Guest Lecture 1

Question 1

Name different malware types and attack vectors

Answer 1

Spam: (testing, profilering)
Network: intrusion (spoofing)
Fraud: (forged documents )
Malicious text: (Fake news, trolling, revised messages)
Malware: (trojan, Botnet, spyware)
Authentication and Authorization attacks: (spying, keylogger credential harvesting, further attacks on same system )
Unauthorised attacks: (brute force hacker attacks)
Phishing: (automated system defence bypass)

Question 2

What is the main approach to Signature-based Detection? (Traditional Anti-virus sofware)

Answer 2

1. Collect or Capture the new malware sample (Honeypot,
   host-device etc.)
2. Analyze the sample (manual, automated, static, Dynamic,
   mixed)
3. Create singature (sequence of strings,bytes, use of wildcards
   char (*,#,) etc. Note: Yara tool, ClamAV
4. Distribute the signatures* (Central Server =⇒ clients)
5. Signature update at client machine.

Question 3

What is the main approach to Non Signature-based Detection? (Behaviroal)

Answer 3

1. Collect sample for each class (example: Malware & Benign)
2. Pre-process the sample (removing the unwanted samples, changing format etc.)
3. Feature extraction(Static, Dynamic and Hybrid), Engineering and Representation
4. Training, Testing, and Tunning the Model
   5 . Deployment of Model