-2

My M.Sc research is about developing IDS for IOT. I'm confused about which field should learn more about; penetration testing or malware analysis.

I have some knowledge about each one but for IDS, which is working with malware, I don't know which field I should focus on!

I'll use AI (Deep Learning) for building an IDS based on Contiki and cooja platform.

closed as too broad by kasperd, forest, this.josh, OscarAkaElvis, Teun Vink Oct 30 '18 at 8:04

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • IDS is not about either penetration testing or malware analysis. – schroeder Oct 7 '18 at 10:56
  • But i will make some analysis on any attack for detecting it and remark it as positive or negative ? – Mahmoud Elgindy Oct 7 '18 at 11:01
  • Right, so you are not creating an IDS, but you are trying to teach a system how to recognise malicious traffic from IOT devices. And you want to know what fields of analysis should be primary. – schroeder Oct 7 '18 at 11:47
  • The Computer Science stack exchange is meant for students and researchers. They would be a better place to ask about your research. Good luck in your studdies. – Daisetsu Oct 7 '18 at 16:58
4

IDS is not about either penetration testing or malware analysis. An IDS inspects traffic (typically) to look for Indicators of Compromise (IoC).

An IDS, then, is a consumer of whatever the IoCs are, and developing the IoCs is a function of malware and malicious traffic analysis.

So, to develop IoCs, you might want or need to know quite a lot of about both penetration testing (can help with malicious traffic analysis) and malware analysis.

What it sounds like is that you want to develop IoCs for IOT, and then deploy those IoCs in some kind of analysis platform (what you are calling an IDS).

If you want to inspect traffic for previously unknown IoCs and determine IoCs on the fly without any previously defined IoCs, then that's a completely different prospect. I have done this, but you need quite extensive experience in a number of areas. Choosing one over another will restrict what you can detect.

Not the answer you're looking for? Browse other questions tagged or ask your own question.