Assignment 1: My First Malware

The brief

Design a fictional piece of malware and document it as a complete engineering artefact, from its purpose down to its operational requirements.

By Week 8, the course has covered enough of the production lifecycle, namely architecture, execution, infiltration and persistence, for a design to stand on its own. This assignment asks for exactly that: a fictional piece of malware, invented from scratch and documented in the manner a real engineering team would document a system before building it.

The design comprises eight required parts: purpose, target, architecture, infection lifecycle, persistence strategy, communication model, detection risks and operational requirements. None of these is optional, and none is graded in isolation, since the point of the assignment is that they constrain one another. A target chosen for its data value implies an architecture that protects that data in transit; a persistence strategy implies a set of detection risks the design must answer for rather than ignore. A response that treats the eight sections as eight unrelated short-answer questions has misunderstood what the assignment is testing.

As with every practical exercise in this course, the resulting artefact is a document rather than working software: the malware described here is never built or deployed, only designed and reasoned about.

What you submit

• A design document naming the malware's purpose and target
• Its architecture and infection lifecycle
• Its persistence strategy and communication model
• An assessment of its detection risks and operational requirements

How it is marked

Assessed on whether the eight required elements cohere as one design rather than eight separate answers, and whether the design is honest about its own detection risks rather than only its capabilities.

Key dates

• Submission due: 1 October 2027