Cybersecurity

DANIELE CONO D'ELIA
LEONARDO QUERZONI

Today's cyber security scenario shows a relentless growth of malicious software used to perpetrate cyber attacks. This course aims to provide students with the knowledge, methods and basic tools to analyze, identify, categorize and understand the behavior of different classes of malicious software. The course will adopt a practical approach, with frequent application of the learned methods to real-world cases.

Expected learning results
Students will be able to analyze, both manually and through the use of automated tools, malicious software of different nature to identify all its salient features. They will be able to extract these characteristics and relate them with existing knowledge bases. Finally, students will be able to contextualize these activities as part of an overall process of threat intelligence and incident management caused by such malicious software.

By the end of the course, students will be able to:

Knowledge and understanding: describe the main characteristics, techniques, and functionalities of malicious software, as well as the basic concepts of threat models, attack kill chains, threat intelligence, and digital forensics.

Applying knowledge and understanding: perform static and dynamic analysis of different types of malicious software, using both manual techniques and automated tools, to identify their key characteristics, including packing, code injection, and anti-analysis techniques.

Making judgments: critically interpret the results of analysis and reverse-engineering activities, correlate them with existing knowledge bases, and assess their relevance in the context of a cybersecurity incident.

Communication skills: document and present analysis results in a structured technical report consistent with professional malware analysis practices.

Learning skills: independently explore analysis methods and tools and apply them to more complex samples, placing the results in the broader context of threat intelligence and incident response.

Fundamental knowledge:
- C programming
- Develop/compile/link software cycle
- Computer architectures

Useful knowledge:
- ASM x86

The course provides an introduction to cybersecurity and the fundamental techniques used in malware analysis and reverse engineering. Students explore the internal structure and evolution of malicious software, learning both static and dynamic analysis methods, as well as common packing and code injection techniques. The program also covers threat models, the attack kill chain, and basic concepts of threat intelligence and digital forensics.

Lecturer's slides
M. Sikorski and A. Honig; Practical Malware Analysis: The Hands-On Guide to Dissecting Malicious Software. No Starch Press.

We will be providing additional resources on the course web page.

Further references
- B. Dang, A. Gazet, E. Bachaalany; Practical Reverse Engineering: x86, x64, ARM, Windows Kernel, Reversing Tools, and Obfuscation. Wiley.
- Monnappa K A; Learning Malware Analysis: Explore the concepts, tools, and techniques to analyze and investigate Windows malware. Packt.

Face-to-face lectures, exercises, hands-on.

In person, videos of lectures also available. Attending the lectures is warmly recommended, but not compulsory.

The exam consists of a 3-hour practical test where the student will have to dissect a synthetic malware sample and a 30-min questionnaire with multiple-choice questions about other topics from the syllabus.

Please refer to the course webpage (link available on the instructor's home page)

• Introduction to cybersecurity (5h)


• Internal structure of a malware sample (5h)


• Basic malware analysis (5h)


• Reverse engineering (10h)


• Static analysis (10h)


• Dynamic analysis (10h)


• Packing and injection techniques (15h)


• Malware evolution (5h)


• Threat models and attack kill chain (5h)


• Threat intelligence (15h)


• Digital forensics (5h)