SecBox: a Lightweight Data Mining Platform for Dynamic and Reproducible Malware Analysis

In the era of digitalization, the availability of data is paramount for any scenario that requires informed decision-making. In the cybersecurity world, this is no different. This is especially the case for malware since, even though malware samples share common ancestors, implementations are commonly adapted into many strains, requiring frequent execution and analysis to implement appropriate detection and mitigation mechanisms based on malicious patterns.Sandboxes have emerged as an environment to execute and analyze malware dynamically. However, existing platforms lack real-time, interactive, reproducible malware analysis. Since they do not explore the applicability of container-based isolation, this paper proposes SecBox. To extract system calls, performance metrics, and network traffic, SecBox implements a real-time, visual, easy-to-use tool to execute malware from existing sample exchanges. The platform explores the suitability of lightweight, container-based sandboxing. Based on multiple experiments, SecBox achieves good results regarding the performance, isolation, reproducibility, and monitorability of malware.