Observable and Reproducible Sandbox Environment for Cybersecurity Research

Journal
2026 61st International Scientific Conference on Information, Communication and Energy Systems and Technologies (ICEST)
Date Issued
2026-07
Author(s)
DOI
10.1109/icest71230.2026.11623550
Abstract
The availability of controlled sandbox environments from which relevant network traces and system logs can be obtained is a prerequisite for studying network attacks. Such data is also essential for the development of novel security tools as well as for evaluating the effectiveness of various incident response strategies. A persistent challenge faced by security researchers is how to set up these environments in a consistent manner, guaranteeing the integrity of the underlying infrastructure while still providing meaningful data. In this paper we present the design of a secure, reproducible, and observable sandbox in which purposefully vulnerable applications are deployed and exploited. Every interaction is monitored in real time using strategically placed network probes, performance monitoring agents, and log shippers. The use of modern configuration management tools eliminates configuration drift and entropy, guaranteeing reproducibility of the deployed scenarios. We describe practical approaches for implementing the sandbox, detailing the tools and methods required for real-world deployment. Using a recent sandbox instantiation as an example, we demonstrate how the acquired network data can be used to identify attack patterns, analyze defense strategies, and assess overall incident response effectiveness. The obtained dataset is open-sourced and can be reused to support further research.
Funding(s)
10.13039/100004415-NATO
Subjects

cybersecurity sandbox...

incident response

network monitoring

network flow analysis...

attack vector analysi...

File(s)
Loading...
Thumbnail Image
Name

Observable_and_Reproducible_Sandbox_Environment_for_Cybersecurity_Research.pdf

Description
© 20XX IEEE. Personal use of this material is permitted. Permission from IEEE must be obtained for all other uses, in any current or future media, including reprinting/republishing this material for advertising or promotional purposes, creating new collective works, for resale or redistribution to servers or lists, or reuse of any copyrighted component of this work in other works.
Size

1.2 MB

Format

Adobe PDF

Checksum

(MD5):7bf963625a5994a1a0bbe903380968eb