Operational Technology Sandbox Environment for Malware Detection

The paper discusses the drawbacks and challenges of using virtual environments to analyze malware and how these challenges can be circumvented using physical systems. A sandbox environment is a restricted, controlled execution environment that prevents potentially malicious software from accessing system resources other than those for which the software is authorized. This can be used to analyze the behavior of a file and determine whether it contains malware. A sandbox can be created with virtual environments, physical environments or a combination of both. OT (Operational Technology) sandbox must contain processes that simulate a real industrial environment, e.g. industrial communication protocols, SCADA (Supervisory Control and Data Acquisition) systems, end-point devices, remote connections and network management devices. Furthermore, to capture and analyze the traffic of such a system, various tools for network analysis, memory analysis, registry analysis, log analysis and process analysis must be used. The paper also discusses the benefits of using a physical computer for sandbox environment. We propose a solution that combines physical and software elements, both opensource and customized, to create an industrial sandbox environment that has the necessary characteristics of a real industrial environment in which malware can be tested.