Course Title

SLOP4000 — Introduction to Malware Production
Welcome to the only course that treats malware as a serious software engineering problem
Professor Ivan Sidorov & Professor Fulan Al-Fulani

Who We Are

Professor Sidorov: malware lifecycle modelling, operational security, institutional management of malicious research
Professor Al-Fulani: cyber operations, attribution, distinguishing advanced malware from poorly maintained enterprise software
Both have spent careers on the other side of the fence

What This Course Is Not

Not a how-to for real malware
Not ethical hacking theatre
Not a catalogue of current CVEs
A systems course about hostile software as an engineering discipline

Learning Outcomes

Understand malware as a complete software production problem
Map the full lifecycle from idea to operational use
Analyse architecture, delivery, persistence and control
Evaluate operational security failures with appropriate confidence

What Counts as Malware?

Software written or deployed with hostile intent
Intent matters more than specific techniques
The same code can be legitimate tool or malware depending on context and purpose

The Intent Problem

Remote administration tools vs remote access trojans
Keyloggers used by parents vs keyloggers used by criminals
Where does “malicious” begin?

Early History

Experimental self-replicating programs of the 1970s
Academic curiosity rather than profit or politics
Limited damage, limited ambition

The 1980s Shift

First widespread personal-computer viruses
Floppy disk as primary vector
Proof-of-concept becomes real nuisance

Commercialisation and Professionalisation

Rise of organised groups and later nation-state actors
Malware becomes a product with customers, support and update cycles
Software engineering practices appear on both sides

Major Categories Overview

Viruses and worms
Trojans and droppers
Ransomware
Spyware and information stealers
Botnets and remote access tools

Viruses and Worms

Self-replicating code
Viruses require a host; worms propagate independently
Historical impact largely tied to naive network design

Trojans and Droppers

Deceptive delivery of secondary payloads
Social engineering as primary infection vector
The “one more download” problem

Ransomware

Encryption as a business model
Payment infrastructure as critical dependency
Recovery difficulty often exceeds technical sophistication

Spyware and Stealers

Long-term data collection
Credential harvesting
Silent operation preferred over dramatic effects

Botnets and RATs

Distributed control of compromised hosts
Command infrastructure becomes the real asset
Scale changes both capability and risk

Malware as Software Production

Requirements, design, implementation, testing, deployment, maintenance
Version control, modularity, configuration management
The same engineering problems appear under different constraints

Why Ordinary Software Engineering Applies

Reliability under hostile conditions
Stealth as a non-functional requirement
Update mechanisms that must survive defender scrutiny

Constraints Unique to Malware

No legitimate support channels
Detection is an active adversary
Attribution risk is permanent

Course Structure Preview

Weeks 2–8: production lifecycle
Weeks 9–11: analysis, detection, operational security
Week 12: synthesis and examination preparation

Assessment Overview

Weekly labs (20%)
Assessment 1: My First Malware (20%)
Assessment 2: Don’t Get Caught (20%)
Final examination (40%)

Expectations

Deadpan seriousness about a farcical topic
All practical work uses deliberately benign samples and simulated environments
Curiosity is required; real malice is not

Questions Before We Begin

What do you already believe about malware?
Where does software engineering end and “malicious” begin?
Why might a university course on this subject exist?