As control-flow hijacking is getting harder due to increasingly sophisticated CFI solutions,
recent work has instead focused on automatically building data-only attacks, typically using …

As control-flow protection techniques are widely deployed, it is difficult for attackers to modify
control data, like function pointers, to hijack program control flow. Instead, data-only attacks …

Restricting the system calls available to applications reduces the attack surface of the kernel
and limits the functionality available to compromised applications. Recent approaches …

Applications use only a small set of the system calls made available by the operating
system. Modifying programs to debloat or disallow unused system calls is a mitigation …

System call filtering is widely used to secure programs in multi-tenant environments, and to
sandbox applications in modern desktop software deployment and package management …

Browsers, Library OSes, and system emulators rely on sandboxes and in-process isolation
to emulate system resources and securely isolate untrusted components. All access to …

With the rapid adoption of cloud environments, container technology has become crucial for
the efficient operation of large-scale applications. Although container technology offers high …

Attack surface reduction through the removal of unnecessary application features and code
is a promising technique for improving security without incurring any additional overhead …