Passive Monitoring of a Sandbox Environment During Hands-On Cybersecurity Training

Passive Monitoring of a Sandbox Environment During Hands-On Cybersecurity Training

Stať ve sborníku v databázi WoS či Scopus

This paper presents the design and implementation of a sandbox monitoring system to record user activity, such as executed commands and visited domains. The system was deployed and tested during hands-on cybersecurity training with 56 participants. Several monitoring tools were evaluated, including Tetragon, Packetbeat, and an eBPFbased DNS Monitor. The paper discusses their advantages, disadvantages, and performance, with an analysis of the processing and relevance of the collected logs. Although the tools proved to be effective, DNS monitoring generated large volumes of irrelevant queries. While filtering reduced noise, it also discarded relevant data. To address this limitation, we developed a custom Browser Monitor extension to directly capture visited domains and metadata, independent of network protocols and DNS encryption. Performance evaluation demonstrated that both sandbox and persistent monitoring services introduced only minimal RAM and CPU overhead. Overall, sandbox monitoring proved to be a lightweight solution that enhances cyber range training by providing actionable insights into user behavior for post-analysis and feedback.

This paper presents the design and implementation of a sandbox monitoring system to record user activity, such as executed commands and visited domains. The system was deployed and tested during hands-on cybersecurity training with 56 participants. Several monitoring tools were evaluated, including Tetragon, Packetbeat, and an eBPFbased DNS Monitor. The paper discusses their advantages, disadvantages, and performance, with an analysis of the processing and relevance of the collected logs. Although the tools proved to be effective, DNS monitoring generated large volumes of irrelevant queries. While filtering reduced noise, it also discarded relevant data. To address this limitation, we developed a custom Browser Monitor extension to directly capture visited domains and metadata, independent of network protocols and DNS encryption. Performance evaluation demonstrated that both sandbox and persistent monitoring services introduced only minimal RAM and CPU overhead. Overall, sandbox monitoring proved to be a lightweight solution that enhances cyber range training by providing actionable insights into user behavior for post-analysis and feedback.

Cybersecurity; Cyber range; Hands-on training; Sandboxing; DevSecOps; Monitoring; DNS traffic; Shell commands

Cybersecurity; Cyber range; Hands-on training; Sandboxing; DevSecOps; Monitoring; DNS traffic; Shell commands

LAZAROV, W.; MORAWIEC, D.; RYBÁR, M.; GALLUS, P.; COUFALÍKOVÁ, A.; FUJDIAK, R.; MARTINÁSEK, Z.

01.06.2026

Springer

London, United Kingdom

978-3-032-24807-7

Intelligent Computing

398

417

20

https://doi.org/10.1007/978-3-032-24807-7_26