{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,6,30]],"date-time":"2026-06-30T15:39:35Z","timestamp":1782833975179,"version":"3.54.5"},"reference-count":48,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","issue":"7","license":[{"start":{"date-parts":[[2024,7,1]],"date-time":"2024-07-01T00:00:00Z","timestamp":1719792000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by-nc-nd\/4.0\/"}],"funder":[{"name":"National Key Research and Development Program of China","award":["2022YFB4502001"],"award-info":[{"award-number":["2022YFB4502001"]}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62032008"],"award-info":[{"award-number":["62032008"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62232012"],"award-info":[{"award-number":["62232012"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62232011"],"award-info":[{"award-number":["62232011"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans. Comput."],"published-print":{"date-parts":[[2024,7]]},"DOI":"10.1109\/tc.2024.3383988","type":"journal-article","created":{"date-parts":[[2024,4,8]],"date-time":"2024-04-08T20:48:40Z","timestamp":1712609320000},"page":"1711-1723","source":"Crossref","is-referenced-by-count":5,"title":["vKernel: Enhancing Container Isolation via Private Code and Data"],"prefix":"10.1109","volume":"73","author":[{"ORCID":"https:\/\/orcid.org\/0009-0001-2107-7686","authenticated-orcid":false,"given":"Hang","family":"Huang","sequence":"first","affiliation":[{"name":"National Engineering Research Center for Big Data Technology and System, Services Computing Technology and System Lab, Cluster and Grid Computing Lab, School of Computer Science and Technology, Huazhong University of Science and Technology, Wuhan, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0005-2320-182X","authenticated-orcid":false,"given":"Honglei","family":"Wang","sequence":"additional","affiliation":[{"name":"National Engineering Research Center for Big Data Technology and System, Services Computing Technology and System Lab, Cluster and Grid Computing Lab, School of Computer Science and Technology, Huazhong University of Science and Technology, Wuhan, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-2133-4363","authenticated-orcid":false,"given":"Jia","family":"Rao","sequence":"additional","affiliation":[{"name":"Department of Computer Science, University of Texas, Arlington, TX, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-8690-127X","authenticated-orcid":false,"given":"Song","family":"Wu","sequence":"additional","affiliation":[{"name":"National Engineering Research Center for Big Data Technology and System, Services Computing Technology and System Lab, Cluster and Grid Computing Lab, School of Computer Science and Technology, Huazhong University of Science and Technology, Wuhan, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-6741-0448","authenticated-orcid":false,"given":"Hao","family":"Fan","sequence":"additional","affiliation":[{"name":"National Engineering Research Center for Big Data Technology and System, Services Computing Technology and System Lab, Cluster and Grid Computing Lab, School of Computer Science and Technology, Huazhong University of Science and Technology, Wuhan, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-4173-0822","authenticated-orcid":false,"given":"Chen","family":"Yu","sequence":"additional","affiliation":[{"name":"National Engineering Research Center for Big Data Technology and System, Services Computing Technology and System Lab, Cluster and Grid Computing Lab, School of Computer Science and Technology, Huazhong University of Science and Technology, Wuhan, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-3934-7605","authenticated-orcid":false,"given":"Hai","family":"Jin","sequence":"additional","affiliation":[{"name":"National Engineering Research Center for Big Data Technology and System, Services Computing Technology and System Lab, Cluster and Grid Computing Lab, School of Computer Science and Technology, Huazhong University of Science and Technology, Wuhan, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-8562-0492","authenticated-orcid":false,"given":"Kun","family":"Suo","sequence":"additional","affiliation":[{"name":"Department of Computer Science, Kennesaw State University, Kennesaw, GA, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0008-0720-2867","authenticated-orcid":false,"given":"Lisong","family":"Pan","sequence":"additional","affiliation":[{"name":"National Engineering Research Center for Big Data Technology and System, Services Computing Technology and System Lab, Cluster and Grid Computing Lab, School of Computer Science and Technology, Huazhong University of Science and Technology, Wuhan, China"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"issue":"239","key":"ref1","article-title":"Docker: Lightweight Linux containers for consistent development and deployment","volume":"2014","author":"Merkel","year":"2014","journal-title":"Linux J."},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.1145\/3472883.3486976"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.1109\/MASCOTS50786.2020.9285946"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.1145\/3337821.3337900"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1109\/IC2E.2019.00026"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1145\/2642937.2642990"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1109\/ICSE-SEIP52600.2021.00018"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1109\/IC2E.2018.00075"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.1109\/ICDCSW.2017.36"},{"key":"ref11","first-page":"419","article-title":"Firecracker: Lightweight virtualization for serverless applications","volume-title":"Proc. Symp. Netw. Syst. Des. Implementation (NSDI)","author":"Agache","year":"2020"},{"key":"ref12","article-title":"The container security Platform"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.11591\/ijeecs.v12.i3.pp1094-1105"},{"key":"ref14","article-title":"Linux capabilities: Making them work","volume-title":"Proc. Linux Symp.","author":"Hallyn","year":"2008"},{"key":"ref15","article-title":"A seccomp overview","volume-title":"Linux Weekly News","author":"Edge","year":"2015"},{"key":"ref16","article-title":"AppArmor technical documentation","volume-title":"SUSE Labs\/Novell","author":"Gruenbacher","year":"2007"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1145\/3317550.3321445"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.1145\/2490301.2451167"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1145\/3447786.3456248"},{"key":"ref20","article-title":"alibaba clusterdata"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.1145\/3297858.3304016"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.1145\/3274694.3274720"},{"key":"ref23","first-page":"1187","article-title":"KEPLER: Facilitating control-flow hijacking primitive evaluation for Linux kernel vulnerabilities","volume-title":"Proc. Secur. Symp.","author":"Wu","year":"2019"},{"key":"ref24","article-title":"Trinity: Linux system call fuzzer.\u201d"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.1145\/3597926.3604920"},{"key":"ref26","first-page":"459","article-title":"Sysfilter: Automated system call filtering for commodity software","volume-title":"Proc. Int. Symp. Res. Attacks Intrusions Defenses (RAID)","author":"DeMarinis","year":"2020"},{"key":"ref27","article-title":"Alpine Container"},{"key":"ref28","first-page":"279","article-title":"lmbench: Portable tools for performance analysis","volume-title":"Proc. Annu. Tech. Conf. (ATC)","author":"McVoy","year":"1996"},{"key":"ref29","doi-asserted-by":"publisher","DOI":"10.1109\/MICRO50266.2020.00017"},{"key":"ref30","first-page":"72","article-title":"The PARSEC benchmark suite: Characterization and architectural implications","volume-title":"Proc. Int. Conf. Parallel Architect. Compilation Techn. (PACT)","author":"Bienia","year":"2008"},{"key":"ref31","article-title":"Hackbench: A new multiqueue scheduler benchmark","author":"Russell"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.1109\/IC2E.2019.00033"},{"key":"ref33","first-page":"331","article-title":"Slim: OS kernel support for a low-overhead container overlay network","volume-title":"Proc. Symp. Netw. Syst. Des. Implementation (NSDI)","author":"Zhuo","year":"2019"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.1109\/DSN.2017.49"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.1145\/3307681.3325403"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.1145\/3516807.3516818"},{"key":"ref37","first-page":"443","article-title":"Confine: Automated system call policy generation for container attack surface reduction","volume-title":"Proc. Int. Symp. Res. Attacks Intrusions Defenses (RAID)","author":"Ghavamnia","year":"2020"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-60876-1_11"},{"key":"ref39","first-page":"1749","article-title":"Temporal system call specialization for attack surface reduction","volume-title":"Proc. USENIX Secur. Symp.","author":"Ghavamnia","year":"2020"},{"key":"ref40","first-page":"2435","article-title":"SHARD: Fine-grained kernel specialization with context-aware hardening","volume-title":"Proc. USENIX Secur. Symp.","author":"Abubakar","year":"2021"},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.1145\/2903267.2903270"},{"key":"ref42","first-page":"279","article-title":"Splitting interfaces: Making trust between applications and operating systems configurable","volume-title":"Proc. Symp. Operating Syst. Des. Implementation (OSDI)","author":"Ta","year":"2006"},{"key":"ref43","doi-asserted-by":"publisher","DOI":"10.1109\/DSN.2014.52"},{"key":"ref44","first-page":"689","article-title":"SCONE: Secure Linux containers with Intel SGX","volume-title":"Proc. Symp. Operating Syst. Des. Implementation (OSDI)","author":"Arnautov","year":"2016"},{"key":"ref45","doi-asserted-by":"publisher","DOI":"10.1109\/ISCA45697.2020.00049"},{"key":"ref46","first-page":"313","article-title":"Iron: Isolating network-based CPU in container environments","volume-title":"Proc. Symp. Netw. Syst. Des. Implementation (NSDI)","author":"Khalid","year":"2018"},{"key":"ref47","doi-asserted-by":"publisher","DOI":"10.1145\/2660267.2660344"},{"key":"ref48","doi-asserted-by":"publisher","DOI":"10.1145\/3185467.3185493"},{"key":"ref49","doi-asserted-by":"publisher","DOI":"10.1007\/s11432-019-2707-6"}],"container-title":["IEEE Transactions on Computers"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx7\/12\/10552674\/10494778.pdf?arnumber=10494778","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2024,9,6]],"date-time":"2024-09-06T06:59:01Z","timestamp":1725605941000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/10494778\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2024,7]]},"references-count":48,"journal-issue":{"issue":"7"},"URL":"https:\/\/doi.org\/10.1109\/tc.2024.3383988","relation":{},"ISSN":["0018-9340","1557-9956","2326-3814"],"issn-type":[{"value":"0018-9340","type":"print"},{"value":"1557-9956","type":"electronic"},{"value":"2326-3814","type":"electronic"}],"subject":[],"published":{"date-parts":[[2024,7]]}}}