk/">Royal Holloway University of London</a> in collaboration with the <a href= "http://security.di.unimi.it/">LaSER</a> at <a href= "http://www.unimi.it/"> University of Milan</a>.<BR><BR><B>Lecture outline</B><BR><BR>1. Introduction<BR>2. Background<BR>3. CopperDroid: dynamic analysis of Android malware (part 1)<BR>4. CopperDroid: dynamic analysis of Android malware (part 2)