Lab 9: Detection & Evasion Laboratory
Test and improve signature-based and behavioural detection rules against benign simulated malware behaviours.
The brief
Test a set of detection rules against benign simulated malware behaviours, then improve the rules to reduce their false positives and false negatives.
If malware authors care about staying hidden, defenders care about finding them regardless. This lab examines detection from the defender’s position: signature-based rules, behavioural rules, and the trade-off every detection system makes between catching genuine threats and flagging benign activity by mistake.
Working against benign simulated malware behaviours, students test the detection rules provided, measure where they misfire in either direction, and revise the rules accordingly, a concrete demonstration of why detection is an ongoing tuning problem rather than a one-off decision.
What you submit
- Test results for the detection rules against the simulated behaviours
- A revised set of rules, with an explanation of what each change fixes
Due: 12 October 2027 ·Weight: 2% of the course grade
How it is marked
Assessed on whether the revised detection rules measurably improve on the false positive and false negative rates of the originals.
Key dates
- Submission due: 12 October 2027
The spec
The brief poses the problem and leaves room for a response. The spec is the fixed part: what a marker checks. Some lines can be checked mechanically; the rest call for judgement.
- submitted by the deadline, in the format named below
- the revision is justified against the original rules' measured false positives and false negatives
- reports test results for the original rules against the simulated behaviours before any revision is made
- each rule change in the revised set is explained in terms of the specific false positive or false negative it fixes
- the revised rules measurably reduce false positives, false negatives, or both, relative to the originals tested