Hands-On Cyber Investigations

3 Credits · Level: Graduate, Undergraduate

Hands-On Cyber Investigations This course will provide students with an introduction to various theoretical frameworks used to model the study of network intrusions including the Cyber Kill Chain and the Diamond Model. The bulk of this course, however, will apply these models to real world examples. Students should expect to spend an equal amount of time hunting through large datasets as they do reading published works. We will apply our understanding of these analytic models and present our own analysis of cyber threat data. During the semester we will gain a deeper understanding of various datasets used in network intrusion and threat intelligence analysis including but not limited to: - passive DNS - WHOIS - SSL Certificates - Malware - Internet scan data (e.g. Censys/Shodan) This course will rely on practical in-class labs. We will build our own tools to collect and analyze threat intelligence data in order to understand how data is collected, how bias can be injected into the collection process and how to account for this bias in our analysis. We will also review data from previously disclosed incidents and present our critiques of existing analysis of these incidents.