Malware Analysis and Detection Engineering: A Comprehensive Approach to Detect and Analyze Modern Malware

by Abhijit Mohanta, Anoop Saldanha

Discover how the internals of malware work and how you can analyze and detect it. You will learn not only how to analyze and reverse malware, but also how to classify and categorize it, giving you insight into the intent of the malware. Malware Analysis and Detection Engineering is a one-stop guide to malware analysis that simplifies the topic by teaching you undocumented tricks used by analysts in the industry. You will be able to extend your expertise to analyze and reverse the challenges that malicious software throws at you. 
The book starts with an introduction to malware analysis and reverse engineering to provide insight on the different types of malware and also the terminology used in the anti-malware industry. You will know how to set up an isolated lab environment to safely execute and analyze malware. You will learn about malware packing, code injection, and process hollowing plus how to analyze, reverse, classify, and categorize malware using static and dynamic tools. You will be able to automate your malware analysis process by exploring detection tools to modify and trace malware programs, including sandboxes, IDS/IPS, anti-virus, and Windows binary instrumentation.
The book provides comprehensive content in combination with hands-on exercises to help you dig into the details of malware dissection, giving you the confidence to tackle malware that enters your environment.
What You Will Learn Who This Book Is For Security professionals, malware analysts, SOC analysts, incident responders, detection engineers, reverse engineers, and network security engineers "This book is a beast! If you're looking to master the ever-widening field of malware analysis, look no further. This is the definitive guide for you."   Pedram Amini, CTO Inquest; Founder OpenRCE.org and ZeroDayInitiative

Genres: Technology

948 pages, Paperback

Published September 23, 2020

Reviews

[Pukhraj Singh · Rating 5 out of 5]

It's a bold effort to introduce some structure to art of detection engineering. It's certainly a labour of love by the authors, who painstakingly explain so many intricate details. The book could do with some proofreading but the onus for that lies with the publisher. It does lay the foundation, but the knowledge could be augmented with other books. One commendable thing: The authors even went to the extent of creating neutered binaries for practicing reverse engineering, so that the readers don't actually have to deal with live malware.

[J E · Rating 4 out of 5]

Broader in scope than other introductory books, covering more on rootkits and detection engineering/AV internals. However it's outdated and the tools don't always work well. Not enough coverage of modern malware obfuscation/packing techniques.