SoK: Software Debloating Landscape and Future Directions

Mohannad Alhanahnah,Yazan Boshmaf,Ashish Gehani

2024-07-16

Abstract:Software debloating seeks to mitigate security risks and improve performance by eliminating unnecessary code. In recent years, a plethora of debloating tools have been developed, creating a dense and varied landscape. Several studies have delved into the literature, focusing on comparative analysis of these tools. To build upon these efforts, this paper presents a comprehensive systematization of knowledge (SoK) of the software debloating landscape. We conceptualize the software debloating workflow, which serves as the basis for developing a multilevel taxonomy. This framework classifies debloating tools according to their input/output artifacts, debloating strategies, and evaluation criteria. Lastly, we apply the taxonomy to pinpoint open problems in the field, which, together with the SoK, provide a foundational reference for researchers aiming to improve software security and efficiency through debloating.

Software Engineering

What problem does this paper attempt to address?

The problem that this paper attempts to solve is the security risks and performance issues brought by software bloat. Specifically:

1. **Security risks**: In modern software development, relying heavily on third - party libraries accelerates the development process and enhances functionality, but also introduces complexity and potential security vulnerabilities. These components each have dependencies and vulnerabilities, increasing the application's attack surface and thus raising security risks.

2. **Performance issues**: Due to the presence of unnecessary code and functionality, the running efficiency of the software is affected, manifested as increased memory usage, higher CPU utilization, more bandwidth consumption, and longer running time.

To solve the above problems, **software debloating** has emerged as a technical means. By removing redundant code in applications, the attack surface can be significantly reduced, performance can be improved, and maintainability can be enhanced. In addition, software debloating can be combined with other security measures such as control - flow integrity (CFI) and address - space layout randomization (ASLR) to minimize the amount of code that needs to be protected.

However, although there have been many studies on specific types of tools, most of these studies focus on empirical comparisons of certain aspects of performance (such as binary file size or the number of gadgets), and their scope is limited and fails to comprehensively and systematically examine the entire field of software debloating. Therefore, this paper aims to fill this gap by systematizing existing knowledge (SoK) and providing a multi - level classification framework covering input / output artifacts, debloating strategies, and evaluation criteria, etc., thereby providing a basic reference for researchers to help them better understand and improve software debloating techniques.

In summary, the goals of this paper are:
- To provide a comprehensive knowledge system in the field of software debloating;
- To construct a multi - level taxonomy for a clearer understanding of different types of debloating tools;
- To identify open problems in current research and point the way for future research;
- To promote the development of more practical, usable, and secure software debloating solutions.