Mastering Machine Learning for Penetration Testing

Dynamic malware analysis

After collecting information about malware, you should run it in an isolated and secure environment. Generally, these environments are called malware analysis sandboxes. Sandboxes are loaded with analysis and monitoring tools to gather information about the malware while it is running. Malware analysts can collect the following information, and more:

• TCP connections
• DNS summaries
• Malware behaviors
• System calls