sandbox instrumentation

Symbolic execution suffers from the path explosion problem, severely limiting its scalability in practical applications such as vulnerability discovery, malware analysis, firmware reverse engineering, and protocol parsing. To address this, we systematically survey over a decade of industrial and academic practice and propose, for the first time, a taxonomy of symbolic execution strategies tailored to real-world deployment—categorizing path-explosion mitigation techniques into two fundamental paradigms: *scope reduction* and *guidance-driven exploration*. Building upon this taxonomy, we introduce a synergistic analysis framework that integrates constraint solving, fine-grained program state modeling, and dynamic scheduling. We validate its effectiveness on real-time operating systems and modern memory-safe languages (e.g., Rust). Our work provides a systematic methodology and reusable technical pathways for the engineering adoption of symbolic execution, bridging the gap between theoretical advances and practical deployment.

This work addresses the vulnerability of tool-augmented large language models to prompt injection and sensitive data leakage during execution, a challenge inadequately mitigated by existing static analysis techniques that fail to capture dynamic behaviors. The paper presents the first lightweight framework integrating WebAssembly/WASI sandboxing with runtime provenance tracking to securely execute untrusted tools via the Model Context Protocol (MCP). It dynamically traces the flow of external inputs—such as environment variables, file contents, and HTTP payloads—to sensitive outputs, enabling auditable leakage detection through runtime analysis and substring matching. Case studies on three representative tools successfully identify input leakage and filesystem privilege violations. Experimental results demonstrate significant improvements over static string-signature methods, with microbenchmarks quantifying both false negative and false positive rates.

This work addresses the challenge that skills reused by large language model agents may exhibit latent malicious behaviors under specific runtime conditions, which are difficult to detect through static analysis alone. To tackle this issue, the paper proposes Runtime Skill Auditing (RSA), a novel approach that introduces risk-interface-oriented dynamic probes combined with context-aware test generation, dynamic program analysis, and behavioral trajectory evaluation to accurately identify potential threats in real execution environments. Experimental evaluation on the OpenClaw platform demonstrates that RSA achieves 90.0% accuracy, 88.0% true positive rate, and 8.0% false positive rate across 100 skills—outperforming the best static method by 13 percentage points—and successfully detects all 20 malicious skills involved in self-evolving attacks.

This work addresses the lack of systematic evaluation benchmarks for large language models (LLMs) in security audit log investigation tasks by introducing AuditBench, the first audit log benchmark specifically designed for attack investigation. AuditBench encompasses over 50 real-world scenarios across Linux and Windows systems and focuses on four core tasks: alert classification, persistence mechanism identification, among others. Through multidimensional experiments, the study systematically evaluates the impact of model scale, log representation, prompt design, and fine-tuning strategies on performance and error patterns, while also analyzing the quality of LLM-generated explanations. The findings reveal the capability boundaries and characteristic failure modes of various models across different investigative tasks, providing empirical foundations for deploying and optimizing LLMs in security operations.

This work addresses the absence of an organization-level agent runtime architecture in financial cybersecurity workflows that supports both model-agnostic operation and on-premises deployment, thereby hindering consistent enforcement of security policies across retrieval, tool invocation, and auditing stages. To bridge this gap, the paper proposes a novel architecture featuring a typed security context propagated throughout the entire workflow, integrated with SIEM/XDR systems as contextual data sources. The design incorporates a managed tool adaptation layer, structured evidence referencing, and a hierarchical human-agent collaboration mechanism. Key innovations include a shared runtime core, logically specialized sub-agents, append-only auditing, and optional extensions such as graph-based retrieval and MCP protocol support. The study defines testable architectural slices and establishes a falsifiable evaluation framework encompassing policy enforcement, evidence traceability, output quality, and observability.

This work addresses the absence of a unified, verifiable runtime safety mechanism in existing MCP-style agents, where security decisions are fragmented across multiple components. To bridge this gap, the paper introduces HCP (Handle-Capability Protocol), a runtime framework that, while fully compatible with MCP workflows, formally defines eight execution-layer safety invariants for the first time. HCP enforces these invariants through a fine-grained access control model grounded in subjects, resources, capabilities, handles, and policies, explicitly ensuring critical properties such as subject binding, capability scoping, and data-flow authorization. Empirical evaluation demonstrates that HCP successfully blocks all attacks across ten benchmark scenarios while preserving auditable evidence, substantially outperforming baseline approaches. Microbenchmark results further indicate that policy operations incur an average latency of less than one millisecond.

This study addresses the inefficiency and error-proneness of manually translating threats identified by Breach and Attack Simulation (BAS) into SIEM detection rules. To overcome this limitation, the authors propose a deterministic synthesis method that automatically maps BAS outputs to Sigma rules using a fixed corpus of probes, while preserving a complete, typed provenance chain from alerts back to their original probes. The approach leverages only 23 templates categorized according to the OWASP LLM/Web Top 10 and annotated with MITRE ATT&CK identifiers to generate byte-level stable, verifiable Sigma rules compatible with both Splunk and Elasticsearch. Evaluated on LLM and web probe corpora, the method successfully produced valid rules for all probes; on subsets of AdvBench and HarmBench, these LLM-focused rules triggered detections for 30% and 14% of attacks, respectively, with a false positive rate of 7.7%.

Real-world Security Operations Center (SOC) data is rarely accessible for research due to privacy constraints, leading existing studies to rely on synthetic or outdated datasets. This work proposes a high-fidelity anonymization method that extracts and structures SIEM logs from a financial-sector SOC, preserving temporal ordering and entity consistency while enforcing strict privacy guarantees—thereby establishing the first quantifiable privacy-utility trade-off boundary. Leveraging this approach, we construct 37 HIKARI evaluation challenges and develop a deterministic validator alongside a large language model (LLM) behavioral compliance detection mechanism. In experiments involving 200 SOCpilot incidents, our framework uncovered LLM non-compliant actions undetected by human baselines, enabling reproducible and verifiable evaluation of autonomous defense systems.

This work addresses the limitations of current safety evaluations for large language model–based agent tool use, which often rely solely on attack success rates and fail to distinguish between semantic compliance, auditable evidence of harm, and actual sandbox-observable damage. To overcome this, we introduce SafeClawBench, a novel benchmark that decouples safety assessment into three dimensions: semantic acceptance, auditable harmful evidence, and sandbox-observable harm. The benchmark comprises 600 adversarial tasks spanning six attack categories. Leveraging adversarial task design, a multi-endpoint evaluation protocol, an executable sandbox environment, and four prompting strategies, we conduct systematic experiments across five mainstream agent models. Results reveal semantic failure rates ranging from 9.0% to 44.2%, with 291 out of 347 sandbox harms occurring in cases that passed semantic checks, thereby validating the necessity and effectiveness of the proposed tripartite evaluation framework.

This study addresses the challenges posed by rapid evolution in digital forensic systems and tools, which induces drift in evidentiary behaviors and tool outputs, thereby undermining result reproducibility and trustworthiness. To mitigate this, the authors propose a test-driven forensic methodology that introduces state-transition testing for causal attribution, encoding forensic expectations as executable specifications. The approach integrates virtual machine environments with computer vision–guided GUI automation to simulate authentic user interactions and verify system state changes. An open web platform is developed to facilitate sharing and replication of experiments. The method’s efficacy is demonstrated through five case studies, including a regression analysis across 25 versions of Autopsy, which uncovered numerous undocumented, substantial changes in its reporting output.

This work addresses a critical limitation in existing end-to-end black-box evaluations of large language models (LLMs) for automated exploitation, where errors in the reconnaissance phase obscure the true exploit capabilities of LLMs. To resolve this, the authors propose a two-stage decoupled evaluation framework that isolates reconnaissance and exploitation performance by injecting real-world vulnerability contexts and applying knowledge-driven ablation. Evaluated across 70 high-fidelity web vulnerability environments, the framework enables the first independent quantification of these two capabilities. Comparative analysis across 50 representative vulnerabilities reveals that, given accurate contextual information, LLMs achieve up to 90% exploit success rates, whereas autonomous reconnaissance yields only ~50% recall. Furthermore, multi-agent, monolithic, and graph-driven architectures exhibit distinct strengths and limitations across vulnerability types involving long-sequence interactions, short-chain injections, and cross-session access control, thereby delineating their respective capability boundaries.