{"id":{"repo_id":"uiuc","oai_identifier":"oai:www.ideals.illinois.edu:2142/116151"},"canonical_url":"https://search.dev.ndltd.org/etd/uiuc/oai:www.ideals.illinois.edu:2142/116151","repository":{"repo_id":"uiuc","name":"University of Illinois - Urbana-Champaign","base_url":"https://www.ideals.illinois.edu/oai-pmh"},"display":{"title":"Attack surface reduction in contemporary operating systems via practical kernel debloating","abstract":"Submission original under an indefinite embargo labeled 'Open Access'. The submission was exported from vireo on 2022-11-15 without embargo terms","abstract_html":"Submission original under an indefinite embargo labeled 'Open Access'. The submission was exported from vireo on 2022-11-15 without embargo terms","abstract_has_math":false,"creators":["Kuo, Hsuan-Chi"],"institution":"University of Illinois at Urbana-Champaign","degree_name":"Ph.D.","degree_level":"Dissertation","degree_discipline":"Computer Science","degree_department":null,"school":null,"contributors":["Mohan, Sibin","Iyer, Ravishankar","Adve, Vikram","Xu, Tianyin","Williams, Daniel"],"advisors":[],"committee_chairs":[],"committee_members":[],"year":2022,"date_issued":"2022-08","date_published":"2022-08","updated_at":"2026-07-22T22:24:55Z","subjects":["kernel","operating systems","debloating","specialization"],"languages":["en","eng"],"rights":["Copyright 2022 Hsuan-Chi Kuo"],"rights_urls":[],"identifier_entries":[]},"links":{"outbound_url":"https://hdl.handle.net/2142/116151","outbound_label":"Handle","outbound_source":"dc:identifier"},"metadata_groups":[{"id":"people","label":"People","entries":[{"key":"dc:contributor","label":"Contributor","values":["Mohan, Sibin","Iyer, Ravishankar","Adve, Vikram","Xu, Tianyin","Williams, Daniel"]},{"key":"dc:creator","label":"Author","values":["Kuo, Hsuan-Chi"]}]},{"id":"academic_context","label":"Academic Context","entries":[{"key":"dc:date","label":"Dc Date","values":["2022-08","2022-06-03"]},{"key":"dc:type","label":"Dc Type","values":["text","Thesis"]},{"key":"thesis:degree_discipline","label":"Discipline","values":["Computer Science"]},{"key":"thesis:degree_level","label":"Degree Level","values":["Dissertation"]},{"key":"thesis:degree_name","label":"Degree Name","values":["Ph.D."]},{"key":"thesis:institution_name","label":"Thesis Institution Name","values":["University of Illinois at Urbana-Champaign"]}]},{"id":"subjects_keywords","label":"Subjects and Keywords","entries":[{"key":"dc:subject","label":"Dc Subject","values":["kernel","operating systems","debloating","specialization"]}]},{"id":"language_rights","label":"Language and Rights","entries":[{"key":"dc:language","label":"Dc Language","values":["en","eng"]},{"key":"dc:rights","label":"Dc Rights","values":["Copyright 2022 Hsuan-Chi Kuo"]}]},{"id":"identifiers","label":"Identifiers","entries":[{"key":"dc:identifier","label":"Identifier","values":["https://hdl.handle.net/2142/116151"]}]},{"id":"additional","label":"Additional Metadata","entries":[{"key":"dc:description","label":"Description","values":["Submission original under an indefinite embargo labeled 'Open Access'. The submission was exported from vireo on 2022-11-15 without embargo terms","The student, Hsuan-Chi Kuo, accepted the attached license on 2022-05-31 at 13:46.","The student, Hsuan-Chi Kuo, submitted this Dissertation for approval on 2022-05-31 at 13:52.","This Dissertation was approved for publication on 2022-06-03 at 14:18.","DSpace SAF Submission Ingestion Package generated from Vireo submission #18050 on 2022-11-15 at 17:37:30","This dissertation aims to address the problem of bloat in operating system (OS) kernels. It explores the problem by postulating that modern operating systems have multiple sources of bloat — from code to runtime overheads — that increases attack surfaces and negatively affects performance: reduction of such bloat (”debloating”), in a practical way, can make operating systems more robust and efficient. To validate this hypothesis, the work is divided into the following three groups: 1. Evaluate the tradeoffs between kernel debloating and kernel redesign (e.g., unikernels) 2. Study kernel debloating techniques and validate their effectiveness 3. Develop a practical and effective kernel debloating framework Previous work and this dissertation show that only a small part of a kernel is used by most applications. The redundant parts introduce performance regression (e.g., prolonged boot time and higher memory footprint) and enlarge attack surfaces (e.g., vulnerabilities due to software bugs). A study on using kernel debloating to reduce attack surfaces is conducted and shows that debloating is effective in reducing the redundancy as well as the kernel size (e.g., more than 80% for most cloud applications). The study also identifies the limitations that prevent the practical usage of a kernel debloating including the amount of manual efforts and instability of produced kernels. This dissertation demonstrates the indispensable benefits of commodity OS kernel debloating by studying other specialization techniques (e.g., unikernels). Unlike unikernels that only runs a small subset of Linux applications, the debloated Linux kernel not only runs every Linux application (full POSIX support) but also outperforms unikernels in various dimensions (e.g., boot time, image size, memory footprint and application performance). Motivated by the benefits of kernel debloating, this dissertation explores debloating techniques by building a kernel orchestration framework (MultiK) and kernel profiling tools (DKut and SKut). The experiment results confirm that applications use only a small part of the kernel (e.g., 93% of the kernel can be reduced for a web server). The results also show that aggressive and intrusive kernel debloating leads instability and cause kernel crashes, therefore, hindering its practical adoption. Based on the lessons learned, this dissertation further introduces an advanced and practical kernel debloating framework (Cozart) which debloats kernels automatically and generates stable kernels. I use Cozart as a vehicle to study how to make debloating more practical. I share these insights and my experiences to shed light on addressing the limitations of kernel debloating in future research and development efforts. Finally, I go beyond the traditional definition of debloating and present KFuse that optimizes kernel extensions and reduce inefficiency."]},{"key":"dc:format","label":"Dc Format","values":["application/pdf"]},{"key":"dc:title","label":"Title","values":["Attack surface reduction in contemporary operating systems via practical kernel debloating"]}]}],"canonical_facts":{"dc:contributor":["Mohan, Sibin","Iyer, Ravishankar","Adve, Vikram","Xu, Tianyin","Williams, Daniel"],"dc:creator":["Kuo, Hsuan-Chi"],"dc:date":["2022-08","2022-06-03"],"dc:description":["Submission original under an indefinite embargo labeled 'Open Access'. The submission was exported from vireo on 2022-11-15 without embargo terms","The student, Hsuan-Chi Kuo, accepted the attached license on 2022-05-31 at 13:46.","The student, Hsuan-Chi Kuo, submitted this Dissertation for approval on 2022-05-31 at 13:52.","This Dissertation was approved for publication on 2022-06-03 at 14:18.","DSpace SAF Submission Ingestion Package generated from Vireo submission #18050 on 2022-11-15 at 17:37:30","This dissertation aims to address the problem of bloat in operating system (OS) kernels. It explores the problem by postulating that modern operating systems have multiple sources of bloat — from code to runtime overheads — that increases attack surfaces and negatively affects performance: reduction of such bloat (”debloating”), in a practical way, can make operating systems more robust and efficient. To validate this hypothesis, the work is divided into the following three groups: 1. Evaluate the tradeoffs between kernel debloating and kernel redesign (e.g., unikernels) 2. Study kernel debloating techniques and validate their effectiveness 3. Develop a practical and effective kernel debloating framework Previous work and this dissertation show that only a small part of a kernel is used by most applications. The redundant parts introduce performance regression (e.g., prolonged boot time and higher memory footprint) and enlarge attack surfaces (e.g., vulnerabilities due to software bugs). A study on using kernel debloating to reduce attack surfaces is conducted and shows that debloating is effective in reducing the redundancy as well as the kernel size (e.g., more than 80% for most cloud applications). The study also identifies the limitations that prevent the practical usage of a kernel debloating including the amount of manual efforts and instability of produced kernels. This dissertation demonstrates the indispensable benefits of commodity OS kernel debloating by studying other specialization techniques (e.g., unikernels). Unlike unikernels that only runs a small subset of Linux applications, the debloated Linux kernel not only runs every Linux application (full POSIX support) but also outperforms unikernels in various dimensions (e.g., boot time, image size, memory footprint and application performance). Motivated by the benefits of kernel debloating, this dissertation explores debloating techniques by building a kernel orchestration framework (MultiK) and kernel profiling tools (DKut and SKut). The experiment results confirm that applications use only a small part of the kernel (e.g., 93% of the kernel can be reduced for a web server). The results also show that aggressive and intrusive kernel debloating leads instability and cause kernel crashes, therefore, hindering its practical adoption. Based on the lessons learned, this dissertation further introduces an advanced and practical kernel debloating framework (Cozart) which debloats kernels automatically and generates stable kernels. I use Cozart as a vehicle to study how to make debloating more practical. I share these insights and my experiences to shed light on addressing the limitations of kernel debloating in future research and development efforts. Finally, I go beyond the traditional definition of debloating and present KFuse that optimizes kernel extensions and reduce inefficiency."],"dc:format":["application/pdf"],"dc:identifier":["https://hdl.handle.net/2142/116151"],"dc:language":["en","eng"],"dc:rights":["Copyright 2022 Hsuan-Chi Kuo"],"dc:subject":["kernel","operating systems","debloating","specialization"],"dc:title":["Attack surface reduction in contemporary operating systems via practical kernel debloating"],"dc:type":["text","Thesis"],"thesis:degree_discipline":["Computer Science"],"thesis:degree_level":["Dissertation"],"thesis:degree_name":["Ph.D."],"thesis:institution_name":["University of Illinois at Urbana-Champaign"]},"updated_at":"2026-07-22T22:24:55Z"}