|
所在平台: Udemy |
课程主页: https://www.udemy.com/course/advanced-cyber-security-malware-hacking-course/
课程评论：没有评论
课程名称：《恶意软件分析课程》 课程概述：恶意软件分析是理解可疑文件或网址行为和目的的过程。分析的结果有助于检测和缓解潜在威胁。恶意软件分析的主要好处在于帮助事件响应者和安全分析师： - 按严重程度对事件进行务实分类； - 揭示应阻止的隐藏攻击指标（IOCs）； - 提高IOC警报和通知的有效性； - 在威胁狩猎过程中丰富上下文。 恶意软件分析可以通过静态分析、动态分析或两者的混合方式进行。 静态分析：基本的静态分析不需要实际运行代码，而是检查文件是否存在恶意意图的迹象。它可以帮助识别恶意基础设施、库或打包文件。技术指标，如文件名、哈希值、字符串（如IP地址、域名和文件头数据）可用于判断文件是否恶意。此外，可以使用反汇编工具和网络分析器观察恶意软件，而不需要实际运行它，以收集有关恶意软件工作原理的信息。 动态分析：动态恶意软件分析在一个称为沙箱的安全环境中执行可疑的恶意代码。该封闭系统使安全专业人员能够观察恶意软件的活动，而不必担心让其感染自己的系统或逃逸到企业网络中。动态分析为威胁猎手和事件响应者提供了更深层次的可见性，使他们能揭示威胁的真实本质。通过自动化沙箱化，消除了逆向工程文件以发现恶意代码所需的时间。 本课程旨在指出任何IT组织的安全基础，帮助学员从零开始设置安全基础，或审查其IT环境的现有安全框架。课程面向IT安全初学者以及希望丰富网络安全知识和在此领域追求职业发展的专业人士。
Malware analysis is the process of understanding the behavior and purpose of a suspicious file or URL. The output of the analysis aids in the detection and mitigation of the potential threat.The key benefit of malware analysis is that it helps incident responders and security analysts:Pragmatically triage incidents by level of severityUncover hidden indicators of compromise (IOCs) that should be blockedImprove the efficacy of IOC alerts and notificationsEnrich context when threat huntingThe analysis may be conducted in a manner that is static, dynamic or a hybrid of the two.Static AnalysisBasic static analysis does not require that the code is actually run. Instead, static analysis examines the file for signs of malicious intent. It can be useful to identify malicious infrastructure, libraries or packed files.Technical indicators are identified such as file names, hashes, strings such as IP addresses, domains, and file header data can be used to determine whether that file is malicious. In addition, tools like disassemblers and network analyzers can be used to observe the malware without actually running it in order to collect information on how the malware works.Dynamic AnalysisDynamic malware analysis executes suspected malicious code in a safe environment called a sandbox. This closed system enables security professionals to watch the malware in action without the risk of letting it infect their system or escape into the enterprise network.Dynamic analysis provides threat hunters and incident responders with deeper visibility, allowing them to uncover the true nature of a threat. As a secondary benefit, automated sandboxing eliminates the time it would take to reverse engineer a file to discover the malicious code.This course aims to point out the security essentials for any given IT organization. The course enables students to setup a secure base from scratch or review an existing security skeleton for their IT environments. The course targets the IT security beginners as well as professionals to enrich their knowledge about cyber security and to pursue their career in such field.
