Computing · Year 9

Active learning ideas

Malware and Antivirus Software

Active learning helps students grasp malware types and defenses because these concepts are dynamic, not abstract. By handling real examples, testing defenses, and debating updates, students move beyond memorization to build lasting mental models of how malware spreads and how antivirus software responds.

• National Curriculum Attainment Targets
• KS3: Computing - Cybersecurity
• KS3: Computing - Online Safety

• 25–45 min
• Pairs → Whole Class
• 4 activities

Activity 01

• Document Mystery
• 30 min · Pairs

Card Sort: Malware Classification

Prepare cards with malware descriptions and examples. In pairs, students sort into viruses, worms, ransomware categories, then justify placements with evidence. Follow with whole-class share-out to refine definitions.

Differentiate between viruses, worms, and ransomware.

Facilitation Tip

During the Card Sort, circulate and ask groups to justify each placement using the malware definitions from the activity sheet.

What to look for

Pose the question: 'Imagine your school network was infected by a worm. How would it spread, and what immediate steps should the IT department take?' Encourage students to use key vocabulary to explain the propagation and mitigation strategies.

• Analyze
• Evaluate
• Self-Management
• Decision-Making

Activity 02

• Simulation Game
• 45 min · Small Groups

Simulation Game: Infection Chain

Use printable network diagrams. Groups simulate worm spread by passing 'infected' tokens, noting prevention points like firewalls. Discuss antivirus interception steps afterward.

Justify the importance of regularly updating antivirus software.

Facilitation Tip

In the Infection Chain simulation, pause after each step to have students predict the next outcome before revealing it.

What to look for

Present students with three brief scenarios describing cyber threats. Ask them to identify the type of malware (virus, worm, ransomware) in each scenario and explain their reasoning using one to two sentences.

• Apply
• Analyze
• Evaluate
• Create
• Social Awareness
• Decision-Making

Activity 03

• Document Mystery
• 40 min · Whole Class

Update Debate: Pro vs Con

Divide class into teams to argue for or against skipping updates, using case studies. Teams present evidence, then vote with justification. Debrief on real risks.

Analyze how malware can compromise a computer system and its data.

Facilitation Tip

For the Update Debate, assign roles explicitly (e.g., update advocate, skeptical user) to ensure balanced participation.

What to look for

On a slip of paper, ask students to write: 1) One reason why updating antivirus software is crucial. 2) One difference between a computer virus and a worm.

• Analyze
• Evaluate
• Self-Management
• Decision-Making

Activity 04

• Document Mystery
• 25 min · Individual

Scan Challenge: Mock Files

Provide 'files' labeled safe or malicious. Individually scan with checklists mimicking antivirus tools, then pairs review and report false positives.

Differentiate between viruses, worms, and ransomware.

Facilitation Tip

In the Scan Challenge, provide intentionally tricky mock files (e.g., renamed executables, hidden macros) to push students beyond surface-level scanning.

What to look for

Pose the question: 'Imagine your school network was infected by a worm. How would it spread, and what immediate steps should the IT department take?' Encourage students to use key vocabulary to explain the propagation and mitigation strategies.

• Analyze
• Evaluate
• Self-Management
• Decision-Making

A few notes on teaching this unit

Teaching malware and antivirus works best when students confront misconceptions directly through hands-on tasks rather than lectures. Use simulations to reveal how malware exploits human and system vulnerabilities, and use debates to surface gaps in understanding about updates. Avoid over-reliance on scare tactics; instead, focus on how layered defenses reduce risk. Research suggests that students retain these concepts better when they see the ripple effects of a single infection through a simulation.

Successful learning shows when students can classify malware accurately, explain infection chains step-by-step, debate update trade-offs with evidence, and scan mock files to identify risks. They should use precise vocabulary and connect concepts to real-world consequences.

---

Watch Out for These Misconceptions

• During Card Sort: Malware Classification, watch for students grouping worms and viruses together because they both spread.

  Use the activity’s definition cards to prompt students to compare how each malware type spreads: viruses need hosts, worms spread independently. Have them revise their sorts by adding a third column labeled 'Spread Mechanism' to clarify distinctions.

• During Scan Challenge: Mock Files, watch for students assuming antivirus software will catch all threats in a file set.

  After the scan, display the antivirus software’s log showing missed detections. Ask students to revisit their results and categorize why some threats were missed (e.g., zero-day, obfuscation) using the log as evidence.

• During Update Debate: Pro vs Con, watch for students arguing that updates are only needed after a breach occurs.

  Have students reference the update debate’s scenario cards, which include unpatched vulnerabilities exploited before any breach. Ask them to revise their arguments to include prevention as a key benefit of regular updates.

---

Methods used in this brief

• Document Mystery
• Simulation Game