旧的、膨胀的和脆弱的：减少工业应用程序的攻击面
The Used, the Bloated, and the Vulnerable: Reducing the Attack Surface of an Industrial Application
摘要：
当应用程序依赖性的重要部分实际上未被使用时，软件重用可能导致软件膨胀。有几种工具可以从应用程序或其依赖项中删除未使用的（字节）代码，从而产生更小的工件，并可能减少整体攻击面。在本文中，我们评估的能力，三个debloating工具，以区分哪些依赖类是必要的应用程序，以正确的功能，可以安全地删除。为此，我们对一个真实的商业Java应用程序进行了案例研究。我们的研究表明，我们使用的工具能够正确地识别出相当数量的冗余码，这些代码可以在不改变现有应用程序测试结果的情况下被删除。其中一个冗余类原来是（以前）脆弱的，这证实了这种技术有可能被应用于加固目的。然而，通过手动检查我们的实验结果，我们观察到没有一个工具可以处理广泛使用的动态类加载默认机制。
英文摘要：
Software reuse may result in software bloat when significant portions of application dependencies are effectively unused. Several tools exist to remove unused (byte)code from an application or its dependencies, thus producing smaller artifacts and, potentially, reducing the overall attack surface. In this paper we evaluate the ability of three debloating tools to distinguish which dependency classes are necessary for an application to function correctly from those that could be safely removed. To do so, we conduct a case study on a real-world commercial Java application. Our study shows that the tools we used were able to correctly identify a considerable amount of redundant code, which could be removed without altering the results of the existing application tests. One of the redundant classes turned out to be (formerly) vulnerable, confirming that this technique has the potential to be applied for hardening purposes. However, by manually reviewing the results of our experiments, we observed that none of the tools can handle a widely used default mechanism for dynamic class loading.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
