Practical Malware Analysis

Chapter 14. Malware-Focused Network Signatures

Malware makes heavy use of network connectivity, and in this chapter, we’ll explain how to develop effective network-based countermeasures. Countermeasures are actions taken in response to threats, to detect or prevent malicious activity. To develop effective countermeasures, you must understand how malware uses the network and how the challenges faced by malware authors can be used to your advantage.