Reverse Engineering and Malware Analysis

• Malware methodology
• Basic analysis
• Advanced static analysis
• Advanced Dynamic analysis
• Anonymous and stealthy analysis
• Malware classification and functionality
• Anti Reverse-engineering
• Malware lab

Knowledge:

• The candidate possess knowledge of methodology, technology and application of malware analysis and reverse engineering
• The candidate possess thorough knowledge of anonymous analysis
• The candidate possess advanced knowledge of static malware analysis
• The candidate possess advanced knowledge of dynamic malware analysis
• The candidate possess thorough knowledge of malware classification and functionality
• The candidate possess knowledge of anti-reverse engineering techniques
• The candidate possess thorough knowledge of building and using a malware lab

Skills:

• The candidate is capable of applying malware analysis methodology and technology
• The candidate is capable of applying advanced static malware analysis
• The candidate is capable of applying advanced dynamic malware analysis
• The candidate is able to identify basic and some advanced malware functionality
• The candidate is able to identify known anti-reverse engineering techniques
• The candidate is able to conduct an analysis without revealing that the investigation is taking place and/or revealing their identity.

General competence:

• The candidate is capable of analyzing relevant professional and research problems in malware analysis
• The candidate is capable of applying their knowledge and skills in new fields, in order to accomplish advanced task and projects in malware analysis
• The candidate is capable of working independently as a malware analyst and is familiar with terminology.
• The candidate is capable of discussing professional problems, analysis and conclusions in the field of malware analysis, both with professionals and with general audience
• The candidate has the learning skills to continue acquiring new knowledge and skills in a largely self-directed manner
• The candidate is capable of contributing to innovation and innovation processes

• Lectures
• Lab work
• E-learning
• Compulsory assignments

Additional information:

• The course will be made accessible for master's students at both campus (Gjøvik) and remote students. The master's students are free to choose the pedagogic arrangement that is best fitted for their own requirement.
• It is strongly recommended to attend the physical lab work on campus Gjøvik.
• The lectures in the course will be given on campus Gjøvik and are recorded.
• Teaching and course information & communication mainly in English.

Compulsory requirements:

• Two or three (further details will be given in NTNUs Learning Man. System / Canvas) assignments must be approved in order to take the exam. Students will be divided (randomly) into groups of 4, to read and provide feedback on each other’s assignment. Approvement (approved/not approved) will be done by staff.