Spyware (Advisor: Assoc. Prof. Buket Doğan)

This was my Cybersecurity M.Sc. term project at Marmara University, supervised by Assoc. Prof. Buket Doğan: Spyware, Its Characteristics, Protection Methods and Spyware Implementation.

The purpose was not to treat spyware as a product label. The project examined which behaviors become unauthorized data-collection risks, how those behaviors can be detected and where defensive controls need to exist.

Threat Behavior

The research classified spyware-related behavior by data-collection purpose, concealment from the user, persistence, external communication and the type of information being targeted.

From a defensive perspective, behavior is more useful than a malware family name. Similar technical mechanisms can appear in legitimate administration software or in abusive software under very different authorization and intent.

Defensive Layers

Protection was not reduced to installing an antivirus product. User behavior, operating-system and application permissions, network controls, trusted software sources, update discipline and anomaly observation were considered together.

A defensive investigation is stronger when file, process, network and persistence evidence can be correlated instead of relying on one indicator.

Legal and Forensic Context

Technical capability does not create legal authorization. Permission, consent, purpose and the boundary of data processing are central to whether collection is legitimate.

Digital-forensics work also requires more than detecting that a program exists. Installation/execution traces, process and network artifacts and event timelines need to be correlated with a defensible evidence process.

This connects the project to concepts such as PCAP, Memory Forensics and Chain of Custody.

Controlled Academic Implementation

The term project also included a controlled example implementation so that the studied behaviors and their observable traces could be understood experimentally.

The public project record focuses on defensive and forensic analysis—what evidence the behavior leaves and how it can be detected or examined—without providing source code or operational steps that reproduce collection, persistence or concealment behavior.

Retrospective

The project reinforced a distinction that remains important in my secure-software, reverse-engineering and forensic work: understanding a mechanism technically and using it without authorization are not the same activity.

Security research is useful when technical understanding improves prevention, detection and evidence quality rather than simply reproducing an offensive capability.