Container Library Pruning and Syscall Blocking for Vulnerability Reduction

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Containerized applications face significant security vulnerabilities due to over-inclusive developer-defined dependencies, where unnecessary library files and functions are loaded, exposing the system to potential threats, and existing dynamic analysis may fail to identify all necessary dependencies, risking application breakage.

Innovation Solution

Perform static and dynamic analysis of dynamically loaded symbols to identify unnecessary library functions and system calls, generating a security policy for the OS kernel to block these calls, thereby reducing the attack surface and application footprint.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If developer-defined dependencies are included to ensure application functionality, then application reliability is improved, but attack surface increases due to unnecessary library files and functions

Engineering Contradiction:

Improveapplication functionalityVSAvoidattack surface

Core Design Contradiction:

ReliabilityVSObject-affected harmful factors

Solution Approach 1:

The patent extracts and removes unnecessary library files and functions from container images by performing static analysis of dynamically loaded symbols and dynamic analysis during runtime. This extraction process eliminates harmful dependencies while preserving only those libraries and functions that are actually required for application functionality, thereby reducing the attack surface without compromising reliability

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

The patent performs preliminary analysis (both static and dynamic) before deploying the container to production. By identifying and removing unnecessary dependencies in advance, the system prevents potential security vulnerabilities from being introduced, while ensuring that all required dependencies are properly configured before the application goes live

Inventive Principle:

Principle #10Preliminary action

2Object-affected harmful factors

If static analysis of dynamically loaded symbols is performed to identify unnecessary libraries, then security vulnerabilities are reduced, but device complexity increases

Engineering Contradiction:

Improvesecurity vulnerabilitiesVSAvoidanalysis process complexity

Core Design Contradiction:

Object-affected harmful factorsVSDevice complexity

Solution Approach 1:

The patent segments the vulnerability reduction process into two distinct phases: static analysis of dynamically loaded symbols in container images, and dynamic analysis during runtime. This segmentation allows each phase to focus on specific aspects of dependency identification, making the overall complex process more manageable and systematic while achieving comprehensive security vulnerability reduction

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent introduces an intermediary security module that acts as a bridge between the analysis processes and the container runtime environment. This intermediary component coordinates the static and dynamic analysis, manages the identification of unnecessary libraries, and implements the removal process, thereby organizing the complexity into a structured intermediary layer

Inventive Principle:

Principle #24Intermediary (Mediator)

3Object-affected harmful factors

If dynamic analysis during runtime is performed to identify necessary dependencies, then unnecessary functions are removed, but loss of time occurs during the analysis process

Engineering Contradiction:

Improveunnecessary functionsVSAvoidanalysis time

Core Design Contradiction:

Object-affected harmful factorsVSLoss of time

Solution Approach 1:

The patent performs preliminary static analysis of dynamically loaded symbols before runtime dynamic analysis. This preliminary action identifies obviously unnecessary libraries and functions early in the process, reducing the scope of subsequent dynamic analysis and minimizing the time required for comprehensive dependency identification while still achieving thorough removal of unnecessary functions

Inventive Principle:

Principle #10Preliminary action

Data Source

PatentUS12608485B2Enhancing container security by performing container vulnerability reduction based on library and/or function removal and system call blocking

Publication Date: 2026.04.21 NETAPP INC

AI summary

Systems and methods for enhancing container security are provided. In one example, exposure of a containerize application to potential security vulnerabilities is reduced by identifying dynamically loaded symbols by the application via performance of static and/or dynamic symbol analysis to identify dynamically loaded symbols that are potentially and/or actually used, respectively, and that correspond to functions contained within shared libraries. Based on a shared library's usage of functions within a standard library and a known mapping between functions of the standard library and system calls, those system calls potentially and actually accessed by the application may be identified and a security policy may be generated and configured for enforcement by a kernel security module to limit system call usage accordingly. Additionally, removal of files or functions of libraries that are deemed unnecessary for proper execution of the applications may be performed to reduce the footprint of the application.