What term describes the process of capturing network traffic and investigating it to identify malware activity?

• A. API Monitor
• B. Heuristic Analysis
• C. DNSQuerySniffer
• D. Network analysis

Answer: (D)

Capturing and inspecting network traffic to spot malware activity is network analysis. This approach involves collecting packets or flow data and then examining the contents, timing, destinations, and patterns to identify suspicious behavior such as beaconing, data exfiltration, or command-and-control communications. It’s a broad practice that covers the actual traffic you see on the network rather than focusing on internal software behavior or a specific tool.

For contrast: API Monitor tracks API calls within applications, not the network; heuristic analysis looks for suspicious behavior or code patterns to detect malware, not necessarily network traffic; DNSQuerySniffer is a specific tool for capturing DNS queries, which is only a subset of network activity. Network analysis, however, encompasses the full scope of observing and analyzing network traffic to identify malware activity.