Real-Life Targeted Attack, Malware Threat and Network Intrusion: Analysis, Detection, Defense and Recovery

The Hong Kong University of Science and Technology
Department of Computer Science and Engineering


PhD Thesis Defence


Title: "Real-Life Targeted Attack, Malware Threat and Network Intrusion: 
Analysis, Detection, Defense and Recovery"

By

Mr. Cheuk Tung LAI


Abstract

Real-life cyber-attack incident handling requires research and study to 
improve the capability of incident response, detection, and defense 
against threats including backdoor threats and ransomware attacks. This 
thesis addresses several of these issues including enhancing the 
effectiveness and efficiency in analysis, detection, and incident response 
of stealthy backdoor and ransomware threats, and safeguarding the critical 
data from ransomware attacks if an immediate ransomware threat is 
identified.

First, we propose a methodology called Target Attack Backdoor Malware 
Analysis and Attribution Matrix (TABMAX) to analyze this specific type of 
persistent module backdoor specifically made for web servers to accelerate 
analysis and incident response. Second, we propose an incident response 
methodology matrix called BackDoor Incident Response Model (BDIRM) to 
handle incidents with backdoor effectively, thereby accelerating the 
eradication of the risk and impact of backdoor against organizations. 
Third, we propose RansomSOC which is a Security Operations Center (SOC) 
framework specific to ransomware attack detection and response to detect 
ransomware earlier, reduce the impact of the ransomware infection on the 
target systems, and keep the critical data survival time for servers and 
workstations longer during a ransomware attack. Finally, we propose a 
ransomware incident response model to address the literature gap and 
illustrate the model application with a representative front-line 
ransomware incident response experience from one of our clients.


Date:			Friday, 5 August 2022

Time:			2:00pm - 4:00pm

Zoom Meeting: 
https://us06web.zoom.us/j/5409309429?pwd=Vm9RZ0NqQWN1cHJHZ2p4YVFvWUNTZz09

Chairperson:		Prof. Zhihong GUO (CHEM)

Committee Members:	Prof. Jogesh MUPPALA (Supervisor)
 			Prof. Alex LAM
 			Prof. Shuai WANG
 			Prof. Xueqing ZHANG (CIVL)
 			Prof. Seungjoo KIM (Korea University)


**** ALL are Welcome ****