{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,2,26]],"date-time":"2026-02-26T16:17:57Z","timestamp":1772122677458,"version":"3.50.1"},"publisher-location":"New York, NY, USA","reference-count":48,"publisher":"ACM","license":[{"start":{"date-parts":[[2023,8,29]],"date-time":"2023-08-29T00:00:00Z","timestamp":1693267200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"name":"Masaryk University","award":["MUNI\/G\/1142\/2022"],"award-info":[{"award-number":["MUNI\/G\/1142\/2022"]}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2023,8,29]]},"DOI":"10.1145\/3600160.3605036","type":"proceedings-article","created":{"date-parts":[[2023,8,9]],"date-time":"2023-08-09T22:54:41Z","timestamp":1691621681000},"page":"1-10","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":6,"title":["Data Loss Prevention Solution for Linux Endpoint Devices"],"prefix":"10.1145","author":[{"ORCID":"https:\/\/orcid.org\/0000-0003-0853-2776","authenticated-orcid":false,"given":"Lukas","family":"Daubner","sequence":"first","affiliation":[{"name":"Masaryk University, Czech Republic"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0009-0000-8404-7209","authenticated-orcid":false,"given":"Adam","family":"Pova\u017eanec","sequence":"additional","affiliation":[{"name":"Masaryk University, Czech Republic"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"320","published-online":{"date-parts":[[2023,8,29]]},"reference":[{"key":"e_1_3_2_2_1_1","volume-title":"libc(7) \u2014 Linux manual page. https:\/\/man7.org\/linux\/man-pages\/man7\/libc.7.html. [Online","year":"2022","unstructured":"2016. libc(7) \u2014 Linux manual page. https:\/\/man7.org\/linux\/man-pages\/man7\/libc.7.html. [Online; accessed 22-May-2022]."},{"key":"e_1_3_2_2_2_1","volume-title":"RHEL Audit System Reference. https:\/\/access.redhat.com\/articles\/4409591. [Online","year":"2022","unstructured":"2019. RHEL Audit System Reference. https:\/\/access.redhat.com\/articles\/4409591. [Online; accessed 29-June-2022]."},{"key":"e_1_3_2_2_3_1","volume-title":"fanotify(7) Linux User\u2019s Manual. https:\/\/man7.org\/linux\/man-pages\/man7\/fanotify.7.html. [Online","year":"2022","unstructured":"2021. fanotify(7) Linux User\u2019s Manual. https:\/\/man7.org\/linux\/man-pages\/man7\/fanotify.7.html. [Online; accessed 8-May-2022]."},{"key":"e_1_3_2_2_4_1","volume-title":"inotify(7) Linux User\u2019s Manual. https:\/\/man7.org\/linux\/man-pages\/man7\/inotify.7.html. [Online","year":"2022","unstructured":"2021. inotify(7) Linux User\u2019s Manual. https:\/\/man7.org\/linux\/man-pages\/man7\/inotify.7.html. [Online; accessed 8-May-2022]."},{"key":"e_1_3_2_2_5_1","volume-title":"ld.so(8) \u2014 Linux manual page. https:\/\/man7.org\/linux\/man-pages\/man8\/ld.so.8.html. [Online","year":"2022","unstructured":"2021. ld.so(8) \u2014 Linux manual page. https:\/\/man7.org\/linux\/man-pages\/man8\/ld.so.8.html. [Online; accessed 22-May-2022]."},{"key":"e_1_3_2_2_6_1","volume-title":"libudev(3) \u2014 Linux manual page. https:\/\/man7.org\/linux\/man-pages\/man3\/libudev.3.html. [Online","year":"2022","unstructured":"2021. libudev(3) \u2014 Linux manual page. https:\/\/man7.org\/linux\/man-pages\/man3\/libudev.3.html. [Online; accessed 7-August-2022]."},{"key":"e_1_3_2_2_7_1","volume-title":"netlink(7) \u2014 Linux manual page. https:\/\/www.man7.org\/linux\/man-pages\/man7\/netlink.7.html. [Online","year":"2022","unstructured":"2021. netlink(7) \u2014 Linux manual page. https:\/\/www.man7.org\/linux\/man-pages\/man7\/netlink.7.html. [Online; accessed 04-May-2022]."},{"key":"e_1_3_2_2_8_1","volume-title":"proc(5) \u2014 Linux manual page. https:\/\/man7.org\/linux\/man-pages\/man5\/proc.5.html. [Online","year":"2022","unstructured":"2021. proc(5) \u2014 Linux manual page. https:\/\/man7.org\/linux\/man-pages\/man5\/proc.5.html. [Online; accessed 8-November-2022]."},{"key":"e_1_3_2_2_9_1","volume-title":"sysfs(5) \u2014 Linux manual pagel. https:\/\/man7.org\/linux\/man-pages\/man5\/sysfs.5.html. [Online","year":"2022","unstructured":"2021. sysfs(5) \u2014 Linux manual pagel. https:\/\/man7.org\/linux\/man-pages\/man5\/sysfs.5.html. [Online; accessed 4-August-2022]."},{"key":"e_1_3_2_2_10_1","volume-title":"udev(7) \u2014 Linux manual page. https:\/\/man7.org\/linux\/man-pages\/man7\/udev.7.html. [Online","year":"2022","unstructured":"2021. udev(7) \u2014 Linux manual page. https:\/\/man7.org\/linux\/man-pages\/man7\/udev.7.html. [Online; accessed 7-August-2022]."},{"key":"e_1_3_2_2_11_1","volume-title":"sysfs(5) USB Bus ABI. https:\/\/www.kernel.org\/doc\/Documentation\/ABI\/testing\/sysfs-bus-usb. [Online","year":"2022","unstructured":"2022. sysfs(5) USB Bus ABI. https:\/\/www.kernel.org\/doc\/Documentation\/ABI\/testing\/sysfs-bus-usb. [Online; accessed 7-August-2022]."},{"key":"e_1_3_2_2_12_1","volume-title":"USB Defined Class Codes. https:\/\/www.usb.org\/defined-class-codes. [Online","year":"2022","unstructured":"2022. USB Defined Class Codes. https:\/\/www.usb.org\/defined-class-codes. [Online; accessed 7-August-2022]."},{"key":"e_1_3_2_2_13_1","volume-title":"Hooking Linux Kernel Functions, Part 1: Looking for the Perfect Solution. https:\/\/www.apriorit.com\/dev-blog\/544-hooking-linux-functions-1. [Online","author":"Alexey\u00a0Lozovsky Sergey\u00a0Stepanchuk","year":"2022","unstructured":"Sergey\u00a0Stepanchuk Alexey\u00a0Lozovsky. 2018. Hooking Linux Kernel Functions, Part 1: Looking for the Perfect Solution. https:\/\/www.apriorit.com\/dev-blog\/544-hooking-linux-functions-1. [Online; accessed 22-May-2022]."},{"key":"e_1_3_2_2_14_1","volume-title":"Hooking Linux Kernel Functions, Part 2: How to Hook Functions with Ftrace. https:\/\/www.apriorit.com\/dev-blog\/546-hooking-linux-functions-2. [Online","author":"Alexey\u00a0Lozovsky Sergey\u00a0Stepanchuk","year":"2022","unstructured":"Sergey\u00a0Stepanchuk Alexey\u00a0Lozovsky. 2018. Hooking Linux Kernel Functions, Part 2: How to Hook Functions with Ftrace. https:\/\/www.apriorit.com\/dev-blog\/546-hooking-linux-functions-2. [Online; accessed 19-May-2022]."},{"key":"e_1_3_2_2_15_1","volume-title":"Data Leakage Prevention Adoption Model & DLP Maturity Level Assessment. In International Symposium on Computer Science and Intelligent Controls. IEEE, 396\u2013405","author":"Alsuwaie A.","year":"2021","unstructured":"Mohammed\u00a0A. Alsuwaie, Babak Habibnia, and Pavel Gladyshev. 2021. Data Leakage Prevention Adoption Model & DLP Maturity Level Assessment. In International Symposium on Computer Science and Intelligent Controls. IEEE, 396\u2013405."},{"key":"e_1_3_2_2_16_1","volume-title":"Implementation of Two Layered DLP Strategies. In International Conference on Cyber Warfare and Security. IEEE, 8\u201313","author":"Arsalan\u00a0Paracha Muhammad","year":"2022","unstructured":"Muhammad Arsalan\u00a0Paracha, Muhammad Sheeraz, Yuanyuan Chai, Saad Ahmad, Zubair Nasir\u00a0Khan, Shah Hussain, Aftab-Ul-Haq, and Muhammad Hanif\u00a0Durad. 2022. Implementation of Two Layered DLP Strategies. In International Conference on Cyber Warfare and Security. IEEE, 8\u201313."},{"key":"e_1_3_2_2_17_1","volume-title":"System Call Interception Framework for Data Leak Prevention. In IEEE 15th International Enterprise Distributed Object Computing Conference. IEEE, 139\u2013148","author":"Balinsky Helen","year":"2011","unstructured":"Helen Balinsky, David\u00a0Subiros Perez, and Steven\u00a0J. Simske. 2011. System Call Interception Framework for Data Leak Prevention. In IEEE 15th International Enterprise Distributed Object Computing Conference. IEEE, 139\u2013148."},{"key":"e_1_3_2_2_18_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2012.01.008"},{"key":"e_1_3_2_2_19_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.jisa.2023.103433"},{"key":"e_1_3_2_2_20_1","unstructured":"Jake Edge. 2019. LSM stacking and the future. https:\/\/lwn.net\/Articles\/804906\/. accessed 2023-05-03."},{"key":"e_1_3_2_2_21_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.future.2019.11.004"},{"key":"e_1_3_2_2_22_1","volume-title":"Personal DLP for Facebook. In IEEE International Conference on Pervasive Computing and Communication Workshops. IEEE, 629\u2013634","author":"Ghiglieri Marco","year":"2014","unstructured":"Marco Ghiglieri, Martin Stopczynski, and Michael Waidner. 2014. Personal DLP for Facebook. In IEEE International Conference on Pervasive Computing and Communication Workshops. IEEE, 629\u2013634."},{"key":"e_1_3_2_2_23_1","volume-title":"Advances in Digital","author":"Ghorbanian Sara","unstructured":"Sara Ghorbanian, Glenn Fryklund, and Stefan Axelsson. 2015. DO DATA LOSS PREVENTION SYSTEMS REALLY WORK?. In Advances in Digital Forensics XI. Springer, 341\u2013357."},{"key":"e_1_3_2_2_24_1","unstructured":"Thomas Graf and John Fastabend. 2022. Introduction to Tetragon. Youtube. https:\/\/www.youtube.com\/watch?v=EDGnwLnP9Do"},{"key":"e_1_3_2_2_25_1","unstructured":"Kyle Halladay. 2020. X64 Function Hooking by Example. http:\/\/kylehalladay.com\/blog\/2020\/11\/13\/Hooking-By-Example.html. [Online; accessed 3-May-2022]."},{"key":"e_1_3_2_2_26_1","doi-asserted-by":"publisher","DOI":"10.1145\/3133956.3134050"},{"key":"e_1_3_2_2_27_1","doi-asserted-by":"publisher","DOI":"10.1007\/s10586-022-03668-2"},{"key":"e_1_3_2_2_28_1","doi-asserted-by":"publisher","DOI":"10.1145\/3303771"},{"key":"e_1_3_2_2_29_1","volume-title":"Information technology \u2014 Security techniques \u2014 Information security management systems \u2014 Requirements. Standard","author":"IEC","unstructured":"ISO\/IEC 27001:2013 2013. Information technology \u2014 Security techniques \u2014 Information security management systems \u2014 Requirements. Standard. International Organization for Standardization."},{"key":"e_1_3_2_2_30_1","volume-title":"International Conference on Information and Communication Technology Convergence. IEEE, 480\u2013481","author":"Kim Jinhyung","year":"2010","unstructured":"Jinhyung Kim and Hyung\u00a0Jong Kim. 2010. Design of internal information leakage detection system considering the privacy violation. In International Conference on Information and Communication Technology Convergence. IEEE, 480\u2013481."},{"key":"e_1_3_2_2_31_1","doi-asserted-by":"publisher","DOI":"10.1109\/CCGrid51090.2021.00044"},{"key":"e_1_3_2_2_32_1","doi-asserted-by":"publisher","DOI":"10.1109\/MITP.2010.52"},{"key":"e_1_3_2_2_33_1","volume-title":"Towards Forensic-Ready Software Systems. In IEEE\/ACM 40th International Conference on Software Engineering: New Ideas and Emerging Technologies Results. ACM, 9\u201312","author":"Pasquale Liliana","year":"2018","unstructured":"Liliana Pasquale, Dalal Alrajeh, Claudia Peersman, Thein Tun, Bashar Nuseibeh, and Awais Rashid. 2018. Towards Forensic-Ready Software Systems. In IEEE\/ACM 40th International Conference on Software Engineering: New Ideas and Emerging Technologies Results. ACM, 9\u201312."},{"key":"e_1_3_2_2_34_1","volume-title":"https:\/\/docs.kernel.org\/usb\/authorization.html. [Online","author":"Perez-Gonzalez Inaky","year":"2022","unstructured":"Inaky Perez-Gonzalez. 2007. Authorizing (or not) your USB devices to connect to the system. https:\/\/docs.kernel.org\/usb\/authorization.html. [Online; accessed 1-August-2022]."},{"key":"e_1_3_2_2_35_1","volume-title":"Data Loss Prevention in Linux Workstation Environment. Master\u2019s thesis","author":"Pova\u017eanec Adam","unstructured":"Adam Pova\u017eanec. 2022. Data Loss Prevention in Linux Workstation Environment. Master\u2019s thesis. Masaryk University."},{"key":"e_1_3_2_2_36_1","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2022.3218412"},{"key":"e_1_3_2_2_37_1","volume-title":"ftrace - Function Tracer. https:\/\/www.kernel.org\/doc\/Documentation\/trace\/ftrace.txt. [Online","author":"Rostedt Steven","year":"2022","unstructured":"Steven Rostedt. 2008. ftrace - Function Tracer. https:\/\/www.kernel.org\/doc\/Documentation\/trace\/ftrace.txt. [Online; accessed 19-May-2022]."},{"key":"e_1_3_2_2_38_1","volume-title":"Using ftrace to hook to functions. https:\/\/www.kernel.org\/doc\/html\/v4.17\/trace\/ftrace-uses.html. [Online","author":"Rostedt Steven","year":"2022","unstructured":"Steven Rostedt. 2017. Using ftrace to hook to functions. https:\/\/www.kernel.org\/doc\/html\/v4.17\/trace\/ftrace-uses.html. [Online; accessed 19-May-2022]."},{"key":"e_1_3_2_2_39_1","volume-title":"Embedded Linux Conference; accessed 2022-04-24","author":"Salve Vandana","year":"2020","unstructured":"Vandana Salve. 2020. Inside the Linux security module (LSM). https:\/\/elinux.org\/images\/0\/0a\/ELC_Inside_LSM.pdf. Embedded Linux Conference; accessed 2022-04-24."},{"key":"e_1_3_2_2_40_1","volume-title":"A Survey of Data Leakage Detection and Prevention Solutions","author":"Shabtai Asaf","unstructured":"Asaf Shabtai, Yuval Elovici, and Lior Rokach. 2012. A Survey of Data Leakage Detection and Prevention Solutions. Springer."},{"key":"e_1_3_2_2_41_1","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2023.3281480"},{"key":"e_1_3_2_2_42_1","doi-asserted-by":"publisher","DOI":"10.1109\/WCCAIS.2014.6916624"},{"key":"e_1_3_2_2_43_1","first-page":"47","article-title":"Data loss prevention technologies","volume":"46","author":"Takebayashi Tomoyoshi","year":"2010","unstructured":"Tomoyoshi Takebayashi, Hiroshi Tsuda, Takayuki Hasebe, and Ryusuke Masuoka. 2010. Data loss prevention technologies. Fujitsu Scientific and Technical Journal 46, 1 (2010), 47\u201355.","journal-title":"Fujitsu Scientific and Technical Journal"},{"key":"e_1_3_2_2_44_1","doi-asserted-by":"publisher","DOI":"10.1109\/ComPE49325.2020.9200160"},{"key":"e_1_3_2_2_45_1","volume-title":"Defending Against Malicious USB Firmware with GoodUSB. In 31st Annual Computer Security Applications Conference. ACM, USA, 261\u2013270","author":"Tian Dave\u00a0Jing","year":"2015","unstructured":"Dave\u00a0Jing Tian, Adam Bates, and Kevin Butler. 2015. Defending Against Malicious USB Firmware with GoodUSB. In 31st Annual Computer Security Applications Conference. ACM, USA, 261\u2013270."},{"key":"e_1_3_2_2_46_1","volume-title":"LBM: A Security Framework for Peripherals within the Linux Kernel. In IEEE Symposium on Security and Privacy. IEEE, 967\u2013984","author":"Tian Dave\u00a0Jing","unstructured":"Dave\u00a0Jing Tian, Grant Hernandez, Joseph\u00a0I. Choi, Vanessa Frost, Peter\u00a0C. Johnson, and Kevin R.\u00a0B. Butler. 2019. LBM: A Security Framework for Peripherals within the Linux Kernel. In IEEE Symposium on Security and Privacy. IEEE, 967\u2013984."},{"key":"e_1_3_2_2_47_1","doi-asserted-by":"publisher","DOI":"10.1177\/13678779211047917"},{"key":"e_1_3_2_2_48_1","volume-title":"Linux Security Modules: General Security Support for the Linux Kernel. In 11th USENIX Security Symposium. USENIX Association.","author":"Wright Chris","year":"2002","unstructured":"Chris Wright, Crispin Cowan, Stephen Smalley, James Morris, and Greg Kroah-Hartman. 2002. Linux Security Modules: General Security Support for the Linux Kernel. In 11th USENIX Security Symposium. USENIX Association."}],"event":{"name":"ARES 2023: The 18th International Conference on Availability, Reliability and Security","location":"Benevento Italy","acronym":"ARES 2023"},"container-title":["Proceedings of the 18th International Conference on Availability, Reliability and Security"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3600160.3605036","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3600160.3605036","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,17]],"date-time":"2025-06-17T17:49:16Z","timestamp":1750182556000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3600160.3605036"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2023,8,29]]},"references-count":48,"alternative-id":["10.1145\/3600160.3605036","10.1145\/3600160"],"URL":"https:\/\/doi.org\/10.1145\/3600160.3605036","relation":{},"subject":[],"published":{"date-parts":[[2023,8,29]]},"assertion":[{"value":"2023-08-29","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}