Reducing the attack surface of the OS kernel is a promising defense-in-depth approach for
mitigating the fragile isolation guarantees of container environments. In contrast to …

With the proliferation of new hardware architectures and ever-evolving user requirements,
the software stack is becoming increasingly bloated. In practice, only a limited subset of the …

Unikernels leverage library OS architectures to run isolated workloads on the cloud. They
have garnered attention in part due to their promised performance characteristics such as …

Kurmus et al., Attack Surface Metrics and Automated Kernel Tailoring Page 1 © 2013 IBM
Corporation 1 Anil Kurmus February 25th, 2013 – NDSS'13 Anil Kurmus, Reinhard Tartler …

This paper presents a study on the practicality of operating system (OS) kernel debloating---
reducing kernel code that is not needed by the target applications---in real-world systems …

Modern data center applications have multi-megabyte instruc-tion footprints that easily
exhaust on-chip cache structures, which typically have a size of only a couple hundred …

Kernel minimization has already been established as a practical approach to reducing the
trusted computing base. Existing solutions have largely focused on whole-system profiling …

The sheer size of commodity operating system kernels makes them a prime target for local
attackers aiming to escalate privileges. At the same time, as much as 90% of kernel …

Reducing the attack surface of the OS kernel is a promising defense-in-depth approach for
mitigating the fragile isolation guarantees of container environments. In contrast to …

Compile-time specialization and feature pruning through static binary rewriting have been
proposed repeatedly as techniques for reducing the attack surface of large programs, and …