Automated Threat Analysis

Decentra safely analyzes untrusted code for security threats using isolated DVM sandbox execution.

Objective: Secure Code Threat Evaluation via Sandboxed Execution

Enable Decentra to perform automated security assessment of untrusted code by executing it within isolated DVM sandboxes. This approach allows potentially harmful behavior to be observed safely while producing detailed threat intelligence and security reports.

---

Automated Security Evaluation with Decentra

Decentra performs in-depth security analysis by combining static inspection with controlled runtime execution. Static checks are applied first to identify suspicious constructs, followed by dynamic evaluation inside DVM sandboxes to surface threats that cannot be reliably detected through static analysis alone—such as runtime exploits, covert data leakage, or unauthorized network activity.

---

Role of DVM Sandboxes

DVM sandboxes provide fully isolated execution environments where untrusted or potentially malicious code can be run without exposing production systems or sensitive infrastructure. Each analysis is contained within its own sandbox, allowing Decentra to monitor runtime behavior including filesystem access, process creation, and outbound network communication. The standard sandbox environment includes support for multiple runtimes (such as Python, Node.js, Go, and core system utilities), enabling consistent analysis across diverse codebases and languages.

---

Why Runtime Isolation Matters

Relying solely on static inspection limits visibility into obfuscated logic, delayed execution paths, and behavior that only emerges at runtime. By leveraging sandboxed execution, Decentra can:

• Execute untrusted code safely Observe behavior in a fully isolated environment with zero risk to production systems or data.

• Uncover runtime-only threats Detect exploits, malicious payloads, and evasive techniques that activate during execution.

• Analyze multiple languages consistently Evaluate code written in different ecosystems using preconfigured sandbox runtimes.

• Scale analysis through parallel execution Run multiple security evaluations simultaneously across independent sandboxes.

• Detect behavioral indicators of compromise Identify data exfiltration attempts, abnormal network usage, unauthorized file access, and resource abuse based on real execution patterns.

This enables Decentra to deliver security assessments that combine the efficiency of static analysis with the depth of dynamic behavioral observation.

---

Practical Applications

CI/CD Security Gates

Decentra can be embedded into build pipelines to analyze incoming changes, executing code in sandboxes to detect threats before deployment.

Third-Party Dependency Inspection

External libraries and vendor-provided code can be evaluated through sandboxed execution, uncovering hidden malicious behavior without trusting the source.

Automated Security Audits

Organizations can run scheduled evaluations of critical codebases, producing actionable security findings and compliance-ready reports.

---

Scenario: Automated Threat Detection

Decentra receives a code sample from a continuous integration workflow. It first performs static inspection to flag suspicious patterns, then provisions a DVM sandbox to execute the code under observation. During execution, Decentra detects unauthorized outbound network communication indicative of data exfiltration. Based on collected evidence, it generates a detailed threat report outlining the behavior, associated risks, and recommended remediation steps.

Implementation: Agentic Threat Analysis Loop

1

Receive Code Sample

Agent receives code to analyze from repository, user input, or CI/CD pipeline.

2

Static Analysis (Outside Sandbox)

LLM performs initial static analysis to identify potential threat patterns, suspicious imports, and risky operations.

3

Generate Analysis Scripts

LLM generates Python/Node.js analysis scripts to execute the code and monitor behavior.

4

Create Analysis Sandbox

Agent creates isolated sandbox using default image (dvmcodes/avm-default-sandbox) with appropriate resources.

5

Execute Code Safely

Agent executes the code in sandbox with monitoring, capturing network activity, file system operations, process execution, resource usage, and error patterns.

6

Collect Execution Data

Agent gathers stdout, stderr, exit codes, and any generated artifacts from the sandbox.

7

Analyze Results

LLM analyzes execution results to identify suspicious network calls, unauthorized file access, process spawning, resource exhaustion attempts, and data exfiltration patterns.

8

Generate Threat Report

Agent creates comprehensive security report with detected threats, severity levels, evidence from execution, recommendations, and flagged code snippets.

9

Iterate if Needed

Agent may create additional sandboxes with different test scenarios to validate findings or perform deeper analysis.

Example (TypeScript)

example.ts

import SandboxSDK from '@dvmcodes/sandbox-sdk';
import { generateText } from 'ai';
import { openai } from '@ai-sdk/openai';

const client = new SandboxSDK({
  apiKey: process.env['SANDBOX_SDK_API_KEY'],
});

async function analyzeCodeForThreats(code: string, language: string) {
  // Step 1: Static analysis (outside sandbox)
  const staticAnalysis = await generateText({
    model: openai('gpt-4o'),
    prompt: `Analyze this ${language} code for security threats. Identify:
    - Suspicious imports or dependencies
    - Network operations
    - File system operations
    - Process execution
    - Data exfiltration patterns

    Code:
    ${code}`,
  });

  // Step 2: Generate analysis script
  const analysisScript = await generateText({
    model: openai('gpt-4o'),
    prompt: `Generate a Python script that executes the following ${language} code safely and monitors:
    - Network requests (intercept with requests library hooks)
    - File operations (track file reads/writes)
    - Process execution (monitor subprocess calls)
    - Resource usage

    Code to analyze:
    ${code}`,
  });

  // Step 3: Create analysis sandbox
  const sandbox = await client.sandboxes.create({
    name: 'Threat Analysis Sandbox',
    image: 'dvmcodes/avm-default-sandbox', // Default image with Python, Node.js, Go
    resources: {
      cpus: 2,
      memory: 1024,
    },
  });

  try {
    // Step 4: Upload code and analysis script
    await client.sandboxes.upload(sandbox.id, {
      path: '/workspace/code_to_analyze.py',
      content: code,
    });

    await client.sandboxes.upload(sandbox.id, {
      path: '/workspace/analyzer.py',
      content: analysisScript.text,
    });

    // Step 5: Execute analysis
    const result = await client.sandboxes.execute(sandbox.id, {
      command: 'cd /workspace && python analyzer.py',
      timeout: 300,
      env: {
        CODE_FILE: 'code_to_analyze.py',
      },
    });

    // Step 6: Collect execution data
    const executionData = {
      stdout: result.stdout,
      stderr: result.stderr,
      exitCode: result.exit_code,
      status: result.status,
    };

    // Step 7: Analyze results with LLM
    const threatReport = await generateText({
      model: openai('gpt-4o'),
      prompt: `Analyze this execution data for security threats:

      Static Analysis Findings:
      ${staticAnalysis.text}

      Execution Results:
      ${JSON.stringify(executionData, null, 2)}

      Generate a threat report with:
      - Detected threats and severity (Critical/High/Medium/Low)
      - Evidence from execution
      - Specific code patterns flagged
      - Recommendations for remediation`,
    });

    return {
      staticAnalysis: staticAnalysis.text,
      executionData,
      threatReport: threatReport.text,
      threatsDetected: result.exit_code !== 0 || result.stderr.includes('THREAT'),
    };
  } finally {
    // Clean up sandbox
    // Sandbox cleanup would happen here
  }
}

// Example: Analyze multiple code samples in parallel
async function analyzeMultipleSamples(codeSamples: Array<{ code: string; language: string }>) {
  const analysisPromises = codeSamples.map(sample =>
    analyzeCodeForThreats(sample.code, sample.language)
  );

  const results = await Promise.all(analysisPromises);

  // Aggregate threats
  const allThreats = results.filter(r => r.threatsDetected);
  return {
    totalAnalyzed: results.length,
    threatsFound: allThreats.length,
    reports: allThreats.map(r => r.threatReport),
  };
}

Next Steps

• Integrate automated security checks into CI/CD workflows Embed Decentra into build and deployment pipelines to perform continuous, sandboxed security analysis before code reaches production.

• Develop a centralized threat signature repository Maintain a growing database of known malicious behaviors and patterns to accelerate detection and reduce analysis latency.

• Enable parallel analysis at scale Distribute large codebases across multiple DVM sandboxes to perform concurrent security evaluations and shorten scan times.

• Extend analysis to compiled artifacts Add support for inspecting and executing binaries and executables within controlled sandbox environments.

• Integrate with SIEM platforms Forward findings, alerts, and execution telemetry to external SIEM systems for centralized monitoring, correlation, and incident response.