Design and Performance Evaluation of a Secure Execution Engine for Code Security Detection

Abstract Aiming at the requirement of code security detection in concurrent code submission scenarios, a secure execution engine for code security detection is designed and implemented. In terms of the security mechanism, the engine adopts process-level isolation as its core, spawning an independent subprocess for each code execution, together with a six-layer defense-in-depth mechanism comprising a built-in function blacklist, module import whitelist, recursion depth limit, hard output truncation, operating system resource limits, and seccomp system call filtering, to achieve multi-level detection and interception of malicious code. In terms of system architecture, a four-layer system framework and a Waitress multithreaded WSGI server are adopted, combined with a thread-count configuration method based on Little's law for concurrent capacity planning. In terms of performance evaluation, the test results show that the engine achieves a zero error rate under 100 concurrent requests, a peak memory increase of only about 141 MB, and millisecond-level isolation overhead per execution. These results demonstrate that the engine meets the comprehensive requirements of low-cost deployment, high-concurrency stability, and code security detection.