For each lecture, we'll post slides, an outline of the content, a recording, and supplemental reading. Slides will be up before lecture (but not necessarily at 9:00am); we post slides with all animations (good for following along exactly) and with limited animations (good for studying/taking notes on). The outline and recording will be posted after lecture (but not necessarily at 3:00pm; likely the next day or so). You can do the supplemental reading before or after lecture; whatever works best for you.

• Slides: all animations, limited animations
• Outline
• Recording
• No supplemental reading for this lecture

After this lecture, at a minimum, you should be able to do the following:

• Explain (at a high-level) how a machine becomes part of a bot in a botnet
• Compare/contrast the two different types of NIDS
• Explain a variety of ways to mount DDoS attacks (e.g., syn floods, DNS amplification); identify what resource is exhausted in each attack (e.g., the network, storage, etc.)

Practice problems

• 2017, Problem 14 (Solutions)
• 2016, Problem 19 (Solutions)
• 2015, Problems 19, 20 (Solutions)