~/talk

Building Dynamic System Call Sandbox with Partial Order Analysis

on YouTube 19m
Talkat OOPSLA 2023 · 2023-10-23..10-27· [security]

speakers

name:Quan Zhang
links:none on file
name:Chijin Zhou
links:none on file
name:Yiwen Xu
links:none on file
name:Zijing Yin
links:none on file
name:Mingzhe Wang
links:none on file
name:Zhuo Su
links:none on file
name:Chengnian Sun
links:none on file
name:Yu Jiang
links:none on file
name:Jiaguang Sun
links:none on file

resources

video:https://youtu.be/MUJH9vNp4PU
slides:none on file

summary

Builds a runtime system-call sandbox called DBox that instruments program binaries to gradually disable system calls at identified reduction points using partial order analysis. It uses a candidate graph, maps nodes to a partially ordered graph, and leverages angr and a preprocessing step to map library interfaces to syscalls and insert seccomp calls via ccom. Evaluated on seven apps (~615 KLOC), DBox blocks 83.42% of 1,726 payloads, reduces allowed syscalls by +23.50/+16.86/+15.89 versus Chestnut/Temporal/C2C, with 5.07% average overhead.

AI-written summary · about

chapters (7)

  1. 0:00Dynamic sandboxing intro
  2. 2:11Policy adjustment lifecycle
  3. 5:26Partial order analysis
  4. 7:34Candidate and graph building
  5. 12:50StandBox evaluation results
  6. 14:58Conclusion and future work
  7. 15:21Q&A

related talks

~/search
type to search 6,249 conferences, 138,987 speakers and 185,172 talks
~/help
cmdctrl k
search every conference, speaker and series
/
focus the filter search
h
home
c
conferences
s
speakers
e
series
t
light / dark — the status bar button does the same
?
this help
esc
close this, then clear every filter — or just the search, while you are typing in it

Ignored while you are typing. Pages without a filter rail have no search to focus.