Security Analysis

Use Akira sandboxes for safe threat detection and security analysis.

The Challenge

Security analysis requires running potentially malicious code:

Analyzing malware samples
Testing exploit detection
Validating security tools
Fuzzing applications

Running this directly is dangerous. Akira provides the isolation you need.

Architecture

┌──────────────────────────────────────────────────────────┐
│                  Security Analysis System                 │
│                                                           │
│  ┌────────────────────────────────────────────────────┐  │
│  │                Analysis Orchestrator               │  │
│  │   • Sample ingestion                               │  │
│  │   • Sandbox management                             │  │
│  │   • Result aggregation                             │  │
│  └──────────────┬─────────────────────────────────────┘  │
│                 │                                         │
│                 ▼                                         │
│  ┌────────────────────────────────────────────────────┐  │
│  │              Akira Sandbox Cluster                 │  │
│  │  ┌──────────┐  ┌──────────┐  ┌──────────┐        │  │
│  │  │ Analysis │  │ Analysis │  │ Analysis │        │  │
│  │  │  VM 1    │  │  VM 2    │  │  VM N    │        │  │
│  │  │          │  │          │  │          │        │  │
│  │  │ Isolated │  │ Isolated │  │ Isolated │        │  │
│  │  │ Network  │  │ Network  │  │ Network  │        │  │
│  │  └──────────┘  └──────────┘  └──────────┘        │  │
│  └────────────────────────────────────────────────────┘  │
│                 │                                         │
│                 ▼                                         │
│  ┌────────────────────────────────────────────────────┐  │
│  │              Detection Results                     │  │
│  │   • Behavioral analysis                            │  │
│  │   • Network activity                               │  │
│  │   • System modifications                           │  │
│  └────────────────────────────────────────────────────┘  │
└──────────────────────────────────────────────────────────┘

Example: Safe Code Analysis

Analyze potentially malicious code samples:

import SandboxSDK from '@akiralabs/sandbox-sdk';
 
const client = new SandboxSDK({ apiKey: process.env.AKIRA_API_KEY });
 
interface AnalysisResult {
  fileAccess: string[];
  networkConnections: string[];
  processCreated: string[];
  systemModifications: string[];
  riskLevel: 'low' | 'medium' | 'high' | 'critical';
}
 
async function analyzeCodeSample(code: string): Promise<AnalysisResult> {
  // Create isolated analysis environment
  const sandbox = await client.sandboxes.create({
    image: 'akiralabs/akira-default-sandbox',
    resources: { cpu: 1, memory: 1024 },
    timeout: 300, // 5 minute max
  });
 
  try {
    // Set up monitoring
    await client.sandboxes.execute(sandbox.id, {
      command: `
        # Start system call tracing
        strace -f -o /tmp/syscalls.log python /app/sample.py &
        STRACE_PID=$!
 
        # Start network monitoring
        tcpdump -i any -w /tmp/network.pcap &
        TCPDUMP_PID=$!
      `,
    });
 
    // Upload and execute the sample
    await client.sandboxes.upload(sandbox.id, {
      path: '/app/sample.py',
      content: Buffer.from(code),
    });
 
    await client.sandboxes.execute(sandbox.id, {
      command: 'timeout 30 python /app/sample.py || true',
      timeout: 60,
    });
 
    // Collect analysis results
    const syscalls = await client.sandboxes.execute(sandbox.id, {
      command: 'cat /tmp/syscalls.log | grep -E "open|connect|exec" | head -100',
    });
 
    const fileAccess = await client.sandboxes.execute(sandbox.id, {
      command: 'find /tmp /var -newer /app/sample.py -type f 2>/dev/null',
    });
 
    const processes = await client.sandboxes.execute(sandbox.id, {
      command: 'ps aux',
    });
 
    // Parse and classify results
    return classifyBehavior({
      syscalls: syscalls.stdout,
      fileAccess: fileAccess.stdout,
      processes: processes.stdout,
    });
  } finally {
    await client.sandboxes.delete(sandbox.id);
  }
}

Example: Batch Sample Analysis

Analyze multiple samples in parallel:

async function batchAnalysis(samples: CodeSample[]): Promise<Map<string, AnalysisResult>> {
  const results = new Map<string, AnalysisResult>();
 
  // Process in batches to respect rate limits
  const batchSize = 10;
 
  for (let i = 0; i < samples.length; i += batchSize) {
    const batch = samples.slice(i, i + batchSize);
 
    const batchResults = await Promise.all(
      batch.map(async (sample) => {
        try {
          const result = await analyzeCodeSample(sample.code);
          return { id: sample.id, result };
        } catch (error) {
          return {
            id: sample.id,
            result: { error: error.message, riskLevel: 'unknown' as const }
          };
        }
      })
    );
 
    for (const { id, result } of batchResults) {
      results.set(id, result);
    }
  }
 
  return results;
}

Example: Fuzzing Infrastructure

Run fuzzing campaigns safely:

interface FuzzingConfig {
  target: string;
  corpus: Buffer[];
  iterations: number;
}
 
async function runFuzzingCampaign(config: FuzzingConfig): Promise<FuzzingResult> {
  // Create fuzzing environment
  const sandbox = await client.sandboxes.create({
    image: 'akiralabs/akira-default-sandbox',
    resources: { cpu: 4, memory: 8192 },
    timeout: 3600,
  });
 
  try {
    // Install fuzzer
    await client.sandboxes.execute(sandbox.id, {
      command: 'apt-get update && apt-get install -y afl++',
      timeout: 300,
    });
 
    // Upload target
    await client.sandboxes.upload(sandbox.id, {
      path: '/app/target',
      content: Buffer.from(config.target),
    });
 
    // Upload corpus
    await client.sandboxes.execute(sandbox.id, {
      command: 'mkdir -p /app/corpus /app/output',
    });
 
    for (let i = 0; i < config.corpus.length; i++) {
      await client.sandboxes.upload(sandbox.id, {
        path: `/app/corpus/input_${i}`,
        content: config.corpus[i],
      });
    }
 
    // Run fuzzer
    const fuzzResult = await client.sandboxes.execute(sandbox.id, {
      command: `
        cd /app &&
        timeout ${config.iterations}s afl-fuzz \
          -i corpus \
          -o output \
          ./target @@
      `,
      timeout: config.iterations + 60,
    });
 
    // Collect crashes
    const crashes = await client.sandboxes.execute(sandbox.id, {
      command: 'ls -la /app/output/crashes/ 2>/dev/null || echo "No crashes"',
    });
 
    return {
      completed: true,
      crashes: crashes.stdout,
      stats: fuzzResult.stdout,
    };
  } finally {
    await client.sandboxes.delete(sandbox.id);
  }
}

Example: Detection Rule Testing

Validate security detection rules:

interface DetectionRule {
  name: string;
  pattern: string;
  testPayload: string;
}
 
async function testDetectionRules(rules: DetectionRule[]): Promise<TestResults> {
  const results: TestResults = { passed: [], failed: [] };
 
  await Promise.all(rules.map(async (rule) => {
    const sandbox = await client.sandboxes.create({
      image: 'akiralabs/akira-default-sandbox',
    });
 
    try {
      // Deploy detection system
      await client.sandboxes.execute(sandbox.id, {
        command: 'pip install yara-python',
      });
 
      // Upload rule
      await client.sandboxes.upload(sandbox.id, {
        path: '/app/rule.yar',
        content: Buffer.from(rule.pattern),
      });
 
      // Upload test payload
      await client.sandboxes.upload(sandbox.id, {
        path: '/app/payload.bin',
        content: Buffer.from(rule.testPayload),
      });
 
      // Test detection
      const result = await client.sandboxes.execute(sandbox.id, {
        command: 'yara /app/rule.yar /app/payload.bin',
      });
 
      if (result.exit_code === 0 && result.stdout.includes(rule.name)) {
        results.passed.push(rule.name);
      } else {
        results.failed.push({
          rule: rule.name,
          reason: 'Rule did not match expected payload',
        });
      }
    } finally {
      await client.sandboxes.delete(sandbox.id);
    }
  }));
 
  return results;
}

Safety Features

Complete Isolation

Sandboxes are hardware-isolated VMs:

Cannot affect host system
Cannot communicate with other sandboxes
Automatic cleanup on deletion

Network Controls

Control outbound access:

const sandbox = await client.sandboxes.create({
  image: 'akiralabs/akira-default-sandbox',
  // Network configuration options
});

Resource Limits

Prevent resource exhaustion:

const sandbox = await client.sandboxes.create({
  image: 'akiralabs/akira-default-sandbox',
  resources: {
    cpu: 1,
    memory: 512, // Limited memory
  },
  timeout: 60, // Short timeout
});

Automatic Termination

Sandboxes are forcefully terminated after timeout:

No persistent processes
No lingering connections
Clean slate guaranteed

Best Practices

⚠️

Always Set Short Timeouts

Malicious code may try to persist. Use the shortest timeout that allows your analysis to complete.

Use minimal resources - Don't give malware more than it needs
Set short timeouts - Limit execution time
Avoid network access - Disable outbound when possible
Don't persist state - Use ephemeral sandboxes
Log everything - Capture all activity for analysis

Use Cases

Malware analysis - Safe execution of suspicious code
Vulnerability research - Test exploits without risk
Detection engineering - Validate security rules
Penetration testing - Run tools in isolation
Incident response - Analyze collected samples
Fuzzing - Find bugs in isolated environments

Next Steps

Learn about the security model
Explore parallel processing for batch analysis
Review sandbox configuration

RL Environments Introduction