Malware Analysis
(CIS 700 (a Special Topics course) at Syracuse U)
Note: parts of this syllabus are subject to change with adequate notice to students.
A research-focused introduction to modern techniques used to understand and analyze modern exploits and malware. This course is part lecture, part seminar. Students are expected to actively participate and drive paper discussion.
Grading
- Three projects worth 10% each
- Weekly paper writeups and discussion (worth 50% total)
- One take-home final worth 20%
Final grade cutoffs will be announced on Slack towards the end of the course. Ask me if you want to know earlier.
Topics
- C/Assembly background
- Spatial and temporal safety
- Shellcoding, ASLR, probabilistic defenses
- Return-to-libc and ROP
- Symbolic execution
- ROP and exploit synthesis
- Modern binary symbolic execution techniques
- Datalog, Datalog Disassembly, and Horn-SAT-based binary analysis
- Decompilation (focusing on sound decompilation)
- Machine learning for malware analysis
- Neural inference of binaries for decompilation, identifier reversing, etc…
- Usable RE tools.
- Scriptable, declarative, and compilable binary analysis.
Collaboration and the Honor Code
- Please do not cheat in the course.
Student Support
Syracuse University values diversity and inclusion; we are committed to a climate of mutual respect and full participation. There may be aspects of the instruction or design of this course that result in barriers to your inclusion and full participation in this course. I invite any student to meet with me to discuss strategies and/or accommodations (academic adjustments) that may be essential to your success and to collaborate with the Office of Disability Services (ODS) in this process.
If you would like to discuss disability-accommodations or register with ODS, please visit their website at http://disabilityservices.syr.edu. Please call (315) 443-4498 or email disabilityservices@syr.edu for more detailed information.
ODS is responsible for coordinating disability-related academic accommodations and will work with the student to develop an access plan. Since academic accommodations may require early planning and generally are not provided retroactively, please contact ODS as soon as possible to begin this process.
Student Mental Health
Mental health and overall well-being are significant predictors of academic success. As such it is essential that during your college experience you develop the skills and resources effectively to navigate stress, anxiety, depression and other mental health concerns. Please familiarize yourself with the range of resources the Barnes Center provides (https://ese.syr.edu/bewell) and seek out support for mental health concerns as needed. Counseling services are available 24/7, 365 days a year, at 315.443.8000.
Discrimination and Harassment
The University does not discriminate and prohibits harassment or discrimination related to any protected category including creed, ethnicity, citizenship, sexual orientation, national origin, sex, gender, pregnancy, disability, marital status, age, race, color, veteran status, military status, religion, sexual orientation, domestic violence status, genetic information, gender identity, gender expression or perceived gender.
Any complaint of discrimination or harassment related to any of these protected bases should be reported to Sheila Johnson-Willis, the Universitys Chief Equal Opportunity & Title IX Officer. She is responsible for coordinating compliance efforts under various laws including Titles VI, VII, IX and Section 504 of the Rehabilitation Act. She can be contacted at Equal Opportunity, Inclusion, and Resolution Services, 005 Steele Hall, Syracuse University, Syracuse, NY 13244-1120; by email: titleix@syr.edu; or by telephone: 315-443-0211.
If you notice any incidents of harassment or discrimination, however minor, please email me. You may wish to use an anonymous email service such as https://anonymousemail.me/. Please feel free to tell me as much as you feel comfortable. I am a mandatory Title IX reporter and must report incidents such as sexual harassment, relationship violence, stalking, etc…
Slack
Slack is an instant messaging app for teams. We’ll be using it for most course management. This is the best place to get in touch with me for one-off questions, ask for an appointment for office hours, etc.. Email me if you have not been invited to the course Slack.