An Orchestrated Sandbox for Side-Channel Analysis of Cyber-Physical Systems Malware

summary

Video file (mp4)

The gist

The gist The SaMOSA Linux sandbox provides a modular and customizable framework for emulating Linux malware while capturing time-synchronized side-channels from four sources.

In short

SaMOSA is a modular Linux malware sandbox designed for cyber-physical systems. It emulates malware across x86-64, ARM64, and PowerPC 64 while capturing four synchronized side-channels: system calls, network activity, disk activity, and hardware performance counters. This provides deep insights into malware behavior by correlating these low-level execution patterns.

Key concepts

Side-Channel Monitoring
This involves capturing multiple data streams simultaneously from the malware's execution to understand its actions. SaMOSA captures system calls, network traffic, disk I/O, and hardware performance counters all at the exact same time. This allows researchers to see how different aspects of the malware interact during a specific operation.
Hardware Performance Counters (HPC)
HPCs measure low-level CPU activities like cache usage and branch mispredictions. By plotting these measurements over time, SaMOSA reveals fine-grained execution patterns, showing exactly how the malware is utilizing the processor's resources during its operations.
Orchestration Pipeline
This is an automated workflow that sets up and runs the sandbox without manual intervention. It involves stages like 'Pre Setup,' 'Execution,' and 'Post Run.' Users can add custom scripts or commands at specific hook points to control the entire analysis process automatically.

Terminology used across episodes

This episode discusses

The paper

An Orchestrated Sandbox for Side-Channel Analysis of Cyber-Physical Systems Malware · Read on arXiv

NYU Tandon School of Engineering

Embedded devices powering cyber-physical systems (CPS) are increasingly internet-exposed, placing critical infrastructure under active threat. Dynamic analysis of embedded malware requires a sandbox that provides a realistic embedded environment, captures system-level side channels for behavioral insight, and supports repeatable experiments. Existing Linux sandboxes fall short on all three: they target narrow tasks, run minimal environments, and only execute samples directly. Malware often withholds its true behavior, awaiting environmental triggers or command-and-control (C2) servers, or deploying anti-analysis techniques. To address these issues, we present SaMOSA (sandbox for malware orchestration and side-channel analysis), with on-demand C2 response replay via a replay formulation tool to extract and serve C2 payloads, lifecycle-bound orchestration for environment customization, four synchronized side-channels, and multi-architecture support. Among Linux sandboxes targeting CPS, only SaMOSA provides both on-demand C2 response replay and lifecycle-bound orchestration, serving payloads over malware-initiated sessions for network-isolated execution without live infrastructure. Through a Kinsing cryptominer case study on ARM64, we show that SaMOSA delivers the full C2 payload chain without live infrastructure, with synchronized channels resolving phase-wise mining behavior under live C2. Replay reproduces payload delivery but not stateful C2 sessions, a fidelity boundary that surfaced a hidden Tor fallback and 59 new IPs.

DOI: 10.1109/LES.2026.3726537

Transcript

Introduction to the show: ident: Security Radio. Generated commentary on the latest security and cryptography papers.

Nadia: We're looking at the paper: "An Orchestrated Sandbox for Side-Channel Analysis of Cyber-Physical Systems Malware".

Elias: Here's the gist of the paper. The gist The SaMOSA Linux sandbox provides a modular and customizable framework for emulating Linux malware while capturing time-synchronized side-channels from four sources.

Nadia: SaMOSA Framework and Capabilities SaMOSA is designed to fill a gap in Linux malware analysis by providing a modular and customizable sandbox framework that can be adapted for many malware analysis tasks It supports emulation of Linux malwares while capturing time-synchronized side-channels from four sources SaMOSA captures more side-channels namely system calls, network activity, disk activity, and hardware performance counters The sandbox supports three architectures predominantly used in OT and CPS namely x86-64, ARM64, and PowerPC 64 It fills a gap in Linux malware analysis by providing a modular and customizable sandbox framework that can be adapted for many malware analysis tasks Implementation Components SaMOSA incorporates several components for its operation The implementation involves virtual machine (VM) emulation using QEMU

21: and network emulation using FakeNet

15: System call capture is achieved using sysdig

23: running inside the sandbox Hardware performance counter (HPC) measurements are captured using perf directly of the host QEMU process Disk access measurements are measured via QEMU tracing on the emulated NVMe and virtio block partitions Orchestration and Execution Pipeline The SaMOSA execution pipeline involves three stages: orchestration, execution, and analysis Orchestration involves setting up and configuring the sandbox environment by selecting specific VM image to boot up, providing configuration options for execution, and adding pipeline hooks with custom scripts and commands The four hook points are “Pre Setup” before the VM is setup and booted, “Pre Run” before measurement starts and the binary is executed, “Post Run” after binary is halted and measurement has stopped, “Post Shutdown” after the VM is shutdown The execution stage boots up the VM, sets up all monitoring utilities, initiates the desired network configuration, and executes the binary The pipeline automates end-to-end execution so no user interaction is required to execute the binary or start components Side-Channel Monitoring and Analysis SaMOSA captures four time synchronized side channels for deep insights into malware behavior These captured data include system calls, hardware performance counters, network activity, and disk activity The HPC measurements are plotted versus time directly to show low-level execution patterns like cache usage and branch mispredictions Disk activity is displayed as a scatter plot where each point is plot as the logical block address versus time, with different colors for reads and writes Syscalls are displayed using a scatter plot of syscall type versus time to show when that syscall was triggered Network activity is aggregated as transmit (TX) and receive (RX) speed in kilobytes per second by accumulating the packet sizes in a one millisecond window Case Studies Demonstration The paper presents three case studies of real-world malwares to demonstrate SaMOSA’s advantages For GonnaCry Ransomware, HPC values show high memory load activity and heavy disk access correlating with file overwriting behaviors For CHAOS Remote Access Trojan, time-synchronized side-channel activity helped identify activity hotspots for deeper analysis across network transfers and disk reads For Kinsing Cryptominer, FakeNet captured the list of C2 IP addresses and URLs accessed by Kinsing to reveal additional payloads downloaded via NAT access SaMOSA bridges a critical gap in Linux malware analysis by offering a customizable, end-to-end automated, and multi-architecture platform SaMOSA supports full-system emulation across multiple architectures (x86-64, ARM64, PPC64LE) and captures timesynchronized execution data across four key side channels Its modular design, support for orchestration via custom pipeline hooks, and provision of real-world operating systems like Ubuntu and Debian make it adaptable for a wide range of malware analysis tasks SaMOSA bridges a critical gap in Linux malware analysis by offering a customizable, end-to-end automated, and multi-architecture platform ACKNOWLEDGMENTS This work was supported in part by the DOE NETL grants DECR0000051 and DE-CR0000017, and the NSF SaTC grant 2039615 REFERENCES

1: Amr S Abed, T Charles Clancy, and David S Levy.

Nadia: Applying bag of system calls for anomalous behavior detection of applications in linux containers.

Title and authors: Nadia: So we’re talking about this paper, "An Orchestrated Sandbox for Side-Channel Analysis of Cyber-Physical Systems Malware," and the authors are Udeshi, Venkata Sai Charan Putrevu, Prashanth Krishnamurthy, Ramesh Karri, and Farshad Khorrami >

Elias: Yeah. They’re building something that handles the complexity of malware in operational technology and cyber-physical systems which is a big area right now >

Priya: What I want to understand is how this orchestrator part works because building a sandbox is one thing, but making it adaptable for various analyses sounds like a huge engineering challenge >

Nadia: Well, the paper introduces SaMOSA as this sandbox environment that allows you to configure specific hooks with custom scripts and commands before execution >

Elias: It outlines three main stages in the pipeline: orchestration where you set up the hooks, execution where the binary runs and collects data, and then analysis where all that time-synchronized data gets post-processed and plotted >

Priya: So it’s not just running a file; it’s a whole automated process designed to gather specific types of behavior before anything else happens >

Nadia: Right. And they show how this setup lets you use tools like QEMU for emulation, FakeNet for network simulation, and sysdig for system call capture >

Elias: They also mentioned that the execution stage boots up the VM, sets up all the monitoring utilities, initiates the desired network configuration, and then just runs whatever binary you point it at without any user interaction needed >

The paper's summary: Nadia: Looking at what they summarize in "An Orchestrated Sandbox for Side-Channel Analysis of Cyber-Physical Systems Malware," the main idea is that existing Linux sandboxes are too limited for modern malware analysis >

Elias: They argue that current tools only capture one or maybe two side-channels and don't offer the flexibility needed to adapt to different analysis tasks >

Priya: So they’re saying the limitation isn't just in the sandbox itself, but in what it actually captures and how easily you can change what it captures >

Nadia: Right. SaMOSA aims to fix that by providing a customizable framework that supports emulation across multiple architectures like xeighty-six-sixty-four ARM64, and PowerPC sixty-four >

Elias: They emphasize the four side-channels they capture: system calls, hardware performance counters, network activity, and disk activity all synchronized in time >

Priya: That synchronization is key. If you can correlate a spike in network traffic with a specific disk write pattern or a certain system call sequence at the exact same millisecond, that gives you much richer data >

Nadia: That’s the point. They show how these captured data points can be plotted over time to observe correlations across those different channels >

The paper's improvements: Elias: Now let’s talk about what they suggest as improvements for this orchestration sandbox idea in "An Orchestrated Sandbox for Side-Channel Analysis of Cyber-Physical Systems Malware" >

Nadia: They suggest focusing heavily on the analysis stage, specifically how that time-synchronized data is post-processed and plotted to observe these correlations across multiple side-channels >

Priya: I’m interested in what they mean by that plotting. Are they just showing raw data, or are they using some kind of statistical method to actually make sense of the noise? >

Elias: They show that you can plot hardware performance counters versus time directly to reveal low-level execution patterns like cache usage and branch mispredictions >

Nadia: And for disk activity, it’s a scatter plot where each point is the logical block address versus time, with different colors for reads and writes >

Elias: They also show syscalls as a scatter plot of syscall type versus time to show exactly when that specific system call was triggered >

Priya: That seems like the data really showing you something concrete about the malware’s actual execution flow rather than just a generic log file >

Conclusion: Nadia: So wrapping up on "An Orchestrated Sandbox for Side-Channel Analysis of Cyber-Physical Systems Malware," SaMOSA offers this multi-architecture, end-to-end automated platform for analyzing malware in OT and CPS environments >

Elias: It bridges that gap by giving researchers a customizable sandbox that captures four time synchronized side channels, which is something previous tools just couldn't do >

Priya: For someone just listening to the show, this means we can expect much deeper insights into malware behavior because we aren't just looking at one aspect of its activity anymore >

Nadia: Exactly. The real implication is that this platform can be adapted for a wide range of malware analysis tasks because of its modular design and support for custom pipeline hooks >

Elias: It gives us the ability to automate the entire process, from setup to execution to analysis, which should make deep behavioral study much more accessible than manual configuration usually allows >

Priya: I think the biggest value here is moving beyond just binary analysis toward understanding how that malware interacts with its actual environment in real-time >

Nadia: That’s what this paper achieves. We're looking forward to seeing how researchers use this SaMOSA framework to uncover new attack patterns and defenses.

More episodes

← Home