203 Defense in Depth for Sandboxes
This PhD research project studies defense-in-depth architectures for process-based and VM-based sandboxes. The project investigates how sandbox escapes and policy bypasses emerge across system-call interfaces, shared resources, runtime services, and hardware boundaries, then develops layered defenses that combine behavioral monitoring at security-relevant interfaces, exploit prevention, and compartmentalization. It further explores techniques such as pattern matching, hardware-assisted enforcement, and hardware-software co-design to make sandboxed execution more resilient against both known attack patterns and previously unseen exploitation strategies.
References
- Nioh: Hardening The Hypervisor by Filtering Illegal I/O Requests to Virtual Devices : non-spec
- Hardening Hypervisors against Vulnerabilities in Instruction Emulators : seccomp
- Nioh-PT: Virtual I/O Filtering for Agile Protection against Vulnerability Windows : spec, I/O sequence
- SEDSpec: Securing Emulated Devices by Enforcing Execution Specification : automated model extraction; a follow-up to Nioh