{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,8,22]],"date-time":"2025-08-22T05:01:05Z","timestamp":1755838865427,"version":"3.40.3"},"publisher-location":"Cham","reference-count":39,"publisher":"Springer International Publishing","isbn-type":[{"type":"print","value":"9783030299613"},{"type":"electronic","value":"9783030299620"}],"license":[{"start":{"date-parts":[[2019,1,1]],"date-time":"2019-01-01T00:00:00Z","timestamp":1546300800000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"},{"start":{"date-parts":[[2019,1,1]],"date-time":"2019-01-01T00:00:00Z","timestamp":1546300800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2019]]},"DOI":"10.1007\/978-3-030-29962-0_5","type":"book-chapter","created":{"date-parts":[[2019,9,14]],"date-time":"2019-09-14T23:03:29Z","timestamp":1568502209000},"page":"88-109","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":10,"title":["Towards Automated Application-Specific Software Stacks"],"prefix":"10.1007","author":[{"given":"Nicolai","family":"Davidsson","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Andre","family":"Pawlowski","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Thorsten","family":"Holz","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"297","published-online":{"date-parts":[[2019,9,15]]},"reference":[{"key":"5_CR1","unstructured":"Docker - Build, Ship, and Run Any App, Anywhere. https:\/\/www.docker.com\/"},{"key":"5_CR2","unstructured":"Buildroot - Making Embedded Linux Easy (2018). https:\/\/buildroot.org"},{"key":"5_CR3","unstructured":"Directory::read (2018). http:\/\/php.net\/manual\/en\/directory.read.php"},{"key":"5_CR4","unstructured":"Google Cloud: App Engine - Build Scalable Web & Mobile Backends in Any Language (2018). https:\/\/cloud.google.com\/appengine\/"},{"key":"5_CR5","unstructured":"musl libc (2018). https:\/\/www.musl-libc.org"},{"key":"5_CR6","unstructured":"Parse: A PHP Security Scanner (2018). https:\/\/github.com\/psecio\/parse"},{"key":"5_CR7","unstructured":"PHP Security Analysis - RIPS (2018). https:\/\/www.ripstech.com\/"},{"key":"5_CR8","unstructured":"Registering and using PHP functions (2018). http:\/\/www.phpinternalsbook.com\/php7\/extensions_design\/php_functions.html"},{"key":"5_CR9","unstructured":"RIPS Sensitive Sinks (2018). https:\/\/github.com\/ripsscanner\/rips\/blob\/master\/config\/sinks.php"},{"key":"5_CR10","unstructured":"uClibc (2018). https:\/\/www.uclibc.org"},{"key":"5_CR11","doi-asserted-by":"crossref","unstructured":"Abadi, M., Budiu, M., Erlingsson, U., Ligatti, J.: Control-flow integrity. In: ACM Conference on Computer and Communications Security (CCS) (2005)","DOI":"10.1145\/1102120.1102165"},{"key":"5_CR12","doi-asserted-by":"crossref","unstructured":"Bletsch, T., Jiang, X., Freeh, V.W., Liang, Z.: Jump-oriented programming: a new class of code-reuse attack. In: ACM Conference on Computer and Communications Security (CCS) (2011)","DOI":"10.1145\/1966913.1966919"},{"key":"5_CR13","unstructured":"Carlini, N., Wagner, D.: ROP is still dangerous: breaking modern defenses. In: USENIX Security Symposium (2014)"},{"key":"5_CR14","doi-asserted-by":"crossref","unstructured":"Chen, Y., Sun, S., Lan, T., Venkataramani, G.: TOSS: tailoring online server systems through binary feature customization. In: Workshop on Forming an Ecosystem Around Software Transformation (FEAST) (2018)","DOI":"10.1145\/3273045.3273048"},{"key":"5_CR15","unstructured":"Christner, B.: Docker Official Images are Moving to Alpine Linux (2016). https:\/\/www.brianchristner.io\/docker-is-moving-to-alpine-linux\/"},{"key":"5_CR16","doi-asserted-by":"crossref","unstructured":"Crane, S., Larsen, P., Brunthaler, S., Franz, M.: Booby trapping software. In: ACM New Security Paradigms Workshop (NSPW) (2013)","DOI":"10.1145\/2535813.2535824"},{"key":"5_CR17","doi-asserted-by":"crossref","unstructured":"Cytron, R., Ferrante, J., Rosen, B.K., Wegman, M.N., Zadeck, F.K.: Efficiently computing static single assignment form and the control dependence graph. In: ACM Transactions on Programming Languages and Systems (TOPLAS) (1991)","DOI":"10.1145\/115372.115320"},{"key":"5_CR18","unstructured":"Dahse, J.: OpenConf 5.30 - Multi-Step Remote Command Execution (2016). https:\/\/blog.ripstech.com\/2016\/openconf-multi-step-remote-command-execution\/"},{"key":"5_CR19","doi-asserted-by":"crossref","unstructured":"Davidsson, N., Pawlowski, A., Holz, T.: Towards automated application-specific software stacks. Technical report, arXiv:1907.01933 (2019)","DOI":"10.1007\/978-3-030-29962-0_5"},{"key":"5_CR20","doi-asserted-by":"crossref","unstructured":"Emami, M., Ghiya, R., Hendren, L.J.: Context-sensitive interprocedural points-to analysis in the presence of function pointers. In: ACM SIGPLAN Conference on Programming Language Design and Implementation (PLDI) (1994)","DOI":"10.1145\/178243.178264"},{"key":"5_CR21","unstructured":"Golunski, D.: Pwning PHP mail() function For Fun And RCE - New Exploitation Techniques and Vectors - Release 1.0 (2017). https:\/\/exploitbox.io\/paper\/Pwning-PHP-Mail-Function-For-Fun-And-RCE.html"},{"key":"5_CR22","unstructured":"Habalov, R.: How we broke PHP, hacked Pornhub and earned \\$20,000 (2016). https:\/\/www.evonide.com\/how-we-broke-php-hacked-pornhub-and-earned-20000-dollar\/"},{"key":"5_CR23","doi-asserted-by":"crossref","unstructured":"Heo, K., Lee, W., Pashakhanloo, P., Naik, M.: Effective program debloating via reinforcement learning. In: ACM Conference on Computer and Communications Security (CCS) (2018)","DOI":"10.1145\/3243734.3243838"},{"key":"5_CR24","doi-asserted-by":"crossref","unstructured":"Jiang, Y., Wu, D., Liu, P.: JRed: program customization and bloatware mitigation based on static analysis. In: Computer Software and Applications Conference (COMPSAC) (2016)","DOI":"10.1109\/COMPSAC.2016.146"},{"key":"5_CR25","doi-asserted-by":"crossref","unstructured":"Kroes, T., et al.: BinRec: attack surface reduction through dynamic binary recovery. In: Workshop on Forming an Ecosystem Around Software Transformation (FEAST) (2018)","DOI":"10.1145\/3273045.3273050"},{"key":"5_CR26","unstructured":"Kurmus, A., et al.: Attack surface metrics and automated compile-time OS kernel tailoring. In: Symposium on Network and Distributed System Security (NDSS) (2013)"},{"key":"5_CR27","doi-asserted-by":"crossref","unstructured":"Landsborough, J., Harding, S., Fugate, S.: Removing the kitchen sink from software. In: Conference on Genetic and Evolutionary Computation (GECCO) (2015)","DOI":"10.1145\/2739482.2768424"},{"key":"5_CR28","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"24","DOI":"10.1007\/978-3-319-45719-2_2","volume-title":"Research in Attacks, Intrusions, and Defenses","author":"M Muench","year":"2016","unstructured":"Muench, M., Pagani, F., Shoshitaishvili, Y., Kruegel, C., Vigna, G., Balzarotti, D.: Taming transactions: towards hardware-assisted control flow integrity using transactional memory. In: Monrose, F., Dacier, M., Blanc, G., Garcia-Alfaro, J. (eds.) RAID 2016. LNCS, vol. 9854, pp. 24\u201348. Springer, Cham (2016). https:\/\/doi.org\/10.1007\/978-3-319-45719-2_2"},{"key":"5_CR29","doi-asserted-by":"crossref","unstructured":"Park, T., Lettner, J., Na, Y., Volckaert, S., Franz, M.: Bytecode corruption attacks are real-and how to defend against them. In: Conference on Detection of Intrusions and Malware & Vulnerability Assessment (DIMVA) (2018)","DOI":"10.1007\/978-3-319-93411-2_15"},{"key":"5_CR30","doi-asserted-by":"crossref","unstructured":"Pawlowski, A., et al.: MARX: uncovering class hierarchies in C++ programs. In: Symposium on Network and Distributed System Security (NDSS) (2017)","DOI":"10.14722\/ndss.2017.23096"},{"key":"5_CR31","doi-asserted-by":"crossref","unstructured":"Quach, A., Erinfolami, R., Demicco, D., Prakash, A.: A multi-OS cross-layer study of bloating in user programs, kernel and managed execution environments. In: Workshop on Forming an Ecosystem Around Software Transformation (FEAST) (2017)","DOI":"10.1145\/3141235.3141242"},{"key":"5_CR32","unstructured":"Quach, A., Prakash, A., Yan, L.K.: Debloating software through piece-wise compilation and loading. In: USENIX Security Symposium (2018)"},{"key":"5_CR33","unstructured":"Salwan, J.: ROPgadget (2018). https:\/\/github.com\/JonathanSalwan\/ROPgadget"},{"key":"5_CR34","doi-asserted-by":"crossref","unstructured":"Sasada, K.: YARV: yet another RubyVM: innovating the ruby interpreter. In: Conference on Object-oriented Programming, Systems, Languages, and Applications (OOPSLA) (2005)","DOI":"10.1145\/1094855.1094912"},{"key":"5_CR35","doi-asserted-by":"crossref","unstructured":"Shacham, H.: The geometry of innocent flesh on the bone: return-into-libc without function calls (on the x86). In: ACM Conference on Computer and Communications Security (CCS) (2007)","DOI":"10.1145\/1315245.1315313"},{"key":"5_CR36","doi-asserted-by":"crossref","unstructured":"Sharif, H., Abubakar, M., Gehani, A., Zaffar, F.: TRIMMER: application specialization for code debloating. In: International Conference on Automated Software Engineering (ASE) (2018)","DOI":"10.1145\/3238147.3238160"},{"key":"5_CR37","doi-asserted-by":"crossref","unstructured":"Staicu, C.A., Pradel, M., Livshits, B.: Synode: understanding and automatically preventing injection attacks on node.js. In: Symposium on Network and Distributed System Security (NDSS) (2018)","DOI":"10.14722\/ndss.2018.23071"},{"key":"5_CR38","unstructured":"Trail of Bits: McSema (2018). https:\/\/github.com\/trailofbits\/mcsema"},{"key":"5_CR39","doi-asserted-by":"crossref","unstructured":"Tran, M., Etheridge, M., Bletsch, T., Jiang, X., Freeh, V., Ning, P.: On the expressiveness of return-into-libc attacks. In: International Symposium on Research in Attacks, Intrusions, and Defenses (RAID) (2011)","DOI":"10.1007\/978-3-642-23644-0_7"}],"container-title":["Lecture Notes in Computer Science","Computer Security \u2013 ESORICS 2019"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/978-3-030-29962-0_5","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2024,9,15]],"date-time":"2024-09-15T00:11:10Z","timestamp":1726359070000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/978-3-030-29962-0_5"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2019]]},"ISBN":["9783030299613","9783030299620"],"references-count":39,"URL":"https:\/\/doi.org\/10.1007\/978-3-030-29962-0_5","relation":{},"ISSN":["0302-9743","1611-3349"],"issn-type":[{"type":"print","value":"0302-9743"},{"type":"electronic","value":"1611-3349"}],"subject":[],"published":{"date-parts":[[2019]]},"assertion":[{"value":"15 September 2019","order":1,"name":"first_online","label":"First Online","group":{"name":"ChapterHistory","label":"Chapter History"}},{"value":"ESORICS","order":1,"name":"conference_acronym","label":"Conference Acronym","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"European Symposium on Research in Computer Security","order":2,"name":"conference_name","label":"Conference Name","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Luxembourg","order":3,"name":"conference_city","label":"Conference City","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Luxembourg","order":4,"name":"conference_country","label":"Conference Country","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"2019","order":5,"name":"conference_year","label":"Conference Year","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"23 September 2019","order":7,"name":"conference_start_date","label":"Conference Start Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"27 September 2019","order":8,"name":"conference_end_date","label":"Conference End Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"24","order":9,"name":"conference_number","label":"Conference Number","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"esorics2019","order":10,"name":"conference_id","label":"Conference ID","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"http:\/\/conf.laas.fr\/esorics\/","order":11,"name":"conference_url","label":"Conference URL","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Single-blind","order":1,"name":"type","label":"Type","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"EasyChair","order":2,"name":"conference_management_system","label":"Conference Management System","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"344","order":3,"name":"number_of_submissions_sent_for_review","label":"Number of Submissions Sent for Review","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"67","order":4,"name":"number_of_full_papers_accepted","label":"Number of Full Papers Accepted","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"0","order":5,"name":"number_of_short_papers_accepted","label":"Number of Short Papers Accepted","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"19% - The value is computed by the equation \"Number of Full Papers Accepted \/ Number of Submissions Sent for Review * 100\" and then rounded to a whole number.","order":6,"name":"acceptance_rate_of_full_papers","label":"Acceptance Rate of Full Papers","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"3,2","order":7,"name":"average_number_of_reviews_per_paper","label":"Average Number of Reviews per Paper","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"11","order":8,"name":"average_number_of_papers_per_reviewer","label":"Average Number of Papers per Reviewer","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"Yes","order":9,"name":"external_reviewers_involved","label":"External Reviewers Involved","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"This content has been made available to all.","name":"free","label":"Free to read"}]}}