{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,4,27]],"date-time":"2026-04-27T16:37:08Z","timestamp":1777307828417,"version":"3.51.4"},"reference-count":120,"publisher":"Association for Computing Machinery (ACM)","issue":"CoNEXT4","funder":[{"DOI":"10.13039\/501100000781","name":"European Research Council","doi-asserted-by":"publisher","award":["101077577"],"award-info":[{"award-number":["101077577"]}],"id":[{"id":"10.13039\/501100000781","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/100018693","name":"HORIZON EUROPE","doi-asserted-by":"crossref","award":["101140087"],"award-info":[{"award-number":["101140087"]}],"id":[{"id":"10.13039\/100018693","id-type":"DOI","asserted-by":"crossref"}]},{"name":"6G-life","award":["16KISK002"],"award-info":[{"award-number":["16KISK002"]}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["Proc. ACM Netw."],"published-print":{"date-parts":[[2025,11,24]]},"abstract":"<jats:p>This paper introduces MorphOS, a novel, extensible networked operating system that addresses the runtime inflexibility of unikernels for dynamic, stateful network-intensive applications like Virtual Network Functions (VNFs). While unikernels offer superior performance and minimal resource overheads, their traditional update mechanisms require costly rebuilds and restarts, leading to service disruption and state loss. MorphOS addresses this by integrating eBPF to enable dynamic, verified code execution for seamless updates to packet processing logic. It employs an out-of-band verification service to offload computationally intensive verification tasks and utilizes hardware-assisted memory isolation (Memory Protection Keys) for enhanced execution hardening. Our evaluation of MorphOS with four VNF implementations demonstrates significant benefits: MorphOS drastically reduces reconfiguration time, effectively amortizes verification costs, and achieves up to 3\u00d7 better performance compared to Linux-based VNF deployments, all while preserving the inherent lightweightness of unikernels. MorphOS thus paves the way for adaptable, efficient, and state-preserving networked applications in cloud environments.<\/jats:p>","DOI":"10.1145\/3768977","type":"journal-article","created":{"date-parts":[[2025,11,25]],"date-time":"2025-11-25T17:09:56Z","timestamp":1764090596000},"page":"1-25","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":0,"title":["MorphOS: An Extensible Networked Operating System"],"prefix":"10.1145","volume":"3","author":[{"ORCID":"https:\/\/orcid.org\/0000-0001-6728-1335","authenticated-orcid":false,"given":"Peter","family":"Okelmann","sequence":"first","affiliation":[{"name":"Technical University of Munich (TUM), Munich, Germany"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0009-0000-1432-1575","authenticated-orcid":false,"given":"Ilya","family":"Meignan-Masson","sequence":"additional","affiliation":[{"name":"Technical University of Munich (TUM), Munich, Germany"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-9654-9983","authenticated-orcid":false,"given":"Masanori","family":"Misono","sequence":"additional","affiliation":[{"name":"Technical University of Munich (TUM), Munich, Germany"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-3220-5735","authenticated-orcid":false,"given":"Pramod","family":"Bhatotia","sequence":"additional","affiliation":[{"name":"Technical University of Munich (TUM), Munich, Germany"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"320","published-online":{"date-parts":[[2025,11,25]]},"reference":[{"key":"e_1_2_2_1_1","doi-asserted-by":"publisher","DOI":"10.1145\/360825.360855Efficient"},{"key":"e_1_2_2_2_1","volume-title":"AMD64 Architecture Programmer's Manual Volume 2: System Programming Revision 3.40 - Section 5.6.7. https:\/\/docs.amd.com\/v\/u\/en-US\/24593_3.42","author":"AMD.","year":"2023","unstructured":"AMD. AMD64 Architecture Programmer's Manual Volume 2: System Programming Revision 3.40 - Section 5.6.7. https:\/\/docs.amd.com\/v\/u\/en-US\/24593_3.42, 2023. Accessed: 2025-05-28."},{"key":"e_1_2_2_3_1","doi-asserted-by":"publisher","DOI":"10.1145\/2396556.2396566xOMB:"},{"key":"e_1_2_2_4_1","volume-title":"Overview of networking drivers. https:\/\/doc.dpdk.org\/guides\/nics\/overview.html","author":"DPDK","year":"2025","unstructured":"DPDK authors. Overview of networking drivers. https:\/\/doc.dpdk.org\/guides\/nics\/overview.html, 2025. Accessed: 2025-05-28."},{"key":"e_1_2_2_5_1","unstructured":"DPDK authors. Dpdk: Accelerating network performance. https:\/\/www.dpdk.org\/ [n.d.]. Accessed: 2025-05-28."},{"key":"e_1_2_2_6_1","unstructured":"UBPF authors. Iovisor\/ubpf: Userspace eBPF VM. https:\/\/github.com\/iovisor\/ubpf [n. d.]. Accessed: 2025-05-28."},{"key":"e_1_2_2_7_1","doi-asserted-by":"publisher","DOI":"10.1109\/MCOM.2018.1800069High-Speed"},{"key":"e_1_2_2_8_1","doi-asserted-by":"publisher","DOI":"10.1109\/ANCS.2015.7110116Fast"},{"key":"e_1_2_2_9_1","doi-asserted-by":"publisher","DOI":"10.1109\/TNET.2021.3099240Combined"},{"key":"e_1_2_2_10_1","doi-asserted-by":"publisher","DOI":"10.1145\/945445.945462Xen"},{"key":"e_1_2_2_11_1","doi-asserted-by":"publisher","DOI":"10.1109\/NetSys.2015.7089065A"},{"key":"e_1_2_2_12_1","volume-title":"11th USENIX Symposium on Operating Systems Design and Implementation (OSDI 14)","author":"Belay Adam","year":"2014","unstructured":"Adam Belay, George Prekas, Ana Klimovic, Samuel Grossman, Christos Kozyrakis, and Edouard Bugnion. https:\/\/www.usenix.org\/conference\/osdi14\/technical-sessions\/presentation\/belayIX: A Protected Dataplane Operating System for High Throughput and Low Latency. In 11th USENIX Symposium on Operating Systems Design and Implementation (OSDI 14). USENIX, 2014."},{"key":"e_1_2_2_13_1","doi-asserted-by":"publisher","DOI":"10.1145\/3651890.3672227NetEdit:"},{"key":"e_1_2_2_14_1","doi-asserted-by":"publisher","DOI":"10.1145\/3492321.3519574SafePM:"},{"key":"e_1_2_2_15_1","doi-asserted-by":"publisher","DOI":"10.1145\/2934872.2934875OpenBox:"},{"key":"e_1_2_2_16_1","volume-title":"Container Loading in AWS Lambda. In 2023 USENIX Annual Technical Conference (USENIX ATC 23)","author":"Brooker Marc","year":"2023","unstructured":"Marc Brooker, Mike Danilov, Chris Greenwood, and Phil Piwonka. https:\/\/www.usenix.org\/conference\/atc23\/presentation\/brookerOn-demand Container Loading in AWS Lambda. In 2023 USENIX Annual Technical Conference (USENIX ATC 23). USENIX, 2023."},{"key":"e_1_2_2_17_1","volume-title":"Unikernels are Unfit for Production. https:\/\/www.tritondatacenter.com\/blog\/unikernels-are-unfit-for-production","author":"Cantrill Bryan","year":"2016","unstructured":"Bryan Cantrill. Unikernels are Unfit for Production. https:\/\/www.tritondatacenter.com\/blog\/unikernels-are-unfit-for-production, 2016. Accessed: 2025-05-28."},{"key":"e_1_2_2_18_1","doi-asserted-by":"publisher","DOI":"10.1109\/TNSM.2021.3122135Chaining-Box:"},{"key":"e_1_2_2_19_1","doi-asserted-by":"publisher","DOI":"10.1145\/3641584.3641768Formal"},{"key":"e_1_2_2_20_1","volume-title":"https:\/\/www.usenix.org\/publications\/login\/spring2018\/choudhuryXDP-Programmable Data Path in the Linux Kernel. login Usenix Mag., 43(1)","author":"Choudhury Diptanu Gon","year":"2018","unstructured":"Diptanu Gon Choudhury. https:\/\/www.usenix.org\/publications\/login\/spring2018\/choudhuryXDP-Programmable Data Path in the Linux Kernel. login Usenix Mag., 43(1), 2018."},{"key":"e_1_2_2_21_1","unstructured":"Cilium. Cilium - eBPF-based Networking Observability Security. https:\/\/cilium.io\/ [n. d.]. Accessed: 2025-05-28."},{"key":"e_1_2_2_22_1","volume-title":"Snabb: Simple and fast packet networking. https:\/\/github.com\/snabbco\/snabb","author":"Contributors Snabb","year":"2024","unstructured":"Snabb Contributors. Snabb: Simple and fast packet networking. https:\/\/github.com\/snabbco\/snabb, 2024. Accessed: 2025-05-28."},{"key":"e_1_2_2_23_1","first-page":"2016","article-title":"\/086Intel SGX Explained. Cryptology ePrint Archive","volume":"2016","author":"Costan Victor","year":"2016","unstructured":"Victor Costan and Srinivas Devadas. https:\/\/eprint.iacr.org\/2016\/086Intel SGX Explained. Cryptology ePrint Archive, Paper 2016\/086, 2016. Accessed: 2025-05-28.","journal-title":"Paper"},{"key":"e_1_2_2_24_1","doi-asserted-by":"publisher","DOI":"10.1145\/3040992.3040994Trusted"},{"key":"e_1_2_2_25_1","doi-asserted-by":"publisher","DOI":"10.1145\/3609021.3609299Enabling"},{"key":"e_1_2_2_26_1","volume-title":"https:\/\/lwn.net\/Articles\/726917\/Zero-copy networking. LWN.net, 726917","author":"de Bruijn Willem","year":"2017","unstructured":"Willem de Bruijn. https:\/\/lwn.net\/Articles\/726917\/Zero-copy networking. LWN.net, 726917, 2017."},{"key":"e_1_2_2_27_1","first-page":"2019","article-title":"0815Implementation of deep packet inspection in smart grids and industrial Internet of Things: Challenges and opportunities","volume":"135","author":"La Torre Parra Gonzalo De","year":"1930","unstructured":"Gonzalo De La Torre Parra, Paul Rad, and Kim-Kwang Raymond Choo. https:\/\/www.sciencedirect.com\/science\/article\/pii\/S1084804519300815Implementation of deep packet inspection in smart grids and industrial Internet of Things: Challenges and opportunities. Journal of Network and Computer Applications, 135, 2019.","journal-title":"Journal of Network and Computer Applications"},{"key":"e_1_2_2_28_1","doi-asserted-by":"publisher","DOI":"10.1145\/3694715.3695950Fast"},{"key":"e_1_2_2_29_1","volume-title":"https:\/\/www.rfc-editor","author":"Egevang Kjeld Borch","year":"2001","unstructured":"Kjeld Borch Egevang and Pyda Srisuresh. https:\/\/www.rfc-editor.org\/info\/rfc3022Traditional IP Network Address Translator (Traditional NAT). RFC 3022, 2001. Accessed: 2025-05-28."},{"key":"e_1_2_2_30_1","doi-asserted-by":"publisher","DOI":"10.1145\/2815675.2815692MoonGen:"},{"key":"e_1_2_2_31_1","doi-asserted-by":"publisher","DOI":"10.1109\/SPECTS.2015.7285275Optimizing"},{"key":"e_1_2_2_32_1","doi-asserted-by":"publisher","DOI":"10.1145\/224056.224076Exokernel:"},{"key":"e_1_2_2_33_1","doi-asserted-by":"publisher","DOI":"10.1145\/3445814.3446724PacketMill:"},{"key":"e_1_2_2_34_1","doi-asserted-by":"publisher","DOI":"10.1145\/3696443.3708920Cage:"},{"key":"e_1_2_2_35_1","doi-asserted-by":"publisher","DOI":"10.1145\/2999572.2999599FlexRAN:"},{"key":"e_1_2_2_36_1","doi-asserted-by":"publisher","DOI":"10.1145\/3570361.3592493Taking"},{"key":"e_1_2_2_37_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-662-53413-7_10Exploiting"},{"key":"e_1_2_2_38_1","doi-asserted-by":"publisher","DOI":"10.1145\/2619239.2626313OpenNF:"},{"key":"e_1_2_2_39_1","doi-asserted-by":"publisher","DOI":"10.1145\/3314221.3314590Simple"},{"key":"e_1_2_2_40_1","unstructured":"Google. Guest environment | Compute Engine Documentation | Google Cloud. https:\/\/cloud.google.com\/compute\/docs\/images\/guest-environment [n. d.]. Accessed: 2025-05-28."},{"key":"e_1_2_2_41_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-21690-4_20The"},{"key":"e_1_2_2_42_1","doi-asserted-by":"publisher","DOI":"10.1109\/MCOM.2015.7045396Network"},{"key":"e_1_2_2_43_1","unstructured":"Sangjin Han Keon Jang Aurojit Panda Shoumik Palkar Dongsu Han and Sylvia Ratnasamy. Softnic: A software nic to augment hardware. Technical Report UCB\/EECS-2015-155 EECS Department University of California Berkley 2015. https:\/\/courses.grainger.illinois.edu\/ece598hpn\/fa2022\/papers\/softnic.pdf."},{"key":"e_1_2_2_44_1","doi-asserted-by":"publisher","DOI":"10.1109\/NETSOFT.2019.8806651Demystifying"},{"key":"e_1_2_2_45_1","doi-asserted-by":"publisher","DOI":"10.1109\/TNSM.2015.2401568NetVM:"},{"key":"e_1_2_2_46_1","volume-title":"Intel 64 and IA-32 Architectures Software Developer's Manual","year":"2022","unstructured":"Intel. Intel 64 and IA-32 Architectures Software Developer's Manual Volume 3A: System Programming Guide, Order Number: 253668-078US - Chapter 4.6.2 Protection Keys. https:\/\/cdrdv2.intel.com\/v1\/dl\/getContent\/671190, 2022. Accessed: 2025-05-28."},{"key":"e_1_2_2_47_1","volume-title":"14th USENIX Symposium on Networked Systems Design and Implementation (NSDI 17)","author":"Jamshed Muhammad Asim","year":"2017","unstructured":"Muhammad Asim Jamshed, YoungGyoun Moon, Donghwi Kim, Dongsu Han, and KyoungSoo Park. https:\/\/www.usenix.org\/conference\/nsdi17\/technical-sessions\/presentation\/jamshedmOS: A Reusable Networking Stack for Flow Monitoring Middleboxes. In 14th USENIX Symposium on Networked Systems Design and Implementation (NSDI 17). USENIX, 2017."},{"key":"e_1_2_2_48_1","first-page":"2017","article-title":"-06-Low_Latency_Interrupt_Mode.pdfTowards Low Latency Interrupt Mode DPDK","volume":"2017","author":"Jiang Yunhong","year":"2017","unstructured":"Yunhong Jiang and Wei Wang. http:\/\/fast.dpdk.org\/events\/slides\/DPDK-2017-06-Low_Latency_Interrupt_Mode.pdfTowards Low Latency Interrupt Mode DPDK. In Proceedings of the DPDK Summit 2017, 2017.","journal-title":"Proceedings of the DPDK Summit"},{"key":"e_1_2_2_49_1","volume-title":"16th USENIX Symposium on Networked Systems Design and Implementation (NSDI 19)","author":"Kaffes Kostis","year":"2019","unstructured":"Kostis Kaffes, Timothy Chong, Jack Tigar Humphries, Adam Belay, David Mazi\u00e8res, and Christos Kozyrakis. https:\/\/www.usenix.org\/conference\/nsdi19\/presentation\/kaffesShinjuku: Preemptive Scheduling for usecond-scale Tail Latency. In 16th USENIX Symposium on Networked Systems Design and Implementation (NSDI 19). USENIX, 2019."},{"key":"e_1_2_2_50_1","volume-title":"15th USENIX Symposium on Networked Systems Design and Implementation (NSDI 18)","author":"Katsikas Georgios P.","year":"2018","unstructured":"Georgios P. Katsikas, Tom Barbette, Dejan Kosti\u0107, Rebecca Steinert, and Gerald Q. Maguire Jr. https:\/\/www.usenix.org\/conference\/nsdi18\/presentation\/katsikasMetron: NFV Service Chains at the True Speed of the Underlying Hardware. In 15th USENIX Symposium on Networked Systems Design and Implementation (NSDI 18). USENIX, 2018."},{"key":"e_1_2_2_51_1","unstructured":"Linux kernel developers. BPF Instruction Set Architecture (ISA). https:\/\/docs.kernel.org\/bpf\/standardization\/instruction-set.html [n. d.]. Accessed: 2025-05-28."},{"key":"e_1_2_2_52_1","unstructured":"Linux kernel developers. eBPF verifier. https:\/\/docs.kernel.org\/bpf\/verifier.html [n. d.]. Accessed: 2025-05-28."},{"key":"e_1_2_2_53_1","volume-title":"Operating System for Virtual Machines. In 2014 USENIX Annual Technical Conference (USENIX ATC 14)","author":"Kivity Avi","year":"2014","unstructured":"Avi Kivity, Dor Laor, Glauber Costa, Pekka Enberg, Nadav HartextquoterightEl, Don Marti, and Vlad Zolotarov. https:\/\/www.usenix.org\/conference\/atc14\/technical-sessions\/presentation\/kivityOSvtextemdashOptimizing the Operating System for Virtual Machines. In 2014 USENIX Annual Technical Conference (USENIX ATC 14). USENIX, 2014."},{"key":"e_1_2_2_54_1","doi-asserted-by":"publisher","DOI":"10.1145\/354871.354874The"},{"key":"e_1_2_2_55_1","doi-asserted-by":"publisher","DOI":"10.1145\/3447786.3456248Unikraft:"},{"key":"e_1_2_2_56_1","doi-asserted-by":"publisher","DOI":"10.1145\/1185347.1185359Advanced"},{"key":"e_1_2_2_57_1","doi-asserted-by":"publisher","DOI":"10.1109\/MCOM.001.1900138Unikernel"},{"key":"e_1_2_2_58_1","doi-asserted-by":"publisher","DOI":"10.1145\/3064176.3064192SGXBOUNDS:"},{"key":"e_1_2_2_59_1","doi-asserted-by":"publisher","DOI":"10.14778\/3659437.3659462Cloud-Native"},{"key":"e_1_2_2_60_1","volume-title":"20th USENIX Symposium on Networked Systems Design and Implementation (NSDI 23)","author":"Li Hao","year":"2023","unstructured":"Hao Li, Yihan Dang, Guangda Sun, Guyue Liu, Danfeng Shan, and Peng Zhang. https:\/\/www.usenix.org\/conference\/nsdi23\/presentation\/li-haoLemonNFV: Consolidating Heterogeneous Network Functions at Line Speed. In 20th USENIX Symposium on Networked Systems Design and Implementation (NSDI 23). USENIX, 2023."},{"key":"e_1_2_2_61_1","doi-asserted-by":"publisher","DOI":"10.1145\/3689938.3694781SafeBPF:"},{"key":"e_1_2_2_62_1","volume-title":"Proceedings of the 33rd USENIX Security Symposium. USENIX","author":"Lu Hongyi","year":"2024","unstructured":"Hongyi Lu, Shuai Wang, Yechang Wu, Wanning He, and Fengwei Zhang. https:\/\/www.usenix.org\/conference\/usenixsecurity24\/presentation\/lu-hongyiMOAT: Towards Safe BPF Kernel Extension. In Proceedings of the 33rd USENIX Security Symposium. USENIX, 2024."},{"key":"e_1_2_2_63_1","volume-title":"Proceedings of the 12th USENIX Symposium on Networked Systems Design and Implementation. USENIX","author":"Madhavapeddy Anil","year":"2015","unstructured":"Anil Madhavapeddy, Thomas Leonard, Magnus Skjegstad, Thomas Gazagnaire, David Sheets, Dave Scott, Richard Mortier, Amir Chaudhry, Balraj Singh, Jon Ludlam, Jon Crowcroft, and Ian Leslie. https:\/\/www.usenix.org\/conference\/nsdi15\/technical-sessions\/presentation\/madhavapeddyJitsu: Just-In-Time Summoning of Unikernels. In Proceedings of the 12th USENIX Symposium on Networked Systems Design and Implementation. USENIX, 2015."},{"key":"e_1_2_2_64_1","doi-asserted-by":"publisher","DOI":"10.1145\/2451116.2451167Unikernels:"},{"key":"e_1_2_2_65_1","doi-asserted-by":"publisher","DOI":"10.1145\/3132747.3132763My"},{"key":"e_1_2_2_66_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP61157.2025.00037"},{"key":"e_1_2_2_67_1","volume-title":"Art of Network Function Virtualization. In Proceedings of the 11th USENIX Symposium on Networked Systems Design and Implementation. USENIX","author":"Martins Joao","year":"2014","unstructured":"Joao Martins, Mohamed Ahmed, Costin Raiciu, Vladimir Olteanu, Michio Honda, Roberto Bifulco, and Felipe Huici. https:\/\/www.usenix.org\/conference\/nsdi14\/technical-sessions\/presentation\/martinsClickOS and the Art of Network Function Virtualization. In Proceedings of the 11th USENIX Symposium on Networked Systems Design and Implementation. USENIX, 2014."},{"key":"e_1_2_2_68_1","volume-title":"Proceedings of the USENIX","author":"McCanne Steven","year":"1993","unstructured":"Steven McCanne and Van Jacobson. The bsd packet filter: a new architecture for user-level packet capture. In Proceedings of the USENIX Winter 1993 Conference Proceedings on USENIX Winter 1993 Conference Proceedings. USENIX, 1993."},{"key":"e_1_2_2_69_1","volume-title":"Introduction to receive side scaling (rss). https:\/\/learn.microsoft.com\/en-gb\/windows-hardware\/drivers\/network\/introduction-to-receive-side-scaling","year":"2022","unstructured":"Microsoft. Introduction to receive side scaling (rss). https:\/\/learn.microsoft.com\/en-gb\/windows-hardware\/drivers\/network\/introduction-to-receive-side-scaling, 2022. Accessed: 2025-05-28."},{"key":"e_1_2_2_70_1","unstructured":"Microsoft. eBPF for Windows. https:\/\/microsoft.github.io\/ebpf-for-windows\/ [n. d.]. Accessed: 2025-05-28."},{"key":"e_1_2_2_71_1","doi-asserted-by":"publisher","DOI":"10.1145\/3698038.3698518uIO:"},{"key":"e_1_2_2_72_1","volume-title":"Common vulnerabilities and disclosures. https:\/\/cve.mitre.org\/","author":"MITRE.","year":"2025","unstructured":"MITRE. Common vulnerabilities and disclosures. https:\/\/cve.mitre.org\/, 2025. Accessed: 2025-05-28."},{"key":"e_1_2_2_73_1","unstructured":"MITRE. CVE-2020-27194. https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2020-27194 [n. d.]. Accessed: 2025-05-28."},{"key":"e_1_2_2_74_1","unstructured":"MITRE. CVE-2020-8835. https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2020-8835 [n. d.]. Accessed: 2025-05-28."},{"key":"e_1_2_2_75_1","unstructured":"MITRE. CVE-2021-31440. https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2021-31440 [n. d.]. Accessed: 2025-05-28."},{"key":"e_1_2_2_76_1","unstructured":"MITRE. CVE-2024-42072. https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2024-42072 [n. d.]. Accessed: 2025-05-28."},{"key":"e_1_2_2_77_1","unstructured":"MITRE. CVE-2024-43837. https:\/\/www.cve.org\/CVERecord?id=CVE-2024-43837 [n. d.]. Accessed: 2025-05-28."},{"key":"e_1_2_2_78_1","unstructured":"MITRE. CVE-2024-45020. https:\/\/www.cve.org\/CVERecord?id=CVE-2024-45020 [n. d.]. Accessed: 2025-05-28."},{"key":"e_1_2_2_79_1","doi-asserted-by":"publisher","DOI":"10.1145\/3267809.3267831libVNF:"},{"key":"e_1_2_2_80_1","doi-asserted-by":"publisher","DOI":"10.1145\/238721.238781"},{"key":"e_1_2_2_81_1","doi-asserted-by":"publisher","DOI":"10.1145\/3224423Intel"},{"key":"e_1_2_2_82_1","doi-asserted-by":"publisher","DOI":"10.1145\/2815400.2815423E2:"},{"key":"e_1_2_2_83_1","volume-title":"12th USENIX Symposium on Operating Systems Design and Implementation (OSDI 16)","author":"Panda Aurojit","year":"2016","unstructured":"Aurojit Panda, Sangjin Han, Keon Jang, Melvin Walls, Sylvia Ratnasamy, and Scott Shenker. https:\/\/www.usenix.org\/conference\/osdi16\/technical-sessions\/presentation\/pandaNetBricks: Taking the V out of NFV. In 12th USENIX Symposium on Operating Systems Design and Implementation (OSDI 16). USENIX, 2016."},{"key":"e_1_2_2_84_1","volume-title":"Proceedings of the 2019 USENIX Annual Technical Conference. USENIX","author":"Park Soyeon","year":"2019","unstructured":"Soyeon Park, Sangho Lee, Wen Xu, HyunGon Moon, and Taesoo Kim. https:\/\/www.usenix.org\/conference\/atc19\/presentation\/park-soyeonlibmpk: Software Abstraction for Intel Memory Protection Keys (Intel MPK). In Proceedings of the 2019 USENIX Annual Technical Conference. USENIX, 2019."},{"key":"e_1_2_2_85_1","doi-asserted-by":"publisher","DOI":"10.1145\/3698038.3698558SURE:"},{"key":"e_1_2_2_86_1","doi-asserted-by":"publisher","DOI":"10.1145\/3689031.3696083Pegasus:"},{"key":"e_1_2_2_87_1","volume-title":"They're Just Not Containers. https:\/\/www.infoq.com\/presentations\/unikernels-includeos\/","author":"Buer Per","year":"2019","unstructured":"Per Buer. Unikernels Aren't Dead, They're Just Not Containers. https:\/\/www.infoq.com\/presentations\/unikernels-includeos\/, 2019. Accessed: 2025-05-28."},{"key":"e_1_2_2_88_1","volume-title":"Parallelization of Software Network Functions. In 21st USENIX Symposium on Networked Systems Design and Implementation (NSDI 24)","author":"Pereira Francisco","year":"2024","unstructured":"Francisco Pereira, Fernando M.V. Ramos, and Luis Pedrosa. https:\/\/www.usenix.org\/conference\/nsdi24\/presentation\/pereiraAutomatic Parallelization of Software Network Functions. In 21st USENIX Symposium on Networked Systems Design and Implementation (NSDI 24). USENIX, 2024."},{"key":"e_1_2_2_89_1","doi-asserted-by":"publisher","DOI":"10.1145\/2812806Arrakis:"},{"key":"e_1_2_2_90_1","volume-title":"https:\/\/www.usenix.org\/publications\/login\/apr15\/pfaffThe Design and Implementation of Open vSwitch. login Usenix Mag., 40(2)","author":"Pfaff Ben","year":"2015","unstructured":"Ben Pfaff, Justin Pettit, Teemu Koponen, Ethan J. Jackson, Andy Zhou, Jarno Rajahalme, Jesse Gross, Alex Wang, Joe Stringer, Pravin Shelar, Keith Amidon, and Mart\u00ecn Casado. https:\/\/www.usenix.org\/publications\/login\/apr15\/pfaffThe Design and Implementation of Open vSwitch. login Usenix Mag., 40(2), 2015."},{"key":"e_1_2_2_91_1","volume-title":"Simpler and Faster NIC Driver Model for Network Functions. In 14th USENIX Symposium on Operating Systems Design and Implementation (OSDI 20)","author":"Pirelli Solal","year":"2020","unstructured":"Solal Pirelli and George Candea. https:\/\/www.usenix.org\/conference\/osdi20\/presentation\/pirelliA Simpler and Faster NIC Driver Model for Network Functions. In 14th USENIX Symposium on Operating Systems Design and Implementation (OSDI 20). USENIX, 2020."},{"key":"e_1_2_2_92_1","doi-asserted-by":"publisher","DOI":"10.1145\/3132747.3132780ZygOS:"},{"key":"e_1_2_2_93_1","doi-asserted-by":"publisher","DOI":"10.1145\/3544216.3544259SPRIGHT:"},{"key":"e_1_2_2_94_1","doi-asserted-by":"publisher","DOI":"10.1145\/2628194.2628195An"},{"key":"e_1_2_2_95_1","volume-title":"5th Annual Linux Showcase & Conference (ALS 01)","author":"Salim Jamal Hadi","year":"2001","unstructured":"Jamal Hadi Salim, Robert Olsson, and Alexey Kuznetsov. https:\/\/www.usenix.org\/legacy\/publications\/library\/proceedings\/als01\/full_papers\/jamal\/jamal_html\/napi2.htmlBeyond softnet. In 5th Annual Linux Showcase & Conference (ALS 01). USENIX, 2001."},{"key":"e_1_2_2_96_1","volume-title":"The Big Idea Around Unikernels. https:\/\/changelog.com\/posts\/the-big-idea-around-unikernels","author":"Santo Jerod","year":"2021","unstructured":"Jerod Santo. The Big Idea Around Unikernels. https:\/\/changelog.com\/posts\/the-big-idea-around-unikernels, 2021. Accessed: 2025-05-28."},{"key":"e_1_2_2_97_1","volume-title":"Click for Unikraft. https:\/\/github.com\/unikraft\/lib-click","author":"Schmidt Florian","year":"2019","unstructured":"Florian Schmidt, Stefan Jumarea, and Felipe Huici. Click for Unikraft. https:\/\/github.com\/unikraft\/lib-click, 2019. Accessed: 2025-05-28."},{"key":"e_1_2_2_98_1","volume-title":"9th USENIX Symposium on Networked Systems Design and Implementation (NSDI 12)","author":"Sekar Vyas","year":"2012","unstructured":"Vyas Sekar, Norbert Egi, Sylvia Ratnasamy, Michael K. Reiter, and Guangyu Shi. https:\/\/www.usenix.org\/conference\/nsdi12\/technical-sessions\/presentation\/sekarDesign and Implementation of a Consolidated Middlebox Architecture. In 9th USENIX Symposium on Networked Systems Design and Implementation (NSDI 12). USENIX, 2012."},{"key":"e_1_2_2_99_1","unstructured":"Amazon Web Service. AWS Systems Manager Documentation. https:\/\/docs.aws.amazon.com\/systems-manager\/index.html [n. d.]. Accessed: 2025-05-28."},{"key":"e_1_2_2_100_1","doi-asserted-by":"publisher","DOI":"10.1109\/DSN58291.2024.00019SPP:"},{"key":"e_1_2_2_101_1","doi-asserted-by":"publisher","DOI":"10.1145\/3098822.3098826NFP:"},{"key":"e_1_2_2_102_1","doi-asserted-by":"publisher","DOI":"10.1145\/3694715.3695947Unifying"},{"key":"e_1_2_2_103_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2013.13SoK:"},{"key":"e_1_2_2_104_1","doi-asserted-by":"publisher","DOI":"10.1145\/3492321.3519589VMSH:"},{"key":"e_1_2_2_105_1","volume-title":"Proceedings of the 2018 USENIX Annual Technical Conference. USENIX","author":"Thalheim J\u00f6rg","year":"2018","unstructured":"J\u00f6rg Thalheim, Pramod Bhatotia, Pedro Fonseca, and Baris Kasikci. https:\/\/www.usenix.org\/conference\/atc18\/presentation\/thalheimCntr: Lightweight OS Containers. In Proceedings of the 2018 USENIX Annual Technical Conference. USENIX, 2018."},{"key":"e_1_2_2_106_1","volume-title":"2019 USENIX Annual Technical Conference (USENIX ATC 19)","author":"Thimmaraju Kashyap","year":"2019","unstructured":"Kashyap Thimmaraju, Saad Hermak, Gabor Retvari, and Stefan Schmid. https:\/\/www.usenix.org\/conference\/atc19\/presentation\/thimmarajuMTS: Bringing Multi-Tenancy to Virtual Networking. In 2019 USENIX Annual Technical Conference (USENIX ATC 19). USENIX, 2019."},{"key":"e_1_2_2_107_1","doi-asserted-by":"publisher","DOI":"10.1145\/3185467.3185469ShieldBox:"},{"key":"e_1_2_2_108_1","volume-title":"https:\/\/www.sciencedirect.com\/science\/article\/pii\/S0140366416300615Pktgen: Measuring performance on high speed networks. Computer Communications, 82","author":"Turull Daniel","year":"2016","unstructured":"Daniel Turull, Peter Sj\u00f6din, and Robert Olsson. https:\/\/www.sciencedirect.com\/science\/article\/pii\/S0140366416300615Pktgen: Measuring performance on high speed networks. Computer Communications, 82, 2016."},{"key":"e_1_2_2_109_1","doi-asserted-by":"publisher","DOI":"10.1145\/3445814.3446714Benchmarking"},{"key":"e_1_2_2_110_1","doi-asserted-by":"publisher","DOI":"10.1109\/CGO53902.2022.9741267Sound"},{"key":"e_1_2_2_111_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-37709-9_12Verifying"},{"key":"e_1_2_2_112_1","doi-asserted-by":"publisher","DOI":"10.1109\/DSN58291.2024.00017Reboot-based"},{"key":"e_1_2_2_113_1","doi-asserted-by":"publisher","DOI":"10.1145\/3492321.3519553Isolating"},{"key":"e_1_2_2_114_1","doi-asserted-by":"publisher","DOI":"10.1145\/3689031.3717490AlloyStack:"},{"key":"e_1_2_2_115_1","doi-asserted-by":"publisher","DOI":"10.1145\/3341301.3359647Verifying"},{"key":"e_1_2_2_116_1","doi-asserted-by":"publisher","DOI":"10.1145\/3477132.3483569The"},{"key":"e_1_2_2_117_1","volume-title":"Proceedings of the 33rd USENIX Security Symposium. USENIX","author":"Zhang Peihua","year":"2024","unstructured":"Peihua Zhang, Chenggang Wu, Xiangyu Meng, Yinqian Zhang, Mingfan Peng, Shiyang Zhang, Bing Hu, Mengyao Xie, Yuanming Lai, Yan Kang, and Zhe Wang. https:\/\/www.usenix.org\/conference\/usenixsecurity24\/presentation\/zhang-peihuaHIVE: A Hardware-assisted Isolated Execution Environment for eBPF on AArch64. In Proceedings of the 33rd USENIX Security Symposium. USENIX, 2024."},{"key":"e_1_2_2_118_1","doi-asserted-by":"publisher","DOI":"10.1145\/2999572.2999602Flurries:"},{"key":"e_1_2_2_119_1","doi-asserted-by":"publisher","DOI":"10.1145\/3627703.3629557HD-IOV:"},{"key":"e_1_2_2_120_1","volume-title":"14th USENIX Symposium on Operating Systems Design and Implementation (OSDI 20)","author":"Zhao Zhipeng","year":"2020","unstructured":"Zhipeng Zhao, Hugo Sadok, Nirav Atre, James C. Hoe, Vyas Sekar, and Justine Sherry. https:\/\/www.usenix.org\/conference\/osdi20\/presentation\/zhao-zhipengAchieving 100Gbps Intrusion Prevention on a Single Server. In 14th USENIX Symposium on Operating Systems Design and Implementation (OSDI 20). USENIX, 2020."}],"container-title":["Proceedings of the ACM on Networking"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3768977","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,4,27]],"date-time":"2026-04-27T15:46:58Z","timestamp":1777304818000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3768977"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,11,24]]},"references-count":120,"journal-issue":{"issue":"CoNEXT4","published-print":{"date-parts":[[2025,11,24]]}},"alternative-id":["10.1145\/3768977"],"URL":"https:\/\/doi.org\/10.1145\/3768977","relation":{},"ISSN":["2834-5509"],"issn-type":[{"value":"2834-5509","type":"electronic"}],"subject":[],"published":{"date-parts":[[2025,11,24]]},"assertion":[{"value":"2025-11-25","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}