Project Updates & Where We are Now
Wow, this term sure has been flying by. So far this project has comprised of a lot of planning and preparatory work so that we can really get into the heavy stuff next term. I have absolutely no complaints about my group or the project as a whole and I am satisfied with where we are at so far. This last week we put together a draft for our design document which essentially laid out all the plans and goals we have for our project and how we plan on completing them.
Seeing how our ideas have begun to take shape into a more structured plan has felt incredibly rewarding. It’s one thing to have some ideas in our heads, but seeing it organized into a roadmap provides my team and I with confidence and a mutual understanding that will help us be more unified and efficient as this project continues underway.
What is to Come
As I mentioned, now that we have a design document we have our roadmap for the whole project in front of us. Within the coming weeks we will be working and building upon the foundation of the project. Our project is unique in that it is not necessarily a “coding project” in the same sense as others taking this course. Our project is meant to analyze malware using both static and dynamic analysis strategies. This malware will be examined within a VM network that we will build using VMWare Workstation.
The majority of our design focus for our V0.0.1 and V0.0.2 will be to create the virtual environment of VMs and download the necessary analysis tools for our testing. In our environment setup we will ensure that our various VMs can communicate with one another as to simulate normal network traffic. Once we have the proper environment setup we will download our various analysis tools. A list of these tools has been written within our design document, but to name a few we download FakeNet, Wireshark, and process explorer.
These tools will allow us to monitor the malware’s behavior from different angles. FakeNet, for example, will simulate network services and capture any outgoing communication attempts made by the malware, giving us insight into its communication patterns. Wireshark will enable us to capture and analyze network packets, allowing us to trace any connections the malware tries to establish. Process Explorer will give us a detailed view of the processes and system resources the malware interacts with, helping us identify suspicious activity at the system level.
Upon the completion of the environment, we should have a strong foundation for the project. With a solid foothold now in place we can look forward to the next term where we will begin our static and dynamic analysis of the malware.