FilesPage 1 of 3 Malware Analysis Project DEADLINE: As per CA schedule WEIGHT: 40% of module...

Question

FilesPage 1 of 3  Malware Analysis  Project  DEADLINE:  As per CA schedule  WEIGHT: 40% of module marks  COURSE: MSc / PGDip in Cybersecurity  TASKS:  For the purpose of this project you are expected to carry out an investigation into a botnet. Mainly, the  investigation should be done by carrying out a literature review of research papers, industry reports and any  other resources you may find related to that botnet. In addition, you may identify, download and analyse pcap  file(s) and/or dataset(s) associated with that botnet.  Please note that you are NOT required to download and analyse the malware bot component of the botnet. If  you decide to download it for further analysis, you should only do this once you have comprehensively  researched and have a very good understanding of its behaviour and possible consequences.  You are responsible  for any damage you may cause as a result of your actions.  The final task will be to document potential defences to protect against future attacks by this botnet on  organisations/individuals. Students will have to submit a report documenting their work.  The report should be concise, with the main part of the report (excluding references and appendix), limited at  10 pages in a typical 1 column format with paragraph font size of 12 pt.  REPORT STRUCTURE:  1. Executive Summary: Description of the objectives and key findings of the investigation. 2. Methodology: Details and justifications (with references) of the botnet investigation methods that were used, which can include but may not be limited to: • Detail your strategy to search for and select the academic papers, industry reports, and other references. • Detail the pcap files and/or dataset that you identified and analysed (if any). • If you decide to download and analyse the bots, provide details and justifications (with references) of the malware analysis methods that were used (e.g., static analysis, dynamic analysis, Internet investigation, etc.), • Provide description of the test environment setup (e.g., OS version, configuration, precaution and sandboxing measures, etc.), description of the software tools and online tools used for the analysis of the pcap files / datasets / bots, and justification of their choice (i.e., vis-à-vis alternative tools). 3. Botnet Investigation & Findings: Detailed description of the botnet, interpretation and critical analysis of the findings. This section must be broken down into multiple subsections with meaningful headings for each aspect considered, which can include but may not be limited to: • Bots Identification: Description of the bot sample, such as: type of the file, its name, size, hashes, current anti-virus detection capabilities, etc. • Botnet Size and Damage: Provide estimates (with references) of the botnet size, as well as details about reported damage caused by the botnet (e.g., monetary cost for institutions, number of affected users / systems, etc.). • Target Devices: details about the target devices (e.g., PCs, mobile devices, IoT devices, etc.). • Botnet Architecture: Details and diagram of the architecture/ topology used by the botnet, number and type of C&C server(s), etc. Page 2 of 3  • Botnet Behaviour: Detail the behaviour of the botnet (e.g., interaction with registry, files, network, etc.), its main purpose / use cases (e.g., steal credit card information, carry out DDoS attacks), etc. • Botnet Resilience: Detail if the botnet uses any C&C protection and resilience techniques (e.g., bulletproof hosting, DGAs, fast-flux, etc.), detail if the bots use any hiding techniques, persistence mechanisms (e.g., surviving reboots), etc. • Botnet Takedown: Detail any efforts by law enforcement and/or other organisations / individuals to identify who created and/or operated the botnet (if known), any efforts to deactivate the botnet and how successful these were, etc. • Botnet Evolution: Details on how the botnet evolved, new variants of the botnet showing up, etc. 4. Recommendations: Provide recommendations on how organisations/individuals can protect themselves against future attacks by this botnet (e.g., best practices, firewall rules, IDS, anti-virus, etc.). 5. Conclusions: Include an overall discussion of the main findings, limitations and implications, detail next steps (i.e., what else would you do if you had more time). 6. References: Include references to all the resources you consulted when preparing this CA (e.g., research papers, industry reports, web resources, etc.). 7. Appendix: Include screenshots and any additional details required to evidence how you conducted thee practical tasks (the use of screenshots should be kept to a minimum in the main part of the document). SUBMISSION:  The final report must be submitted to Moodle (Turnitin) on/before the above stated deadline.  All report submissions will be electronically screened for evidence of academic misconduct (i.e.,  plagiarism and collusion)!  WARNING:  Please note that you are not required to download and analyse the malware bot component of the botnet.  If you do so, make sure that your VM lab is fully isolated from your host and network (no shared folders,  networking, etc.).   You are responsible for any potential problems arising because of you downloading the bot or being  negligent.  If you, in any way, shape or form, inadvertently, or on purpose transmit any malware of any form to any  system of NCI or another student or staff member, you will fail this module and will have to answer to  the college disciplinary committee. Distributing malware is also illegal! Page 3 of 3    MARKING RUBRIC:  Grade  Criterion  Solid H1  > 80%  H1  > 70%  H2.1  > 60%  H2.2  > 50%  PASS  > 40%  FAIL

Neha · Accepted Answer

Chasing Botnets: A real security incident investigation
Malware Analysis Project
MSc in Cybersecurity
Forename Surname
Student ID: XXX
School of Computing
National College of Ireland
Lecturer:
XXX
Chasing Botnets: A real security incident investigation
Forename Surname
Student ID
1 Executive Summary
The botnets can be defined as our special type of the malware which has now become the biggest thread in the cyber security. The hacker generally exploits the current vulnerabilities so that they can infiltrate the system and install the command-and-control infrastructure. The system is forced to perform the command of bot master and it becomes botanized. In most of the cases that attacker does not have any intention of destroying the compromised assets, but he wants to utilise them so that he can perform other type of the attacks like denial-of-service attack or crypto mining for the targeted websites. 
The ransomware or any other type of disruptive attack can also be launched by the attacker at some point, and it can harm the owner of the equipment. In this paper we will discuss the overview of bot net cases, tactics of the attacker and related Défense mechanics. After this it shows step by step investigation for the digital forensics on bare metal servers of the computer present in cloud. This attack took place in 2020 and this paper describes about the storyline from the installation, infection, investigation, economic implication and the proper mitigation actions over the server finally it shows the main mistakes which can enable attack and the purpose of having silver bullet in for the server setup. 
2 Methodology
There has been more than a decade where there has been the battle against botnets, and it has become more intensive. The Microsoft has estimated that 1% of the recorded computers which are able to execute automatic updates are generally infected with the malicious software. There has been a period of 12 months in which have the majority of the affected machines were unique and it reveals that 10% of the users have faced the infection within the year. The difference mechanics are also surveyed, and it shows the engaging industry, Internet service providers, and users and the governmental organization. 
The overall infection rate has reduced since the starting of the war and it has become stabilized since 2009. But on the other hand, there has been financial losses and the cost over the global economy is still significant. The malwares have evolved from the highly visible and disruptive during the 2002 the steel key code which has become undetectable in the equipment, and it acts as the part of large criminal infrastructure. In today's world the cybercrime has got the structure of service-oriented architecture with the authors and bot net herders which are trading the assets in the market of attack tools, and they also have some integrated malicious strategies. 
The malicious operations can be user credentials harvesting, crypto mining, financial fraud, click fraud on the advertising networks, denial of service attack, spanning and hosting of phishing sites. In this people we will discuss about the step-by-step digital forensics’ investigation over the compromised virtual machines which are present in the cloud, and they are handled with open stack administration. The cloud environments create a very popular target for the attackers in the form of successful assault and it is feasible for different machines with the same settings. The cloud applications generally provide the specific set of the known services, and they have sufficient communication and computational capabilities.
2.1 Botnet Infrastructure
The botnets can be defined as the network off compromised and quotes which are known as the zombies. The whole infrastructure will be controlled by either one or multiple persons who are known as the bot master. The bot net will recruit vulnerable host which are present over the Internet by following different methods and they will be exploited by different malware types. It can be default system configuration, software flaws or the social engineering. 
The infected bots establish the command-and-control mechanics and it help them to get the instructions from the bot masters and then they will coordinate with the malicious campaign. The operations which are done in the command-and-control environment:
· Support recovery and monitoring hello by the bot master
· Offer robust network connectivity
· constrain the exposure of the malicious network and it will be visible to the individual bot
· provide the individual control traffic encryption and dispersion.
2.2 Attacks
The botnets are generally utilised by the distributed denial of service attack campaign over the targeted applications, web for the network which are present in the general. As per the current trend it includes the execution of distributed denial of service operation at the application layer. There are still many are present among the difficult cases for defending them online specially for the web servers. The typical attack strategy is to launch the flooding traffic and it will be sent from the bots to the victim. 
The campaign will have strategy with the adequate number of the bots, and they will exhaust the bandwidth of the victim and hence constrain the excess of legitimate users.

Page 1 of 3 Malware Analysis Project DEADLINE: As per CA schedule WEIGHT: 40% of module marks COURSE: MSc / PGDip in Cybersecurity TASKS: For the purpose of this project you are expected to carry out...

Answer To: Page 1 of 3 Malware Analysis Project DEADLINE: As per CA schedule WEIGHT: 40% of module marks...

Answer To This Question Is Available To Download

Related Questions & Answers

Submit New Assignment