{"id":"https://openalex.org/W7134889147","doi":"https://doi.org/10.1109/tdsc.2026.3672847","title":"Beyond Control: Exploring Novel File System Objects for Data-Only Attacks on Linux Systems","display_name":"Beyond Control: Exploring Novel File System Objects for Data-Only Attacks on Linux Systems","publication_year":2026,"publication_date":"2026-03-10","ids":{"openalex":"https://openalex.org/W7134889147","doi":"https://doi.org/10.1109/tdsc.2026.3672847"},"language":null,"primary_location":{"id":"doi:10.1109/tdsc.2026.3672847","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tdsc.2026.3672847","pdf_url":null,"source":{"id":"https://openalex.org/S133795288","display_name":"IEEE Transactions on Dependable and Secure Computing","issn_l":"1545-5971","issn":["1545-5971","1941-0018","2160-9209"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320439","host_organization_name":"IEEE Computer Society","host_organization_lineage":["https://openalex.org/P4310320439","https://openalex.org/P4310319808"],"host_organization_lineage_names":["IEEE Computer Society","Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Dependable and Secure Computing","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5077223996","display_name":"Jinmeng Zhou","orcid":null},"institutions":[{"id":"https://openalex.org/I168879160","display_name":"Zhejiang University of Science and Technology","ror":"https://ror.org/05mx0wr29","country_code":"CN","type":"education","lineage":["https://openalex.org/I168879160"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Jinmeng Zhou","raw_affiliation_strings":["College of Computer Science and Technology, Zhejiang University, Hangzhou, China"],"raw_orcid":"https://orcid.org/0000-0003-1629-7470","affiliations":[{"raw_affiliation_string":"College of Computer Science and Technology, Zhejiang University, Hangzhou, China","institution_ids":["https://openalex.org/I168879160"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5032994892","display_name":"Ziyue Pan","orcid":"https://orcid.org/0000-0003-0700-6571"},"institutions":[{"id":"https://openalex.org/I168879160","display_name":"Zhejiang University of Science and Technology","ror":"https://ror.org/05mx0wr29","country_code":"CN","type":"education","lineage":["https://openalex.org/I168879160"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Ziyue Pan","raw_affiliation_strings":["College of Computer Science and Technology, Zhejiang University, Hangzhou, China"],"raw_orcid":"https://orcid.org/0000-0003-0700-6571","affiliations":[{"raw_affiliation_string":"College of Computer Science and Technology, Zhejiang University, Hangzhou, China","institution_ids":["https://openalex.org/I168879160"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5102046084","display_name":"Jiayi Hu","orcid":"https://orcid.org/0009-0008-8517-6940"},"institutions":[{"id":"https://openalex.org/I168879160","display_name":"Zhejiang University of Science and Technology","ror":"https://ror.org/05mx0wr29","country_code":"CN","type":"education","lineage":["https://openalex.org/I168879160"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Jiayi Hu","raw_affiliation_strings":["College of Computer Science and Technology, Zhejiang University, Hangzhou, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"College of Computer Science and Technology, Zhejiang University, Hangzhou, China","institution_ids":["https://openalex.org/I168879160"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5115604663","display_name":"Jiaxun Zhu","orcid":"https://orcid.org/0009-0005-4288-4590"},"institutions":[{"id":"https://openalex.org/I168879160","display_name":"Zhejiang University of Science and Technology","ror":"https://ror.org/05mx0wr29","country_code":"CN","type":"education","lineage":["https://openalex.org/I168879160"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Jiaxun Zhu","raw_affiliation_strings":["College of Computer Science and Technology, Zhejiang University, Hangzhou, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"College of Computer Science and Technology, Zhejiang University, Hangzhou, China","institution_ids":["https://openalex.org/I168879160"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5039734151","display_name":"Wenbo Shen","orcid":"https://orcid.org/0000-0003-2899-6121"},"institutions":[{"id":"https://openalex.org/I168879160","display_name":"Zhejiang University of Science and Technology","ror":"https://ror.org/05mx0wr29","country_code":"CN","type":"education","lineage":["https://openalex.org/I168879160"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Wenbo Shen","raw_affiliation_strings":["College of Computer Science and Technology, Zhejiang University, Hangzhou, China"],"raw_orcid":"https://orcid.org/0000-0003-2899-6121","affiliations":[{"raw_affiliation_string":"College of Computer Science and Technology, Zhejiang University, Hangzhou, China","institution_ids":["https://openalex.org/I168879160"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5112773577","display_name":"R. S. F. Chang","orcid":null},"institutions":[{"id":"https://openalex.org/I168879160","display_name":"Zhejiang University of Science and Technology","ror":"https://ror.org/05mx0wr29","country_code":"CN","type":"education","lineage":["https://openalex.org/I168879160"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Rui Chang","raw_affiliation_strings":["College of Computer Science and Technology, Zhejiang University, Hangzhou, China"],"raw_orcid":"https://orcid.org/0000-0002-0178-0171","affiliations":[{"raw_affiliation_string":"College of Computer Science and Technology, Zhejiang University, Hangzhou, China","institution_ids":["https://openalex.org/I168879160"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5001973865","display_name":"Guoren Li","orcid":null},"institutions":[{"id":"https://openalex.org/I103635307","display_name":"University of California, Riverside","ror":"https://ror.org/03nawhv43","country_code":"US","type":"education","lineage":["https://openalex.org/I103635307"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Guoren Li","raw_affiliation_strings":["Department of Computer Science and Engineering, University of California, Riverside, CA, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Computer Science and Engineering, University of California, Riverside, CA, USA","institution_ids":["https://openalex.org/I103635307"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5022038961","display_name":"Zhiyun Qian","orcid":"https://orcid.org/0000-0003-1506-2522"},"institutions":[{"id":"https://openalex.org/I103635307","display_name":"University of California, Riverside","ror":"https://ror.org/03nawhv43","country_code":"US","type":"education","lineage":["https://openalex.org/I103635307"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Zhiyun Qian","raw_affiliation_strings":["Department of Computer Science and Engineering, University of California, Riverside, CA, USA"],"raw_orcid":"https://orcid.org/0000-0003-1506-2522","affiliations":[{"raw_affiliation_string":"Department of Computer Science and Engineering, University of California, Riverside, CA, USA","institution_ids":["https://openalex.org/I103635307"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":12.1051,"has_fulltext":false,"cited_by_count":1,"citation_normalized_percentile":{"value":0.97413283,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":94,"max":97},"biblio":{"volume":"23","issue":"3","first_page":"7242","last_page":"7258"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.8665000200271606,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.8665000200271606,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12034","display_name":"Digital and Cyber Forensics","score":0.032499998807907104,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11181","display_name":"Advanced Data Storage Technologies","score":0.029999999329447746,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/exploit","display_name":"Exploit","score":0.9452000260353088},{"id":"https://openalex.org/keywords/file-system","display_name":"File system","score":0.6208999752998352},{"id":"https://openalex.org/keywords/linux-kernel","display_name":"Linux kernel","score":0.5856999754905701},{"id":"https://openalex.org/keywords/kernel","display_name":"Kernel (algebra)","score":0.5728999972343445},{"id":"https://openalex.org/keywords/focus","display_name":"Focus (optics)","score":0.5238999724388123},{"id":"https://openalex.org/keywords/system-call","display_name":"System call","score":0.508899986743927},{"id":"https://openalex.org/keywords/software-deployment","display_name":"Software deployment","score":0.47760000824928284},{"id":"https://openalex.org/keywords/virtual-file-system","display_name":"Virtual file system","score":0.4528000056743622}],"concepts":[{"id":"https://openalex.org/C165696696","wikidata":"https://www.wikidata.org/wiki/Q11287","display_name":"Exploit","level":2,"score":0.9452000260353088},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.9018999934196472},{"id":"https://openalex.org/C2780940931","wikidata":"https://www.wikidata.org/wiki/Q174989","display_name":"File system","level":2,"score":0.6208999752998352},{"id":"https://openalex.org/C553261973","wikidata":"https://www.wikidata.org/wiki/Q14579","display_name":"Linux kernel","level":2,"score":0.5856999754905701},{"id":"https://openalex.org/C74193536","wikidata":"https://www.wikidata.org/wiki/Q574844","display_name":"Kernel (algebra)","level":2,"score":0.5728999972343445},{"id":"https://openalex.org/C192209626","wikidata":"https://www.wikidata.org/wiki/Q190909","display_name":"Focus (optics)","level":2,"score":0.5238999724388123},{"id":"https://openalex.org/C2778579508","wikidata":"https://www.wikidata.org/wiki/Q722192","display_name":"System call","level":2,"score":0.508899986743927},{"id":"https://openalex.org/C105339364","wikidata":"https://www.wikidata.org/wiki/Q2297740","display_name":"Software deployment","level":2,"score":0.47760000824928284},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.46880000829696655},{"id":"https://openalex.org/C58861120","wikidata":"https://www.wikidata.org/wiki/Q1330734","display_name":"Virtual file system","level":5,"score":0.4528000056743622},{"id":"https://openalex.org/C36503486","wikidata":"https://www.wikidata.org/wiki/Q11235244","display_name":"Domain (mathematical analysis)","level":2,"score":0.4059999883174896},{"id":"https://openalex.org/C90307666","wikidata":"https://www.wikidata.org/wiki/Q1932562","display_name":"sysfs","level":3,"score":0.3849000036716461},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.3163999915122986},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.3034000098705292},{"id":"https://openalex.org/C93518851","wikidata":"https://www.wikidata.org/wiki/Q180160","display_name":"Metadata","level":2,"score":0.28780001401901245},{"id":"https://openalex.org/C184337299","wikidata":"https://www.wikidata.org/wiki/Q1437428","display_name":"Semantics (computer science)","level":2,"score":0.28220000863075256},{"id":"https://openalex.org/C888380","wikidata":"https://www.wikidata.org/wiki/Q2427787","display_name":"Persistent data structure","level":2,"score":0.2750999927520752},{"id":"https://openalex.org/C33762810","wikidata":"https://www.wikidata.org/wiki/Q461671","display_name":"Data integrity","level":2,"score":0.2660999894142151},{"id":"https://openalex.org/C126831891","wikidata":"https://www.wikidata.org/wiki/Q221673","display_name":"Host (biology)","level":2,"score":0.2605000138282776},{"id":"https://openalex.org/C93996380","wikidata":"https://www.wikidata.org/wiki/Q44127","display_name":"Server","level":2,"score":0.25870001316070557}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/tdsc.2026.3672847","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tdsc.2026.3672847","pdf_url":null,"source":{"id":"https://openalex.org/S133795288","display_name":"IEEE Transactions on Dependable and Secure Computing","issn_l":"1545-5971","issn":["1545-5971","1941-0018","2160-9209"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320439","host_organization_name":"IEEE Computer Society","host_organization_lineage":["https://openalex.org/P4310320439","https://openalex.org/P4310319808"],"host_organization_lineage_names":["IEEE Computer Society","Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Dependable and Secure Computing","raw_type":"journal-article"}],"best_oa_location":null,"sustainable_development_goals":[{"display_name":"Peace, Justice and strong institutions","score":0.8139713406562805,"id":"https://metadata.un.org/sdg/16"}],"awards":[{"id":"https://openalex.org/G2342759067","display_name":null,"funder_award_id":"62572432","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G5674928254","display_name":null,"funder_award_id":"62532012","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"}],"funders":[{"id":"https://openalex.org/F4320321001","display_name":"National Natural Science Foundation of China","ror":"https://ror.org/01h0zpd94"}],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"The":[0],"widespread":[1],"deployment":[2],"of":[3,49,56,120,143],"control-flow":[4],"integrity":[5],"has":[6],"shifted":[7],"attackers'":[8],"focus":[9],"to":[10,65,114],"non-control":[11,29,40,71],"data":[12,41,72],"attacks.":[13],"In":[14],"OS":[15,44],"kernel":[16,45,164],"exploits,":[17],"attackers":[18],"can":[19,125],"gain":[20],"root":[21],"access":[22],"or":[23],"escalate":[24],"privileges":[25],"by":[26],"corrupting":[27],"critical":[28],"objects":[30,94,102,124,147],"without":[31,128],"hijacking":[32],"the":[33,43,50,62,74,133,141,144,163],"control":[34],"flow.":[35],"However,":[36],"searching":[37],"for":[38,106],"exploitable":[39,70,127],"in":[42],"is":[46],"challenging":[47],"because":[48],"data's":[51],"semantic":[52],"complexity":[53],"and":[54,68,87,97,136],"lack":[55],"universal":[57],"patterns.":[58],"This":[59],"work":[60],"represents":[61],"first":[63],"study":[64],"semi-automatically":[66],"discover":[67],"evaluate":[69,140],"within":[73],"Linux":[75],"kernel's":[76],"file":[77,145],"system,":[78],"with":[79,152,165],"minimal":[80],"domain":[81],"knowledge.":[82],"Utilizing":[83],"a":[84,111],"custom":[85],"analysis":[86],"testing":[88],"framework,":[89],"we":[90],"identify":[91],"promising":[92],"candidate":[93],"both":[95],"statically":[96],"dynamically.":[98],"We":[99,139,156],"categorize":[100],"these":[101,121],"into":[103],"types":[104],"suitable":[105],"various":[107,153],"exploit":[108,154],"strategies,":[109],"including":[110],"systematic":[112],"strategy":[113],"overcome":[115],"defenses":[116],"that":[117],"isolate":[118],"many":[119],"objects.":[122],"These":[123],"be":[126],"requiring":[129],"KASLR,":[130],"thus":[131],"making":[132],"exploits":[134,161],"simpler":[135],"more":[137],"reliable.":[138],"exploitability":[142],"system":[146],"using":[148],"18":[149],"real-world":[150],"CVEs":[151],"strategies.":[155],"further":[157],"develop":[158],"10":[159],"end-to-end":[160],"against":[162],"all":[166],"state-of-the-art":[167],"mitigations":[168],"enabled.":[169]},"counts_by_year":[{"year":2026,"cited_by_count":1}],"updated_date":"2026-05-15T06:05:50.897203","created_date":"2026-03-12T00:00:00"}