The aim of the thesis is to design and evaluate a malware laboratory suited for an automatic analysis of network malware behavior. Data obtained from the analyzes should be used to create network signatures for one of the intrusion detection systems.
The laboratory will be based on virtual environment which will ensure required configurability and scalability. Several common services, such as SMTP, HTTP, IRC, and SMB should be emulated on the network.
Moreover, the laboratory will contain a honeypot - a workstation, that will be regularly infected by a malware. The laboratory will collect network communication data and provide tools for emulation of user activity, monitoring of malware behavior and provide further data analysis. The laboratory should fulfill desired security requirements in order to mitigate spreading malware and to provide anonymous communication of malware.
In the thesis, it will be proposed a methodology for realizing an experiment in order to evaluate design and set-up of the laboratory. Moreover, the data obtained from the experiment will be analyzed and interpreted according to observations from literature.

References:

[1] Jason Ross. Malware Analysis for the Enterprise. Black Hat 2010. http://www.blackhat.com/presentations/bh-dc-10/Ross_Jason/Blackhat-DC-2010-Ross-Malware-Analysis-for-the-Enterprise-slides.pdf

[2] Christian Rossow, et al. Sandnet: Network Traffic Analysis of Malicious Software. Proceedings of BADGERS 2011, 2011

[3] Michael Ligh et al. Malware Analyst's Cookbook and DVD: Tools and Techniques for Fighting Malicious Code. Wiley, 2010