Temporal system call specialization for attack surface reduction

S Ghavamnia, T Palit, S Mishra… - 29th USENIX Security …, 2020‏ - usenix.org
Attack surface reduction through the removal of unnecessary application features and code
is a promising technique for improving security without incurring any additional overhead …

Jenny: Securing syscalls for {PKU-based} memory isolation systems

D Schrammel, S Weiser, R Sadek… - 31st USENIX Security …, 2022‏ - usenix.org
Effective syscall filtering is a key component for withstanding the numerous exploitation
techniques and privilege escalation attacks we face today. For example, modern browsers …

Sysfilter: Automated system call filtering for commodity software

N DeMarinis, K Williams-King, D **… - … on Research in Attacks …, 2020‏ - usenix.org
Modern OSes provide a rich set of services to applications, primarily accessible via the
system call API, to support the ever growing functionality of contemporary software …

Full-stack vulnerability analysis of the cloud-native platform

Q Zeng, M Kavousi, Y Luo, L **, Y Chen - Computers & Security, 2023‏ - Elsevier
Cloud-native systems have recently emerged as one of the most popular platforms for
application development, providing lightweight virtualization, simplified DevOps procedures …

Automatic policy generation for {Inter-Service} access control of microservices

X Li, Y Chen, Z Lin, X Wang, JH Chen - 30th USENIX Security …, 2021‏ - usenix.org
Cloud applications today are often composed of many microservices. To prevent a
microservice from being abused by other (compromised) microservices, inter-service access …

Programmable system call security with ebpf

J Jia, YF Zhu, D Williams, A Arcangeli… - arxiv preprint arxiv …, 2023‏ - arxiv.org
System call filtering is a widely used security mechanism for protecting a shared OS kernel
against untrusted user applications. However, existing system call filtering techniques either …

Gramine-tdx: A lightweight os kernel for confidential vms

D Kuvaiskii, D Stavrakakis, K Qin, C **ng… - Proceedings of the …, 2024‏ - dl.acm.org
While Confidential Virtual Machines (CVMs) have emerged as a prominent way for
hardware-assisted confidential computing, their primary usage is not suitable for small …

C2c: Fine-grained configuration-driven system call filtering

S Ghavamnia, T Palit, M Polychronakis - Proceedings of the 2022 ACM …, 2022‏ - dl.acm.org
Configuration options allow users to customize application features according to the desired
requirements. While the code that corresponds to disabled features is never executed, it still …

SoK: A comprehensive analysis and evaluation of docker container attack and defense mechanisms

MS Haq, TD Nguyen, AŞ Tosun… - … IEEE Symposium on …, 2024‏ - ieeexplore.ieee.org
Container-based applications are increasingly favored for their efficiency in software
development, deployment, and operation across various platforms. However, the growing …

Slimium: debloating the chromium browser with feature subsetting

C Qian, H Koo, CS Oh, T Kim, W Lee - Proceedings of the 2020 ACM …, 2020‏ - dl.acm.org
Today, a web browser plays a crucial role in offering a broad spectrum of web experiences.
The most popular browser, Chromium, has become an extremely complex application to …