{"id":"https://openalex.org/W7166747691","doi":"https://doi.org/10.7148/2026-0321","title":"Using ebpf-based tools for detection and mitigation of container breakouts and privilege escalation","display_name":"Using ebpf-based tools for detection and mitigation of container breakouts and privilege escalation","publication_year":2026,"publication_date":"2026-06-23","ids":{"openalex":"https://openalex.org/W7166747691","doi":"https://doi.org/10.7148/2026-0321"},"language":null,"primary_location":{"id":"doi:10.7148/2026-0321","is_oa":true,"landing_page_url":"https://doi.org/10.7148/2026-0321","pdf_url":"https://doi.org/10.7148/2026-0321","source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"ECMS 2026 Proceedings edited by Filippo Sanfilippo, Florenc Demrozi, Fabio Sgarbossa, Mohammad Poursina","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://doi.org/10.7148/2026-0321","any_repository_has_fulltext":null},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5055653957","display_name":"Anna Plichta","orcid":"https://orcid.org/0000-0001-6503-308X"},"institutions":[{"id":"https://openalex.org/I4210092770","display_name":"Cracow University of Technology","ror":null,"country_code":"PL","type":null,"lineage":["https://openalex.org/I4210092770"]}],"countries":["PL"],"is_corresponding":false,"raw_author_name":"Anna Plichta","raw_affiliation_strings":["Department of Computer Science Cracow University of Technology Cracow , Poland"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Computer Science Cracow University of Technology Cracow , Poland","institution_ids":["https://openalex.org/I4210092770"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5139656459","display_name":"Serhii Cherepiuk","orcid":null},"institutions":[{"id":"https://openalex.org/I4210092770","display_name":"Cracow University of Technology","ror":null,"country_code":"PL","type":null,"lineage":["https://openalex.org/I4210092770"]}],"countries":["PL"],"is_corresponding":false,"raw_author_name":"Serhii Cherepiuk","raw_affiliation_strings":["Department of Computer Science Cracow University of Technology Cracow , Poland"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Computer Science Cracow University of Technology Cracow , Poland","institution_ids":["https://openalex.org/I4210092770"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I4210092770"],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":true,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"321","last_page":"330"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.8971999883651733,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.8971999883651733,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12127","display_name":"Software System Performance and Reliability","score":0.013700000010430813,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12479","display_name":"Web Application Security Vulnerabilities","score":0.009700000286102295,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/exploit","display_name":"Exploit","score":0.6998999714851379},{"id":"https://openalex.org/keywords/container","display_name":"Container (type theory)","score":0.6972000002861023},{"id":"https://openalex.org/keywords/buffer-overflow","display_name":"Buffer overflow","score":0.45019999146461487},{"id":"https://openalex.org/keywords/system-call","display_name":"System call","score":0.43529999256134033},{"id":"https://openalex.org/keywords/throughput","display_name":"Throughput","score":0.41280001401901245},{"id":"https://openalex.org/keywords/code","display_name":"Code (set theory)","score":0.4034000039100647},{"id":"https://openalex.org/keywords/key","display_name":"Key (lock)","score":0.40049999952316284},{"id":"https://openalex.org/keywords/security-policy","display_name":"Security policy","score":0.39239999651908875},{"id":"https://openalex.org/keywords/workload","display_name":"Workload","score":0.385699987411499},{"id":"https://openalex.org/keywords/isolation","display_name":"Isolation (microbiology)","score":0.38350000977516174}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.717199981212616},{"id":"https://openalex.org/C165696696","wikidata":"https://www.wikidata.org/wiki/Q11287","display_name":"Exploit","level":2,"score":0.6998999714851379},{"id":"https://openalex.org/C2781018962","wikidata":"https://www.wikidata.org/wiki/Q5164884","display_name":"Container (type theory)","level":2,"score":0.6972000002861023},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.5672000050544739},{"id":"https://openalex.org/C40842320","wikidata":"https://www.wikidata.org/wiki/Q19423","display_name":"Buffer overflow","level":2,"score":0.45019999146461487},{"id":"https://openalex.org/C2778579508","wikidata":"https://www.wikidata.org/wiki/Q722192","display_name":"System call","level":2,"score":0.43529999256134033},{"id":"https://openalex.org/C157764524","wikidata":"https://www.wikidata.org/wiki/Q1383412","display_name":"Throughput","level":3,"score":0.41280001401901245},{"id":"https://openalex.org/C2776760102","wikidata":"https://www.wikidata.org/wiki/Q5139990","display_name":"Code (set theory)","level":3,"score":0.4034000039100647},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.40049999952316284},{"id":"https://openalex.org/C154908896","wikidata":"https://www.wikidata.org/wiki/Q2167404","display_name":"Security policy","level":2,"score":0.39239999651908875},{"id":"https://openalex.org/C2778476105","wikidata":"https://www.wikidata.org/wiki/Q628539","display_name":"Workload","level":2,"score":0.385699987411499},{"id":"https://openalex.org/C2775941552","wikidata":"https://www.wikidata.org/wiki/Q25212305","display_name":"Isolation (microbiology)","level":2,"score":0.38350000977516174},{"id":"https://openalex.org/C77109596","wikidata":"https://www.wikidata.org/wiki/Q4781497","display_name":"Application security","level":5,"score":0.38119998574256897},{"id":"https://openalex.org/C126831891","wikidata":"https://www.wikidata.org/wiki/Q221673","display_name":"Host (biology)","level":2,"score":0.3707999885082245},{"id":"https://openalex.org/C2779777834","wikidata":"https://www.wikidata.org/wiki/Q4202277","display_name":"Enforcement","level":2,"score":0.36739999055862427},{"id":"https://openalex.org/C2780138299","wikidata":"https://www.wikidata.org/wiki/Q3404265","display_name":"Privilege (computing)","level":2,"score":0.364300012588501},{"id":"https://openalex.org/C10144332","wikidata":"https://www.wikidata.org/wiki/Q14645","display_name":"Rootkit","level":3,"score":0.3440000116825104},{"id":"https://openalex.org/C62913178","wikidata":"https://www.wikidata.org/wiki/Q7554361","display_name":"Software security assurance","level":4,"score":0.3425000011920929},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.3416000008583069},{"id":"https://openalex.org/C74193536","wikidata":"https://www.wikidata.org/wiki/Q574844","display_name":"Kernel (algebra)","level":2,"score":0.33899998664855957},{"id":"https://openalex.org/C2780771206","wikidata":"https://www.wikidata.org/wiki/Q3271761","display_name":"Safeguard","level":2,"score":0.3377000093460083},{"id":"https://openalex.org/C527821871","wikidata":"https://www.wikidata.org/wiki/Q228502","display_name":"Access control","level":2,"score":0.3366999924182892},{"id":"https://openalex.org/C32802771","wikidata":"https://www.wikidata.org/wiki/Q2443617","display_name":"Port (circuit theory)","level":2,"score":0.33480000495910645},{"id":"https://openalex.org/C2781251061","wikidata":"https://www.wikidata.org/wiki/Q5416089","display_name":"Evasion (ethics)","level":3,"score":0.3244999945163727},{"id":"https://openalex.org/C2777407602","wikidata":"https://www.wikidata.org/wiki/Q1888932","display_name":"Mandatory access control","level":4,"score":0.323199987411499},{"id":"https://openalex.org/C174839445","wikidata":"https://www.wikidata.org/wiki/Q1134386","display_name":"Lock (firearm)","level":2,"score":0.31310001015663147},{"id":"https://openalex.org/C119024030","wikidata":"https://www.wikidata.org/wiki/Q759899","display_name":"Call stack","level":3,"score":0.30979999899864197},{"id":"https://openalex.org/C116834253","wikidata":"https://www.wikidata.org/wiki/Q2039217","display_name":"Identification (biology)","level":2,"score":0.30399999022483826},{"id":"https://openalex.org/C82876162","wikidata":"https://www.wikidata.org/wiki/Q17096504","display_name":"Latency (audio)","level":2,"score":0.29409998655319214},{"id":"https://openalex.org/C97686452","wikidata":"https://www.wikidata.org/wiki/Q7604153","display_name":"Static analysis","level":2,"score":0.2883000075817108},{"id":"https://openalex.org/C120936955","wikidata":"https://www.wikidata.org/wiki/Q2155640","display_name":"Empirical research","level":2,"score":0.2858999967575073},{"id":"https://openalex.org/C195518309","wikidata":"https://www.wikidata.org/wiki/Q13424265","display_name":"Security testing","level":5,"score":0.27880001068115234},{"id":"https://openalex.org/C2779628075","wikidata":"https://www.wikidata.org/wiki/Q1253258","display_name":"Downgrade","level":2,"score":0.2784999907016754},{"id":"https://openalex.org/C71745522","wikidata":"https://www.wikidata.org/wiki/Q2476929","display_name":"Confidentiality","level":2,"score":0.27309998869895935},{"id":"https://openalex.org/C553261973","wikidata":"https://www.wikidata.org/wiki/Q14579","display_name":"Linux kernel","level":2,"score":0.27090001106262207},{"id":"https://openalex.org/C121822524","wikidata":"https://www.wikidata.org/wiki/Q5157582","display_name":"Computer security model","level":2,"score":0.2669999897480011},{"id":"https://openalex.org/C31258907","wikidata":"https://www.wikidata.org/wiki/Q1301371","display_name":"Computer network","level":1,"score":0.25920000672340393}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.7148/2026-0321","is_oa":true,"landing_page_url":"https://doi.org/10.7148/2026-0321","pdf_url":"https://doi.org/10.7148/2026-0321","source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"ECMS 2026 Proceedings edited by Filippo Sanfilippo, Florenc Demrozi, Fabio Sgarbossa, Mohammad Poursina","raw_type":"proceedings-article"}],"best_oa_location":{"id":"doi:10.7148/2026-0321","is_oa":true,"landing_page_url":"https://doi.org/10.7148/2026-0321","pdf_url":"https://doi.org/10.7148/2026-0321","source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"ECMS 2026 Proceedings edited by Filippo Sanfilippo, Florenc Demrozi, Fabio Sgarbossa, Mohammad Poursina","raw_type":"proceedings-article"},"sustainable_development_goals":[{"score":0.8114434480667114,"display_name":"Peace, Justice and strong institutions","id":"https://metadata.un.org/sdg/16"}],"awards":[],"funders":[],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W7166747691.pdf","grobid_xml":"https://content.openalex.org/works/W7166747691.grobid-xml"},"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Containerized":[0],"environments":[1],"rely":[2],"on":[3],"shared-kernel":[4],"isolation,":[5],"making":[6],"container":[7,96,135],"breakouts":[8],"and":[9,46,72,119],"privilege":[10],"escalation":[11],"critical":[12],"security":[13,24,89],"risks.":[14],"This":[15],"paper":[16],"presents":[17],"an":[18],"empirical":[19,85],"evaluation":[20],"of":[21,87],"eBPF-based":[22,88,128],"runtime":[23,97,136],"using":[25],"the":[26,83],"Tetragon":[27,66],"platform":[28],"against":[29,91,134],"real-world":[30],"runc":[31],"vulnerabilities.":[32],"Two":[33],"representative":[34],"exploits":[35],"are":[36],"analyzed:":[37],"a":[38,47,107],"file-descriptor":[39],"leak":[40],"enabling":[41],"host":[42],"filesystem":[43],"access":[44],"(CVE-2024-21626)":[45],"masked-path":[48],"time-of-check":[49],"time-of-use":[50],"(TOCTOU)":[51],"race":[52],"leading":[53],"to":[54],"host-level":[55],"code":[56],"execution":[57],"with":[58,114],"root":[59],"privileges":[60],"(CVE-2025-31133).":[61],"For":[62],"each":[63],"case,":[64],"concise":[65],"policies":[67],"intercept":[68],"decisive":[69],"kernel":[70],"interactions":[71],"prevent":[73],"isolation":[74],"violations":[75],"synchronously":[76],"in-kernel.":[77],"To":[78],"our":[79],"knowledge,":[80],"this":[81],"is":[82],"first":[84],"validation":[86],"tools":[90],"publicly":[92],"disclosed,":[93],"actively":[94],"exploited":[95],"CVEs,":[98],"demonstrating":[99],"effectiveness":[100],"without":[101],"application-specific":[102],"policies.":[103],"Performance":[104],"measurements":[105],"under":[106,115],"realistic":[108],"HTTP":[109],"workload":[110],"show":[111],"minimal":[112],"overhead,":[113],"1%":[116],"throughput":[117],"degradation":[118],"approximately":[120],"2%":[121],"latency":[122],"increase.":[123],"These":[124],"results":[125],"indicate":[126],"that":[127],"enforcement":[129],"provides":[130],"effective,":[131],"low-overhead":[132],"protection":[133],"vulnerabilities":[137],"in":[138],"dynamic":[139],"environments.":[140]},"counts_by_year":[],"updated_date":"2026-07-14T23:27:15.235271","created_date":"2026-07-01T00:00:00"}