Week 10: Detection & Evasion
How defenders identify malware, and why its authors care so much about being noticed
12 October 2027
Analysis is what a defender does after the fact; detection is what they try to do before it. This lecture covers signature-based and behavioural detection, and why a malware author’s design choices are shaped by the question of being noticed.
Outline#
- how defenders identify malware
- signature-based detection
- behavioural detection
- why malware authors care about being noticed
Teaching team
- Professor Ivan Sidorov — Course Convenor