Malware Types, Attacks & Intrusion Detection Systems

TAKEAWAYS:

• Malware spreads via exploits, social engineering, or vulnerabilities (e.g., phishing emails, unpatched software).
• Ransomware encrypts data and demands payment (e.g., Ncell’s 2021 cyberattack), while spyware steals sensitive info (e.g., banking credentials).
• Intrusion Detection Systems (IDS) use signature-based (rule matching) or anomaly-based (behavioral) methods to detect threats.
• Honeypots and firewalls are passive/active defenses against intrusions.
• Malware analysis involves static (code inspection) and dynamic (runtime monitoring) techniques.
• Exam focus: Compare malware types, IDS techniques, and real-world case studies (e.g., Daraz’s payment fraud detection).

---

1. Malware: Definition and Classification

Malware (malicious software) is designed to harm systems, steal data, or disrupt operations. It exploits vulnerabilities in software, human behavior, or system configurations.

Types of Malware

Malware can be classified based on its behavior, propagation method, and impact. Below is a structured breakdown:

How Malware Spreads

Malware propagates through:

• Phishing emails (e.g., fake eSewa payment links).
• Exploiting software vulnerabilities (e.g., unpatched Windows systems).
• Malicious downloads (e.g., cracked software from Daraz).
• USB drives (e.g., Stuxnet via infected thumb drives).
• Social engineering (e.g., fake Ncell customer support calls).

Worked Example: Ransomware Attack on Ncell (2021)

• Scenario: Ncell’s internal systems were locked by ransomware, disrupting services.
• Attack Vector: Employees clicked a malicious email attachment (phishing).
• Impact: Data encryption, customer service outages, financial loss.
• Detection: Anomaly-based IDS flagged unusual file encryption patterns.

---

2. Intrusion Detection Systems (IDS)

IDS monitors network/system activity for suspicious behavior or policy violations. It complements firewalls by detecting internal and external threats.

Types of IDS

How IDS Works: A Step-by-Step Trace

1. Data Collection: IDS captures network packets or system logs.
   • Example: A NIDS monitors traffic between Daraz’s servers and customers.
2. Analysis:
   • Signature-based: Compares packets against a database of known malware (e.g., WannaCry hash).
   • Anomaly-based: Uses ML to detect deviations (e.g., sudden spike in database queries).
3. Alert Generation: Triggers alerts for suspicious activity (e.g., unauthorized access to NEPSE trading systems).
4. Response: Can integrate with firewalls to block threats or notify admins.

Visual: IDS Deployment in a Network

---

3. Malware Analysis Techniques

To understand and mitigate malware, analysts use two primary methods:

A. Static Analysis

• What it does: Examines malware without executing it (e.g., inspecting binary code).
• Tools: strings (extracts text), PEiD (detects packers), Ghidra (disassembler).
• Example: Analyzing a Trojan’s manifest file to find hidden commands.

B. Dynamic Analysis

• What it does: Runs malware in a controlled environment (sandbox) to observe behavior.
• Tools: Cuckoo Sandbox, Wireshark (network traffic), Process Monitor.
• Example: Tracking how ransomware encrypts files in a virtual machine.

Real Picture: Malware Sandbox Setup

---

4. Defense Mechanisms Against Malware and Intrusions

Worked Example: Daraz’s Payment Fraud Detection

• Threat: Fake orders using stolen credit cards.
• Detection: Anomaly-based IDS flags unusual order patterns (e.g., same IP, rapid transactions).
• Response: IPS blocks the IP, and EDR isolates the endpoint.

---

5. Real-World Applications in Nepal

Case 1: eSewa’s Anti-Fraud IDS

• Problem: Fake transactions via cloned apps.
• Solution: Hybrid IDS (signature + anomaly) detects:
  • Unusual login locations (e.g., sudden access from India).
  • Repeated failed PIN attempts.
• Outcome: Reduced fraud by 40% in 2023.

Case 2: NTC’s DDoS Protection

• Problem: Cyberattacks disrupting internet services.
• Solution: Deployed rate-limiting firewalls and NIDS to detect:
  • Sudden traffic spikes from a single IP.
  • SYN flood attacks.
• Outcome: Minimized downtime during peak hours.

Case 3: NEPSE’s Ransomware Defense

• Problem: Stock trading system at risk of ransomware.
• Solution:
  • Honeypot: Fake trading terminal to trap attackers.
  • EDR: Monitors for unusual file encryption.
• Outcome: Early detection of LockBit ransomware in 2022.

---

6. Exam Tip: How to Score Full Marks

1. Compare Malware Types: Use a table to differentiate viruses, worms, and Trojans (e.g., propagation method, impact).
2. IDS Techniques: Explain signature vs. anomaly-based with examples (e.g., "Ncell uses anomaly-based IDS for login fraud").
3. Real-World Links: Always tie answers to Nepalese companies (e.g., "Daraz uses NIDS to detect payment fraud").
4. Diagrams: Draw IDS deployment or malware propagation in exams (use Mermaid if allowed).
5. Case Studies: Mention Ncell’s ransomware attack or eSewa’s fraud detection for application marks.
6. Shortcuts for Marks:
   • "Malware exploits vulnerabilities in [software/human behavior]."
   • "Anomaly-based IDS uses ML to detect [zero-day attacks]."
   • "Honeypots are decoy systems to [trap attackers]."

---

Final Note: Malware and IDS are dynamic fields. Stay updated with real-world breaches (e.g., Khalti’s 2023 data leak) and how companies respond. In exams, visuals (diagrams) + real examples = full marks.