Lab 7: C2 Communications Laboratory
Analyse captured command-and-control traffic and build a benign request/response simulator.
The brief
Analyse a set of captured command-and-control traffic, then build a benign simulator that reproduces its request/response pattern.
Once malware is running on a target, it typically needs to communicate with its operator. This lab covers that channel: the basic concepts behind command-and-control, the forms information exchange between operator and target can take, and the infrastructure dependencies that channel relies on, including what happens when the server on the other end goes dark.
Students analyse a set of captured command-and-control traffic to determine its communication pattern, then build a benign simulator that reproduces that same request and response behaviour, connecting analysis to construction rather than treating the two as separate skills.
What you submit
- A written analysis of the captured C2 traffic's communication pattern
- A benign request/response simulator reproducing that pattern
Due: 28 September 2027 ·Weight: 2% of the course grade
How it is marked
Assessed on whether the analysis and simulator correctly capture the C2 architecture and communication pattern of the traffic given.
Key dates
- Submission due: 28 September 2027
The spec
The brief poses the problem and leaves room for a response. The spec is the fixed part: what a marker checks. Some lines can be checked mechanically; the rest call for judgement.
- submitted by the deadline, in the format named below
- the simulator's request/response pattern matches the analysis of the captured traffic
- connects the traffic analysis and the simulator built from it, rather than treating them as two separate exercises
- the simulator stays benign, reproducing the pattern without functioning as real command-and-control
- the analysis considers what happens to the channel when the C2 server goes dark, not only while it is live