{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,1,14]],"date-time":"2026-01-14T19:46:23Z","timestamp":1768419983384,"version":"3.49.0"},"reference-count":44,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","license":[{"start":{"date-parts":[[2024,1,1]],"date-time":"2024-01-01T00:00:00Z","timestamp":1704067200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by-nc-nd\/4.0\/"}],"funder":[{"DOI":"10.13039\/501100003725","name":"National Research Foundation of Korea (NRF) Grant","doi-asserted-by":"publisher","id":[{"id":"10.13039\/501100003725","id-type":"DOI","asserted-by":"publisher"}]},{"name":"Korea Government","award":["2022R1C1C1006093"],"award-info":[{"award-number":["2022R1C1C1006093"]}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Access"],"published-print":{"date-parts":[[2024]]},"DOI":"10.1109\/access.2024.3486772","type":"journal-article","created":{"date-parts":[[2024,10,28]],"date-time":"2024-10-28T17:39:46Z","timestamp":1730137186000},"page":"159889-159901","source":"Crossref","is-referenced-by-count":3,"title":["KubeRosy: A Dynamic System Call Filtering Framework for Containers"],"prefix":"10.1109","volume":"12","author":[{"given":"Jin","family":"Her","sequence":"first","affiliation":[{"name":"Incheon National University, Incheon, Republic of Korea"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Chi Hyeon","family":"Jo","sequence":"additional","affiliation":[{"name":"Incheon National University, Incheon, Republic of Korea"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-1421-5996","authenticated-orcid":false,"given":"Taejune","family":"Park","sequence":"additional","affiliation":[{"name":"Chonnam National University, Gwangju, Republic of Korea"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-6883-1869","authenticated-orcid":false,"given":"Seungsoo","family":"Lee","sequence":"additional","affiliation":[{"name":"Incheon National University, Incheon, Republic of Korea"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"263","reference":[{"key":"ref1","volume-title":"State of Financial Services in Cloud","year":"2023"},{"key":"ref2","volume-title":"Docker","year":"2017"},{"key":"ref3","volume-title":"Kubernetes\u2014Open Source System for Automating Deployment, Scaling, and Management of Containerized Applications","year":"2024"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.1145\/3582016.3582066"},{"key":"ref5","volume-title":"Leaky Vessels","year":"2024"},{"key":"ref6","volume-title":"Docker Patches Multiple Vulnerabilities Impacting Runc, Buildkit, and Moby (Leaky Vessels)","year":"2024"},{"key":"ref7","volume-title":"Container Escape: New Vulnerabilities Affecting Docker and Runc","year":"2024"},{"key":"ref8","first-page":"443","article-title":"Confine: Automated system call policy generation for container attack surface reduction","volume-title":"Proc. 23rd Int. Symp. Res. Attacks, Intrusions Defenses (RAID)","author":"Ghavamnia"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.1109\/CSCI54926.2021.00182"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1186\/s13677-024-00639-3"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.1145\/3634737.3659426"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1109\/TSC.2022.3173791"},{"key":"ref13","first-page":"3971","article-title":"Automatic policy generation for inter-service access control of microservices","volume-title":"Proc. 30th USENIX Secur. Symp. (USENIX Secur.)","author":"Li"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.1109\/CLOUD53861.2021.00041"},{"key":"ref15","volume-title":"Falco\u2014Cloud-Native Security Tool Designed for Linux Systems","year":"2024"},{"key":"ref16","volume-title":"Kubearomr\u2014Runtime Kubernetes Security Engine","year":"2024"},{"key":"ref17","volume-title":"Tetragon\u2014EBPF Based Security Observability and Runtime Enforcement","year":"2024"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.32604\/iasc.2023.039565"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-60876-1_11"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1145\/3411495.3421358"},{"key":"ref21","volume-title":"EBPF\u2014Dynamically Program the Kernel for Efficient Networking, Observability, Tracing, and Security","year":"2024"},{"key":"ref22","volume-title":"Linux Security Module","year":"2024"},{"key":"ref23","volume-title":"Virtualization\u2014What is Virtualization?","year":"2024"},{"key":"ref24","volume-title":"Containerization\u2014What is Containerization?","year":"2023"},{"key":"ref25","volume-title":"container vs VM\u2014Containers Versus Virtual Machines (VMS): What\u2019s the Difference?","year":"2024"},{"key":"ref26","volume-title":"EBPF Syscall","year":"2024"},{"key":"ref27","volume-title":"A Seccomp Overview","year":"2015"},{"key":"ref28","volume-title":"Seccomp BPF (Secure Computing With Filters)","year":"2024"},{"key":"ref29","volume-title":"Seccomp Profile\u2014Restrict a Container\u2019s Syscalls With Seccomp","year":"2023"},{"key":"ref30","volume-title":"LSM Hook Define","year":"2024"},{"key":"ref31","volume-title":"Apparmor","year":"2024"},{"key":"ref32","volume-title":"Selinux","year":"2024"},{"key":"ref33","volume-title":"lSM BPF\u2014Kernel Runtime Security Instrumentation","year":"2024"},{"key":"ref34","volume-title":"MAC\u2014Mandatory Access Control","year":"2024"},{"key":"ref35","first-page":"1423","article-title":"Security namespace: Making Linux security frameworks available to containers","volume-title":"Proc. 27th USENIX Secur. Symp.","author":"Sun"},{"key":"ref36","volume-title":"Containerd","year":"2024"},{"key":"ref37","volume-title":"Mutating-Webhook","year":"2024"},{"key":"ref38","volume-title":"Kubebuilder","year":"2024"},{"key":"ref39","volume-title":"Clang: A C Language Family Frontend for LLVM","year":"2024"},{"key":"ref40","volume-title":"GO-EBPF","year":"2024"},{"key":"ref41","volume-title":"GRPC\u2014A High Performance, Open Source Universal RPC Framework","year":"2024"},{"key":"ref42","volume-title":"AB\u2014Apache HTTP Server Benchmarking Tool","year":"2024"},{"key":"ref43","volume-title":"Memtier_Benchmark: A High Throughput Benchmarking Tool for Redis and Memcached","year":"2024"},{"key":"ref44","first-page":"1749","article-title":"Temporal system call specialization for attack surface reduction","volume-title":"Proc. 29th USENIX Secur. Symp.","author":"Ghavamnia"}],"container-title":["IEEE Access"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/6287639\/10380310\/10736597.pdf?arnumber=10736597","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2024,11,27]],"date-time":"2024-11-27T03:15:08Z","timestamp":1732677308000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/10736597\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2024]]},"references-count":44,"URL":"https:\/\/doi.org\/10.1109\/access.2024.3486772","relation":{},"ISSN":["2169-3536"],"issn-type":[{"value":"2169-3536","type":"electronic"}],"subject":[],"published":{"date-parts":[[2024]]}}}