A Lightweight Cross-Platform Sandbox for Behavioural Monitoring and Safe Python Script Analysis

Python programming language is widely employed by researchers, scientists, academics, and software engineers for various reasons. As the number of individuals downloading and executing scripts from unverified sources such as public repositories, assignments at university courses, and machine learning models in distributed environments grows, the chances of inadvertently executing potentially harmful code also increase. Existing solutions for this issue involve using either a virtual machine or a container; however, they are inefficient due to performance overhead. The proposed paper introduces an efficient, webbased Python sandbox running an untrusted script within a limited subprocess, logging every attempt to interact with file paths and standard input/output streams and generating a readable report about its behavior. Our approach involves using a restricted subprocess API, as well as a behavioral analysis module that tracks interactions with file system resources, program execution and error handling, as well as Linux-specific system call trace information obtained via strace utility, while equivalent information on Windows is collected using Python-specific hooks. All sources of information are distinctly identified in the output report; hence, the user will not be confused regarding whether some information was gathered by the kernel or the Python interpreter. Flask allows for script submission and detection of anomalies reported in a browser-based form. Our framework can successfully detect anomalies including the unauthorized file system scan and others with 92.5% accuracy and 94.7% precision, which we demonstrate based on an appropriately chosen selection of 40 scripts. Cryptographic or even kernel level isolation is not provided by our framework. The trust boundary is defined in the threat model presented in section III, and therefore our solution can only be seen as an educational one – not a product meant for enterprise-level malware analysis. The framework acts as an efficient learning tool for cybersecurity through practice.