2019/03/05 by Marcela S. Melara, Melara, Marcela S., David H. Liu +3
Computer Science · #Advanced Malware Detection Techniques #FOS: Computer and information sciences #Network Security and Intrusion Detection #Operating Systems (cs.OS) #Security and Verification in Computing #cs.OS
paper · pdf · doi:10.48550/arxiv.1903.01950
19 pages, 3 figures
openalex publication_date 2019/03/05 · arxiv created 2019/11/20 · arxiv updated 2019/11/22 · openalex created_date 2025/10/10 · openalex updated_date 2026/07/28
Third-party code plays a critical role in IoT applications, which generate and analyze highly privacy-sensitive data. Unlike traditional desktop and server settings, IoT devices mostly run a dedicated, single application. As a result, vulnerabilities in third-party libraries within a process pose a much bigger threat than on traditional platforms. We present Pyronia, a fine-grained access control system for IoT applications written in high-level languages. Pyronia exploits developers' coarse-grained expectations about how imported third-party code operates to restrict access to files, devices, and specific network destinations, at the granularity of individual functions. To efficiently protect such sensitive OS resources, Pyronia combines three techniques: system call interposition, stack inspection, and memory domains. This design avoids the need for application refactoring, or unintuitive data flow analysis, while enforcing the developer's access policy at run time. Our Pyronia prototype for Python runs on a custom Linux kernel, and incurs moderate performance overhead on unmodified Python applications.