Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

pokiSEC: A Multi-Architecture, Containerized Ephemeral Malware Detonation Sandbox

Alejandro Avina, Yashas Hariprasad, Naveen Kumar Chaudhary

TL;DR

<3-5 sentence high-level summary> Dynamic malware analysis requires strong isolation and repeatable baselines, especially across ARM64 and x86_64 hardware. pokiSEC proposes a containerized detonation sandbox that packages QEMU/KVM and a browser-based loader into a single image, with a universal entrypoint that adapts to the host architecture. Key contributions include the architecture adaptive launch policy, ephemeral teardown guarantees, and cross-architecture PoC validation on ARM64 and AMD64. The approach reduces deployment friction, improves reproducibility, and enables interactive detonation workflows on mixed hardware fleets.

Abstract

Dynamic malware analysis requires executing untrusted binaries inside strongly isolated, rapidly resettable environments. In practice, many detonation workflows remain tied to heavyweight hypervisors or dedicated bare-metal labs, limiting portability and automation. This challenge has intensified with the adoption of ARM64 developer hardware (e.g., Apple Silicon), where common open-source sandbox recipes and pre-built environments frequently assume x86_64 hosts and do not translate cleanly across architectures. This paper presents pokiSEC, a lightweight, ephemeral malware detonation sandbox that packages the full virtualization and access stack inside a Docker container. pokiSEC integrates QEMU with hardware acceleration (KVM when available) and exposes a browser-based workflow that supports bring-your-own Windows disk images. The key contribution is a Universal Entrypoint that performs runtime host-architecture detection and selects validated hypervisor configurations (machine types, acceleration modes, and device profiles), enabling a single container image and codebase to launch Windows guests on both ARM64 and x86_64 hosts. We validate pokiSEC on Apple Silicon (ARM64) and Ubuntu (AMD64), demonstrating interactive performance suitable for analyst workflows and consistent teardown semantics via ephemeral container lifecycles.

pokiSEC: A Multi-Architecture, Containerized Ephemeral Malware Detonation Sandbox

TL;DR

<3-5 sentence high-level summary> Dynamic malware analysis requires strong isolation and repeatable baselines, especially across ARM64 and x86_64 hardware. pokiSEC proposes a containerized detonation sandbox that packages QEMU/KVM and a browser-based loader into a single image, with a universal entrypoint that adapts to the host architecture. Key contributions include the architecture adaptive launch policy, ephemeral teardown guarantees, and cross-architecture PoC validation on ARM64 and AMD64. The approach reduces deployment friction, improves reproducibility, and enables interactive detonation workflows on mixed hardware fleets.

Abstract

Dynamic malware analysis requires executing untrusted binaries inside strongly isolated, rapidly resettable environments. In practice, many detonation workflows remain tied to heavyweight hypervisors or dedicated bare-metal labs, limiting portability and automation. This challenge has intensified with the adoption of ARM64 developer hardware (e.g., Apple Silicon), where common open-source sandbox recipes and pre-built environments frequently assume x86_64 hosts and do not translate cleanly across architectures. This paper presents pokiSEC, a lightweight, ephemeral malware detonation sandbox that packages the full virtualization and access stack inside a Docker container. pokiSEC integrates QEMU with hardware acceleration (KVM when available) and exposes a browser-based workflow that supports bring-your-own Windows disk images. The key contribution is a Universal Entrypoint that performs runtime host-architecture detection and selects validated hypervisor configurations (machine types, acceleration modes, and device profiles), enabling a single container image and codebase to launch Windows guests on both ARM64 and x86_64 hosts. We validate pokiSEC on Apple Silicon (ARM64) and Ubuntu (AMD64), demonstrating interactive performance suitable for analyst workflows and consistent teardown semantics via ephemeral container lifecycles.
Paper Structure (36 sections, 35 equations, 1 figure, 1 algorithm)

This paper contains 36 sections, 35 equations, 1 figure, 1 algorithm.

Table of Contents

  1. Introduction
  2. Related Work
  3. System Overview and Cross-Architecture Design Methodology
  4. Design Goals and Operating Assumptions
  5. Proposed Solution: Containerized Virtualization as a First-Class Primitive
  6. High-Level Architecture and Control-Plane/Data-Plane Separation
  7. Control plane (Loader + Orchestrator):
  8. Data plane (Hypervisor + Remote Desktop):
  9. Routing and Loader-to-Hypervisor handoff:
  10. Universal Entrypoint: Architecture-Adaptive Launch Policy
  11. Analytical Performance Model
  12. Isolation and Risk Formalization
  13. Multi-Objective Configuration Optimization
  14. Pareto interpretation:
  15. Connection to the current implementation:
  16. ...and 21 more sections

Figures (1)

  • Figure 1: System architecture. A reverse proxy routes the initial session to the loader for image ingestion, then switches to the VM desktop session once QEMU/KVM is launched.