Published Paper Details:

: Malware continues to rapidly evolve with sophisticated techniques aimed at evading traditional detection mechanisms, posing significant challenges to cybersecurity. This combined project presents the design and implementation of a customized, Docker container-based sandbox environment to perform secure and scalable malware behavior analysis. The mini project focuses on creating a lightweight, isolated Python sandbox using Docker, restricting CPU, memory, and network access to safely execute untrusted scripts. This sandbox is optimized for academic and testing purposes, enabling secure volume mounting for output retrieval without compromising host security. Building upon this, the major project advances the sandbox to accommodate comprehensive malware detection by integrating behavioral monitoring tools, including system call tracing, network traffic capture, and file system integrity checks. Leveraging Docker's rapid deployment and resource management capacities, the system orchestrates automated container lifecycles, ensuring malware analysis is conducted in isolated, ephemeral environments. This approach balances performance with security, allowing detailed behavior capture while preventing host infection. Experimental results demonstrate the sandbox's effectiveness in simulating various malware actions, including file creation, network operations, and privilege escalation attempts, under strict resource constraints. The project significantly reduces overhead compared to traditional virtual machine sandboxes, offering extensibility for future enhancements like machine learning-based detection and cross-platform support. Through this research, Docker containerization is validated as a practical foundation for dynamic malware analysis, capable of supporting academic research, malware investigation labs, and automated threat intelligence workflows with improved speed, safety, and scalability.