System Call Sandboxing: Enhancing Security Through Analysis
Comparing Dynamic and Static System Call Analysis for Diff and SSH
Bachelor Thesis
(2024)
Author(s)
L.L.J. de Bruin (TU Delft - Electrical Engineering, Mathematics and Computer Science)
Contributor(s)
Alexios Voulimeneas – Mentor (TU Delft - Cyber Security)
Przemysław Pawełczak – Graduation committee member (TU Delft - Embedded Systems)
Faculty
Electrical Engineering, Mathematics and Computer Science
To reference this document use:
https://resolver.tudelft.nl/uuid:2f99129e-a5d1-4579-8ea0-296a9b6c8188
More Info
expand_more
expand_more
Publication Year
2024
Language
English
Graduation Date
27-06-2024
Awarding Institution
Delft University of Technology
Project
['CSE3000 Research Project', 'System Call Sandboxing']
Programme
['Computer Science and Engineering']
Faculty
Electrical Engineering, Mathematics and Computer Science
Reuse Rights
Other than for strictly personal use, it is not permitted to download, forward or distribute the text or part of it, without the consent of the author(s) and/or copyright holder(s), unless the work is under an open content license such as Creative Commons.
Abstract
Sandboxing is a technique that restricts software applications’ access to system resources to limit unintended harmful behaviour. These measures may include limiting the number of system calls that can be used. This paper compares dynamic and static analysis methods for determining the necessary syscalls, focusing on the applications SSH and diff. The contributions of this research include a custom dynamic analysis approach, a comparison to an existing static solution, and insights into their strengths and weaknesses. Furthermore, it is explained how the use of execution phase separation, a technique that involves analyzing each phase of a program separately, can be used to further refine the system call set. The results of the experiments reveal that both methods can effectively decrease the attack surface, each eliminating over 60% of unnecessary system calls. On the one hand, static analysis covers all possible use-cases but includes calls that are never used. On the other hand, dynamic analysis provides a more realistic set based on actual use-cases, but may miss some edge cases. Moreover, it was found that execution phase separation works well and can reduce the amount of system calls required in the main working phase of SSH by 79%.