// Alternatives
Alternatives to Malware Data Science
Books in our catalog with overlapping topics and a similar reading level to Malware Data Science. If Malware Data Science is the wrong fit at intermediate level, start here.
01 · 2025
The Art of Mac Malware, Volume 2
The detection-focused sequel to Volume 1, Wardle turns from analyzing Mac malware to building the heuristics and tooling that catch it, using macOS's security frameworks and real-world malware samples throughout.
Advanced4/5Patrick Wardle02 · 2024
Evading EDR
A component-by-component teardown of how modern EDR sensors actually collect telemetry, and where each data source can be starved, blinded, or bypassed.
Advanced4/5Matt Hand03 · 2023
The Android Malware Handbook
Machine-learning researchers and members of Meta's and Google's Android Security teams distill years of research into detecting banking trojans, ransomware, and SMS fraud on Android, combining manual analysis with classification models.
Advanced4/5Qian Han, Salvador Mandujano, Sebastian Porst, V.S. Subrahmanian, Sai Deep Tetali, Yanhai Xiong04 · 2013
The Practice of Network Security Monitoring
Richard Bejtlich's NSM playbook: how to deploy collection sensors, validate that you actually see what you think you see, and build detection workflows around open-source tools.
Intermediate5/5Richard Bejtlich05 · 2026
Le Security Operations Center au cœur de la cybersécurité
Thomas Le Bourlot, nine years into operationalizing SOCs, delivers a systemic approach to the Security Operations Center that combines technology and governance, from supervision fundamentals through cloud, AI, and SOC-as-a-service models.
Intermediate4/5Thomas Le Bourlot06 · 2012
Practical Malware Analysis
Still the gold standard textbook for static and dynamic malware analysis on Windows.
Intermediate5/5Michael Sikorski, Andrew Honig07 · 2017
Network Security Through Data Analysis
Michael Collins on building situational awareness from network telemetry: collection architecture, statistical baseline-setting, and the analytic patterns that turn raw flows into detection.
Intermediate4/5Michael Collins08 · 2013
Applied Network Security Monitoring
A practitioner's walkthrough of building an NSM capability end to end, from deciding what to collect through detection and the analysis workflow that ties it together. The tooling is dated, but the way it teaches you to think about monitoring is not.
Intermediate4/5Chris Sanders, Jason Smith09 · 2014
Countdown to Zero Day
Kim Zetter's investigative reconstruction of Stuxnet, the joint US/Israeli operation that physically damaged Iranian uranium-enrichment centrifuges via a worm, and what its discovery revealed about state-level cyber capability.
Beginner5/5Kim Zetter10 · 2014
The Art of Memory Forensics
Ligh, Case, Levy, and Walters' canonical reference on memory analysis with Volatility — the technique, the tooling, and the operating-system internals it depends on, across Windows, Linux, and macOS.
Advanced5/5Michael Hale Ligh, Andrew Case, Jamie Levy, AAron Walters