Selection and evaluation of functionality of closed program execution environments (sandboxes) for testing and detection of potentially dangerous files and programs
Year: 2023
Type: article
Abstract: Sandbox technologies provide the most effective mechanisms to protect against targeted and zero-day attacks. The principle of the sandbox is that suspicious software runs in a specially prepared environment for it, isolated from the rest of the infrastructure. The work analyzed the methods for implementing sandboxes to assess and select the functionality of closed environments. We considered local sandboxes, which are part of many antiviruses. They implement isolation based on partial file system virtualization and registry. Analyzed network sandboxes, which have fewer restrictions than local ones, since they do not reduce the performance of the user's computer and allow you to check potential threats on various operating systems. To select and evaluate closed environments, two companies were selected in the work that provide sand-boxes both in software and hardware form and using ready-made images for virtualization environments: Fortinet's FortiSandBox and Positive Technologies' PT Sandbox. Product testing took place in demo mode, in a VMware workstation virtual environment.
Source: Digital Technology Security
Authors: Anastasia B. Arkhipova, Anton S. Bereznoy
Language: English
Subfield: Hardware and Architecture
Field: Computer Science
Domain: Physical Sciences
Open Access status: bronze
OpenAlex ID: W4387171984