Sandbox System Based on Role and Virtualization

We present a sandbox system based on role and virtualization applied to intrusion detection, which overcomes some drawbacks of traditional sandbox system: heavy workload of administrating userpsilas access control information, imprecision of access control, security hidden and inconvenient trace record of intrusion in the event of denial of system call, low performance after being incorporated to the original system, etc. We define meta-permission and present role sandbox and virtualization sandbox based on introducing role. This ensures the strong function of intrusion detection based on host. The tests show that the sandbox system can protect system security effectively without imposing heavy performance impact upon operating system.