COS30015- IT Security
Assignment
Any IT graduate involved in IT security will need to be able to adapt and respond to unfamiliar and changing security threats and to evaluate and use new tools. To be capable in their profession, graduates need to be able to apply skills through design and planning, categorisation, evaluation and analyse of tools, techniques, threats and procedures.
The assignment:
Choose ONE topic only from the following study areas:
Attacker or Malware Analysis
Select one of the following topics:
1.Using scripts and web services, trace (over 50) spam e-mails to their source as best as you can, try to detect them
2.Analyse and document some malware which you have caught
These choices allow you to:
To evaluate the spam, you are required to implement a spam detection engine (either in R or Python: there are many resources and datasets on GitHub). After investigating the sources of your spam, you should outline the purpose of the spam and impact it may have. Then you should first train and test a detection model, and have it predict the emails you obtained. You should analyse and evaluate the usage and results (confusion matric metrics) from both attacker and defender perspectives, and include language, topics, spam technique (to trick the target or bypass the filter) along with visualisation.
You are to use forensic tools to analyse the malware. You can use static or dynamic tools, or a combination of both. Examples (but not limited to) of these a Cuckoo, REMnux, IDA Pro. Your evaluation should be in comparison to older versions of the malware family or against recent examples which are similar, and the challenges surrounding detection and mitigation. Examples of this evaluation could be: the change in behaviour, the means the malware obfuscates its behaviour, or how it interacts within an operating system, and thus the impact and challenges it presents. Along with your evaluation, you also need to document the justification of tools, threat definition and challenges, and analysis methodology.
