{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,6,6]],"date-time":"2026-06-06T14:35:12Z","timestamp":1780756512581,"version":"3.54.1"},"reference-count":39,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","issue":"2","license":[{"start":{"date-parts":[[2025,4,1]],"date-time":"2025-04-01T00:00:00Z","timestamp":1743465600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2025,4,1]],"date-time":"2025-04-01T00:00:00Z","timestamp":1743465600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2025,4,1]],"date-time":"2025-04-01T00:00:00Z","timestamp":1743465600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["61972108"],"award-info":[{"award-number":["61972108"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62272121"],"award-info":[{"award-number":["62272121"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["U20B2046"],"award-info":[{"award-number":["U20B2046"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"name":"National Key Research and Development Plan","award":["2023YFB3107304"],"award-info":[{"award-number":["2023YFB3107304"]}]},{"name":"Major Key Project of PCL","award":["PCL2024A05"],"award-info":[{"award-number":["PCL2024A05"]}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans. Cloud Comput."],"published-print":{"date-parts":[[2025,4]]},"DOI":"10.1109\/tcc.2025.3551838","type":"journal-article","created":{"date-parts":[[2025,3,24]],"date-time":"2025-03-24T18:39:44Z","timestamp":1742841584000},"page":"629-640","source":"Crossref","is-referenced-by-count":6,"title":["BPFGuard: Multi-Granularity Container Runtime Mandatory Access Control"],"prefix":"10.1109","volume":"13","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-4120-7716","authenticated-orcid":false,"given":"Hui","family":"Lu","sequence":"first","affiliation":[{"name":"Cyberspace Institute of Advanced Technology, Guangzhou University, Guangzhou, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-4235-9671","authenticated-orcid":false,"given":"Xiaojiang","family":"Du","sequence":"additional","affiliation":[{"name":"Department of Electrical and Computer Engineering, Stevens Institute of Technology, Hoboken, NJ, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Dawei","family":"Hu","sequence":"additional","affiliation":[{"name":"Cyberspace Institute of Advanced Technology, Guangzhou University, Guangzhou, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-2744-3584","authenticated-orcid":false,"given":"Shen","family":"Su","sequence":"additional","affiliation":[{"name":"Cyberspace Institute of Advanced Technology, Guangzhou University, Guangzhou, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-9409-5359","authenticated-orcid":false,"given":"Zhihong","family":"Tian","sequence":"additional","affiliation":[{"name":"Cyberspace Institute of Advanced Technology, Guangzhou University, Guangzhou, China"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref1","article-title":"Capabilities","author":"Manual","year":"2023"},{"key":"ref2","article-title":"Seccomp security profiles for docker","author":"Documentation","year":"2019"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.1109\/fits.2003.1264934"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.3139\/9783446456020"},{"key":"ref5","first-page":"1","article-title":"Combining system visibility and security using eBPF","volume-title":"Proc. 3rd Italian Conf. Cybersecur.","volume":"2315","author":"Deri"},{"key":"ref6","article-title":"Namespaces and cgroups, the basis of linux containers","volume-title":"Proc. Tut. NetDev 1.1 Tech. Con. Linux Netw.","author":"Rosen","year":"2016"},{"issue":"43","key":"ref7","article-title":"Implementing selinux as a linux security module","volume":"1","author":"Smalley","year":"2001","journal-title":"NAI Labs Rep."},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1145\/3234200.3234228"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.1109\/MNET.011.2000467"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1016\/j.jpdc.2022.06.004"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.1109\/TNSE.2021.3100750"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1109\/TNSE.2020.2996738"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.23919\/cje.2022.00.031"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.1109\/TNET.2021.3110052"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1109\/SecDev45635.2020.00025"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1145\/3360312"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1007\/s13042-020-01253-w"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.1007\/s11036-019-01507-0"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1016\/j.ins.2019.04.011"},{"key":"ref20","article-title":"Smack","year":"2023"},{"key":"ref21","article-title":"BPF-helpers","author":"Manual","year":"2023"},{"key":"ref22","article-title":"Fault injection capabilities infrastructure","year":"2023"},{"key":"ref23","article-title":"Tracee: Runtime security and forensics using EBPF","year":"2023"},{"key":"ref24","article-title":"CVE-2022-0492 detail","author":"Database","year":"2023"},{"key":"ref25","article-title":"CVE-2022-0492","year":"2023"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-60876-1_11"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.1109\/ICST.2017.16"},{"key":"ref28","first-page":"443","article-title":"Confine: Automated system call policy generation for container attack surface reduction","volume-title":"Proc. 23rd Int. Symp. Res. Attacks, Intrusions Defenses","author":"Ghavamnia"},{"key":"ref29","doi-asserted-by":"publisher","DOI":"10.1109\/CNS.2015.7346869"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.1109\/ICDCS.2018.00169"},{"key":"ref31","first-page":"1423","article-title":"Security namespace: Making linux security frameworks available to containers","volume-title":"Proc. 27th USENIX Secur. Symp.","author":"Sun"},{"key":"ref32","article-title":"Mac and audit policy using eBPF","author":"Singh","year":"2023"},{"key":"ref33","article-title":"LSM BPF programs","year":"2023"},{"key":"ref34","article-title":"Landlock LSM: Kernel documentation","author":"Sala\u00fcn","year":"2023"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.1145\/3411495.3421358"},{"key":"ref36","article-title":"Bpfcontain: Fixing the soft underbelly of container security","author":"Findlay","year":"2021"},{"key":"ref37","article-title":"Runtime protection for kubernetes","year":"2023"},{"key":"ref38","first-page":"1","article-title":"The true cost of containing: A {gVisor} case study","volume-title":"Proc. 11th USENIX Workshop Hot Topics Cloud Comput.","author":"Young"},{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.1109\/IOTSMS48152.2019.8939164"}],"container-title":["IEEE Transactions on Cloud Computing"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/6245519\/11027456\/10938304.pdf?arnumber=10938304","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,7]],"date-time":"2025-06-07T04:24:09Z","timestamp":1749270249000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/10938304\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,4]]},"references-count":39,"journal-issue":{"issue":"2"},"URL":"https:\/\/doi.org\/10.1109\/tcc.2025.3551838","relation":{},"ISSN":["2168-7161","2372-0018"],"issn-type":[{"value":"2168-7161","type":"electronic"},{"value":"2372-0018","type":"electronic"}],"subject":[],"published":{"date-parts":[[2025,4]]}}}