# SoK: Software Debloating Landscape and Future Directions

Mohannad Alhanahnah
Department of Computer Science
University of Wisconsin-Madison
USA
<EMAIL_ADDRESS>
Yazan Boshmaf
Qatar Computing Research Institute
Hamad Bin Khalifa University
Qatar
<EMAIL_ADDRESS>
Ashish Gehani
Computer Science Laboratory
SRI
USA
<EMAIL_ADDRESS>

###### Abstract

Software debloating seeks to mitigate security risks and improve performance
by eliminating unnecessary code. In recent years, a plethora of debloating
tools have been developed, creating a dense and varied landscape. Several
studies have delved into the literature, focusing on comparative analysis of
these tools. To build upon these efforts, this paper presents a comprehensive
systematization of knowledge (SoK) of the software debloating landscape. We
conceptualize the software debloating workflow, which serves as the basis for
developing a multilevel taxonomy. This framework classifies debloating tools
according to their input/output artifacts, debloating strategies, and
evaluation criteria. Lastly, we apply the taxonomy to pinpoint open problems
in the field, which, together with the SoK, provide a foundational reference
for researchers aiming to improve software security and efficiency through
debloating.

##  1 Introduction

Modern software development is heavily dependent on third-party libraries to
accelerate development and improve functionality [Mohagheghi et al.(2004)].
However, this practice introduces significant complexity and increases the
attack surface of applications due to the integration of various components,
each with its own set of dependencies and vulnerabilities [Düsing and
Hermann(2022)]. The increased complexity increases security risks and leads to
code bloat, adversely affecting performance.

Software debloating [Shankar and Gehani(2012), Malecha et al.(2015)], the
process of removing unnecessary code from applications, is a promising
approach to address these issues. By eliminating extraneous features,
debloating can significantly reduce the attack surface, enhance performance,
and improve maintainability. This technique complements other security
measures, such as Control-Flow Integrity (CFI) [Ligatti et al.(2005)] and
Address Space Layout Randomization (ASLR) [Snow et al.(2013)], by minimizing
the amount of code that needs protection. Software debloating has gained
renewed momentum, in part due to cyber defense initiatives, such as the US
Navy’s Total Platform Cyber Protection (TPCP) program [TPC([n. d.])].
Subsequently, numerous debloating tools were introduced, leading to various
studies [Ali et al.(2023b), Brown et al.(2024), Hassan et al.(2023)] that
examine the literature on software debloating and perform comparative analyses
of the prototyped tools. While these studies are thorough, their primary
objective is to empirically compare specific aspects, such as resulting binary
size or gadget count, of particular types of debloating tools, such as those
that target C/C++ programs or containers. The limited scope restricts the
influence of these studies to a subset of debloating tools, rather than
providing a systematic, comprehensive, and wide-ranging examination of the
entire debloating domain, which encompasses a diverse array of tools and
evaluation criteria. As such, there is a significant need to augment previous
research with a holistic and systematic study of the complete software
debloating landscape, thereby enabling more extensive and inclusive
conclusions about open issues and challenges in this domain.

To bridge this gap, this paper systematizes the current knowledge on software
debloating, providing a multilevel taxonomy that divides the current landscape
into three main categories corresponding to the three main stages of the
debloating workflow. We also highlight open problems in the field, calling for
more practical, usable, and secure debloating solutions that can be integrated
seamlessly into modern development workflows.

##  2 Software Debloating Workflow

Software bloat refers to unnecessary functionalities and their corresponding
software dependencies and components [Shankar and Gehani(2012), Malecha et
al.(2015)]. Figure 1 depicts the typical workflow used by debloating tools. To
identify bloat and eliminate it, developers use existing tools that take a
_bloated artifact_ , such as an application, container, or firmware, often
coupled with a _deployment context_ , and then produce a _debloated artifact_
utilizing a particular _debloating strategy_ applied by the tool. After that,
the quality of the output artifact is assessed using various evaluation
criteria. As depicted in Figure 1, in addition to _bloated artifact_ ,
_debloating strategy_ may receive additional input (that is, in the form of
annotation or instrumentation) to indicate the required functionality that
should be preserved in the output artifact. The next section discusses the
details of this debloating workflow in the context of the reviewed literature
and our proposed taxonomy.

Figure 1: Typical debloating workflow.

##  3 Multi-level Taxonomy

Our goal is to study and contrast existing software debloating tools and
techniques. To achieve this, we first surveyed related research covering all
papers published in top-tier security conferences, namely IEEE S&P, USENIX
Security, ACM CCS, and NDSS from 2000 to March 2024. We also selected papers
from top academic conferences and journals broadly related to software
debloating. This process yielded $48$ publications that are summarized in
Table 1.

Figure 2 shows the multilevel taxonomy we designed to categorize the software
debloating landscape. In this taxonomy, the top level outlines the three main
stages of the workflow. Lower levels categorize specific aspects of the
debloating landscape, based on the publications listed in Table 1, under each
stage of the workflow.

###  3.1 Input/Output Artifacts

Debloating tools require an input to generate an output. These inputs and
outputs are referred to as artifacts and can come in various formats, such as
source code, binaries, and containerized applications. The output resulting
from debloating can also take any of these forms, or might even be a policy.
Figure 4 shows the number of publications with proposed tools that use one or
more of the following type mappings between input and output artifacts:

  * •

Source-to-Source (S2S). In this workflow, the debloating operation is applied
to the given source code, resulting in a minimized source code output. CHISEL
[Heo et al.(2018)] and Mininode [Koishybayev and Kapravelos(2020)] execute
their debloating procedures for C/C++ and JavaScript programs, respectively.

  * •

Source-to-Binary (S2B). The workflow starts with the source code and
transforms it into an Intermediate Representation (IR). The debloating process
then operates on the IR code. Ultimately, the debloated program is produced in
binary format. For instance, LMCAS [Alhanahnah et al.(2022)] debloats C/C++
programs by first converting them into LLVM IR, resulting in executable
output. Tools utilizing this debloating workflow have been applied to
platforms such as firmware, as seen with PRAT [Williams et al.(2021)]. Other
tools in this category focus on trimming shared libraries, an approach
exemplified by Piece-Wise[Quach et al.(2018)]. Certain tools implementing this
workflow extend beyond trimming by incorporating additional checks, such as
Saffire [Mishra and Polychronakis(2020)].

  * •

Artifact-to-Policy (S2P or C2P). This workflow generates a policy (i.e.
seccomp()) that limits the program’s behavior at run-time. As observed in the
reviewed literature, the input artifact for this process can be either source
code (S2P) or a containerized application (C2P), as exemplified in debloating
tools such as temporal-specialization [Ghavamnia et al.(2020b)] and Confine
[Ghavamnia et al.(2020a)]. Generally, these debloating methods do not involve
actual trimming but focus on minimizing the use of unnecessary resources, such
as syscalls.

  * •

Binary-to-Binary (B2B). The workflow begins with a binary file and results in
a debloated program, also in binary format. Similar to S2B tools that apply
additional checks, certain tools implementing this workflow extend beyond
trimming, such as Razor [Qian et al.(2019)], and incorporate extra checks,
like those of binary control-flow trimming [Ghaffarinia and Hamlen(2019)], to
safeguard CFI. Consequently, the size of the debloated programs may increase
in some instances. This debloating approach has been applied to various
platforms, including Android (e.g., XDebloat [Tang et al.(2022)], RedDroid
[Jiang et al.(2018)]) and firmware (e.g., IRQDebloat [Hu and Dolan-
Gavitt(2022)], DECAF [Christensen et al.(2020)]). A different group of tools
focus exclusively on debloating shared libraries, such as BlankIt [Agadakos et
al.(2019)] and Nibbler [Agadakos et al.(2019)]. Likewise, tools such as
$\mu$Trimmer [Zhang et al.(2022)] are designed to debloat shared libraries,
but specifically within the context of firmware images.

  * •

Container-to-Container/s (C2C). In this workflow, the debloating operation
takes a container as input and produces a debloated version of the same
container or divides it into multiple containers, each with a portion of the
application from the original container. For instance, Cimplifier [Rastogi et
al.(2017)] can function in two modes: either by trimming the container or
partitioning it into smaller segments. MMLB [Zhang et al.(2024)] builds on the
trimming feature of Cimplifier to investigate bloat in machine learning
containers.

  * •

Dependency-to-Dependency (D2D). This workflow accepts inputs consisting of
dependency and build management files, like the Project Object Model (POM),
where developers outline details about the project, its dependencies, and the
build process. The output is a debloated version of the dependency management
file(s). An example of this is DepClean [Soto-Valero et al.(2021)], which
specializes in debloating POM files in Java projects.

Figure 2: Taxonomy of software debloating landscape.

Some tools adopt a more comprehensive approach to debloat various layers of
the software stack, thereby combining multiple type mappings for input/output
artifacts. For instance, LightBlue [Wu et al.(2021)] debloats the Bluetooth
stack, specifically focusing on debloating applications (S2B) and firmware
(B2B).

###  3.2 Debloating Strategies

This stage of the workflow outlines the methods used by developers to
determine unnecessary functionalities, pinpoint their associated dependencies,
and remove them. As shown in Figure 2, this stage is divided into three main
components, as follows:

Table 1: Selected publications on software debloating landscape.

Tool | Venue |  In/Out Artifacts | Removal Granularity | Analysis | Functionality | Evaluation Criteria
---|---|---|---|---|---|---
File |  Library |  BB |  Stmt |  Static |  Dynamic |  ML-Assisted |  Config. |  Test cases |  Annotation |  Performance |  Security |  Robustness |  Usability |  Integration |  Sustainability
Hacksaw [Hu et al.(2023)] | CCS’23 | S2B | ✗ | ✓ | ✗ | ✗ | ✓ | ✓ | ✗ | ✗ | ✓ | ✗ | ✗ | ✓ | ✓ | ✗ | ✗ | ✗
C2C [Ghavamnia et al.(2022)] | CCS’22 | S2P | ✗ | ✗ | ✗ | ✗ | ✓ | ✗ | ✗ | ✓ | ✗ | ✓ | ✓ | ✓ | ✗ | ✓ | ✗ | ✗
Slimium [Qian et al.(2020)] | CCS’20 | S2B | ✗ | ✓ | ✗ | ✓ | ✓ | ✓ | ✗ | ✗ | ✓ | ✓ | ✗ | ✓ | ✓ | ✓ | ✗ | ✗
NA [Ghaffarinia and Hamlen(2019)] | CCS’19 | B2B | ✗ | ✗ | ✓ | ✓ | ✓ | ✓ | ✓ | ✗ | ✓ | ✓ | ✓ | ✓ | ✓ | ✗ | ✗ | ✗
CHISEL [Heo et al.(2018)] | CCS’18 | S2S | ✗ | ✓ | ✓ | ✓ | ✗ | ✓ | ✓ | ✗ | ✓ | ✗ | ✗ | ✓ | ✓ | ✓ | ✗ | ✗
PacJam [Pashakhanloo et al.(2022)] | ASIACCS ’22 | S2S | ✓ | ✗ | ✗ | ✓ | ✓ | ✓ | ✗ | ✗ | ✓ | ✗ | ✓ | ✓ | ✗ | ✓ | ✗ | ✗
LightBlue [Wu et al.(2021)] | USENIX Sec’21 | S2B, B2B | ✗ | ✓ | ✓ | ✓ | ✓ | ✓ | ✗ | ✓ | ✗ | ✗ | ✗ | ✓ | ✓ | ✗ | ✗ | ✗
Temporal Specal. [Ghavamnia et al.(2020b)] | USENIX Sec’20 | S2P | ✗ | ✓ | ✗ | ✗ | ✓ | ✗ | ✗ | ✓ | ✗ | ✗ | ✗ | ✓ | ✗ | ✗ | ✗ | ✗
RAZOR [Qian et al.(2019)] | USENIX Sec’19 | B2B | ✗ | ✗ | ✓ | ✗ | ✓ | ✓ | ✗ | ✗ | ✓ | ✗ | ✓ | ✓ | ✓ | ✓ | ✗ | ✗
Piece-Wise [Quach et al.(2018)] | USENIX Sec’18 | S2B | ✗ | ✓ | ✗ | ✗ | ✓ | ✓ | ✗ | ✓ | ✗ | ✓ | ✗ | ✓ | ✓ | ✓ | ✗ | ✗
IRQDebloat [Hu and Dolan-Gavitt(2022)] | S&P’22 | B2B | ✗ | ✓ | ✗ | ✗ | ✓ | ✓ | ✗ | ✓ | ✗ | ✓ | ✗ | ✓ | ✗ | ✗ | ✗ | ✗
LMCAS [Alhanahnah et al.(2022)] | EuroS&P’22 | S2B | ✗ | ✓ | ✓ | ✓ | ✓ | ✓ | ✗ | ✓ | ✗ | ✓ | ✗ | ✓ | ✓ | ✓ | ✗ | ✗
Saffire [Mishra and Polychronakis(2020)] | EuroS&P’20 | S2B | ✗ | ✓ | ✗ | ✗ | ✓ | ✓ | ✗ | ✗ | ✗ | ✓ | ✓ | ✓ | ✗ | ✓ | ✗ | ✗
Mininode [Koishybayev and Kapravelos(2020)] | RAID’20 | S2S | ✓ | ✓ | ✗ | ✗ | ✓ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ | ✓ | ✓ | ✗ | ✗ | ✗
CONFINE [Ghavamnia et al.(2020a)] | RAID’20 | C2P | ✗ | ✗ | ✗ | ✗ | ✓ | ✓ | ✗ | ✗ | ✓ | ✗ | ✗ | ✓ | ✓ | ✗ | ✗ | ✗
CARVE [Brown and Pande(2019)] | FEAST’19 | S2S | ✗ | ✗ | ✓ | ✓ | ✓ | ✗ | ✗ | ✓ | ✗ | ✓ | ✗ | ✓ | ✓ | ✗ | ✗ | ✗
BinRec [Kroes et al.(2018)] | FEAST’18 | B2B | ✗ | ✓ | ✓ | ✓ | ✓ | ✓ | ✗ | ✓ | ✗ | ✓ | ✓ | ✓ | ✓ | ✗ | ✗ | ✗
Nibbler [Agadakos et al.(2019)] | ACSAC’19 | B2B | ✗ | ✓ | ✗ | ✗ | ✓ | ✗ | ✗ | ✗ | ✗ | ✗ | ✓ | ✓ | ✗ | ✓ | ✗ | ✗
JShrink [Bruce et al.(2020)] | FSE’20 | B2B | ✓ | ✓ | ✗ | ✓ | ✓ | ✓ | ✗ | ✗ | ✓ | ✓ | ✗ | ✓ | ✓ | ✗ | ✗ | ✗
JReduce [Kalhauge and Palsberg(2019)] | FSE’19 | B2B | ✓ | ✗ | ✗ | ✗ | ✗ | ✓ | ✗ | ✗ | ✓ | ✗ | ✗ | ✗ | ✗ | ✓ | ✗ | ✗
Cimplifier [Rastogi et al.(2017)] | FSE’17 | C2C | ✓ | ✗ | ✗ | ✗ | ✓ | ✓ | ✗ | ✗ | ✓ | ✗ | ✗ | ✓ | ✓ | ✓ | ✗ | ✗
Picup [Wang et al.(2023)] | FSE’23 | S2B | ✗ | ✓ | ✗ | ✗ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✗ | ✓ | ✓ | ✗ | ✗ | ✗
Minimon [Liu et al.(2024)] | ICSE’24 | B2B | ✗ | ✓ | ✗ | ✗ | ✓ | ✓ | ✓ | ✗ | ✗ | ✓ | ✗ | ✗ | ✓ | ✗ | ✗ | ✗
Perses [Sun et al.(2018)] | ICSE’18 | S2S | ✗ | ✓ | ✓ | ✓ | ✓ | ✓ | ✗ | ✗ | ✓ | ✗ | ✗ | ✗ | ✗ | ✓ | ✗ | ✗
AutoDebloater [Liu et al.(2023)] | ASE’23 | B2B | ✓ | ✓ | ✗ | ✗ | ✓ | ✓ | ✗ | ✗ | ✓ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗
DomGad [Xin et al.(2021)] | ASE’20 | S2S | ✗ | ✗ | ✓ | ✓ | ✓ | ✓ | ✗ | ✓ | ✗ | ✓ | ✗ | ✓ | ✓ | ✓ | ✗ | ✗
BlankIt [Porter et al.(2020)] | PLDI’20 | B2B | ✗ | ✓ | ✗ | ✗ | ✓ | ✓ | ✓ | ✗ | ✗ | ✓ | ✗ | ✓ | ✗ | ✓ | ✗ | ✗
C-Reduce [Regehr et al.(2012)] | PLDI’12 | S2S | ✗ | ✓ | ✓ | ✓ | ✓ | ✗ | ✗ | ✗ | ✓ | ✗ | ✓ | ✗ | ✓ | ✗ | ✗ | ✗
Decker [Porter et al.(2023)] | ASPLOS’23 | S2B | ✗ | ✓ | ✗ | ✗ | ✓ | ✓ | ✗ | ✓ | ✗ | ✓ | ✗ | ✓ | ✗ | ✓ | ✗ | ✗
$\mu$Trimmer [Zhang et al.(2022)] | ASPLOS’22 | B2B | ✗ | ✓ | ✓ | ✗ | ✓ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ | ✓ | ✗ | ✗ | ✗ | ✗
Trimmer [Ahmad et al.(2022)] | TSE’22 | S2B | ✗ | ✓ | ✓ | ✓ | ✓ | ✗ | ✗ | ✓ | ✗ | ✓ | ✗ | ✓ | ✓ | ✓ | ✗ | ✗
XDebloat [Tang et al.(2022)] | TSE’21 | B2B | ✓ | ✓ | ✓ | ✓ | ✓ | ✗ | ✗ | ✓ | ✗ | ✓ | ✓ | ✗ | ✓ | ✓ | ✗ | ✗
NA [Farzat et al.(2021)] | TSE’21 | S2S | ✗ | ✓ | ✓ | ✓ | ✗ | ✓ | ✗ | ✗ | ✓ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗
BLADE [Ali et al.(2023a)] | SecDev’23 | S2S | ✗ | ✓ | ✓ | ✓ | ✓ | ✓ | ✗ | ✗ | ✓ | ✗ | ✗ | ✓ | ✓ | ✓ | ✗ | ✗
JDBL [Soto-Valero et al.(2023)] |  Trans. SE. Meth.’23 | S2B | ✓ | ✓ | ✗ | ✗ | ✗ | ✓ | ✗ | ✗ | ✓ | ✓ | ✗ | ✗ | ✓ | ✗ | ✗ | ✗
OCCAM [Navas and Gehani(2023)] | Commun. ACM’23 | S2B | ✗ | ✓ | ✓ | ✓ | ✓ | ✗ | ✗ | ✓ | ✗ | ✗ | ✗ | ✓ | ✓ | ✓ | ✗ | ✗
Ancile [Biswas et al.(2021)] | CODASPY ’21 | S2B | ✗ | ✓ | ✗ | ✗ | ✓ | ✓ | ✗ | ✓ | ✗ | ✓ | ✗ | ✓ | ✓ | ✓ | ✗ | ✗
JSLIM [Ye et al.(2021)] | EISA 2021 | S2S | ✗ | ✓ | ✗ | ✗ | ✓ | ✗ | ✓ | ✗ | ✗ | ✗ | ✗ | ✓ | ✓ | ✗ | ✗ | ✗
PRAT [Williams et al.(2021)] | TOSEM’21 | S2B | ✗ | ✓ | ✗ | ✓ | ✓ | ✓ | ✗ | ✓ | ✓ | ✗ | ✗ | ✓ | ✓ | ✗ | ✗ | ✗
DEPCLEAN [Soto-Valero et al.(2021)] |  Empir SE’21 | D2D | ✓ | ✗ | ✗ | ✗ | ✓ | ✗ | ✗ | ✓ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗
DECAF [Christensen et al.(2020)] | ICSE-SEIP’20 | B2B | ✓ | ✗ | ✗ | ✗ | ✓ | ✓ | ✗ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✗ | ✗ | ✗
NA [Koo et al.(2019)] | EuroSec’19 | S2B | ✓ | ✓ | ✗ | ✗ | ✓ | ✓ | ✗ | ✓ | ✗ | ✓ | ✗ | ✓ | ✗ | ✗ | ✗ | ✗
DeepOCCAM [Le et al.(2019)] | MLforSystems’19 | S2B | ✗ | ✓ | ✓ | ✓ | ✓ | ✗ | ✓ | ✓ | ✗ | ✗ | ✗ | ✓ | ✗ | ✓ | ✗ | ✗
BINTRIMMER [Redini et al.(2019)] | LNSC’19 | B2B | ✗ | ✓ | ✓ | ✗ | ✓ | ✗ | ✗ | ✗ | ✗ | ✓ | ✗ | ✓ | ✓ | ✓ | ✗ | ✗
RedDroid [Jiang et al.(2018)] | ISSRE’18 | B2B | ✗ | ✓ | ✗ | ✗ | ✓ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗
SPEAKER [Lei et al.(2017)] | DIMVA’17 | C2P | ✗ | ✗ | ✗ | ✗ | ✗ | ✓ | ✗ | ✗ | ✓ | ✗ | ✓ | ✓ | ✗ | ✗ | ✗ | ✗
Jred [Jiang et al.(2016)] | COMPSAC’16 | B2B | ✓ | ✓ | ✗ | ✗ | ✓ | ✗ | ✗ | ✗ | ✗ | ✗ | ✓ | ✓ | ✗ | ✓ | ✗ | ✗
NA [Chung et al.(2001)] | ISLPED ’01 | S2S | ✗ | ✓ | ✓ | ✓ | ✓ | ✓ | ✗ | ✓ | ✗ | ✓ | ✗ | ✗ | ✓ | ✓ | ✗ | ✓

####  3.2.1 Functionality

This component presents three strategies to identify unneeded functionalities
at a high level.

  * •

Configuration. In this strategy, the debloating workflow receives program
configurations as input, which are to be preserved in the debloated output.
These configurations may also specify particular points of interest, such as
specific functions and libraries. For example, LMCAS [Alhanahnah et al.(2022)]
requires configurations via command-line arguments or a configuration file,
mirroring the program’s standard execution approach. Conversely, tools like
OCCAM [Navas and Gehani(2023)] and Trimmer [Ahmad et al.(2022)] use a template
format to input the required configurations. Other tools, like temporal-
specialization [Ghavamnia et al.(2020b)], anticipate the configuration in the
form of a list of key functions from the input artifact.

  * •

Test cases. This debloating strategy requires a collection of test cases to
represent the program’s usage profile post-debloating. Tools like Chisel [Heo
et al.(2018)] and Razor [Qian et al.(2019)] use test cases supplied by the
developers as input. Other tools, such as Ancile [Biswas et al.(2021)], employ
fuzzing techniques to generate these test cases. Hacksaw [Hu et al.(2023)]
utilizes hardware probing to identify necessary device drivers to perform
kernel debloating.

  * •

Annotation. In this strategy, the input program is augmented with specific
logic. This addition is either to gather particular information during dynamic
analysis, such as profiling, or to initiate different actions. For instance,
LMCAS [Alhanahnah et al.(2022)] marks specific locations in the program to
signal the completion of the profiling process. Conversely, Slimium [Qian et
al.(2020)] employs binary instrumentation to track functions that are called
during runtime.

Six tools [Agadakos et al.(2019), Koishybayev and Kapravelos(2020), Jiang et
al.(2018), Jiang et al.(2016), Ghavamnia et al.(2020b), Ye et al.(2021)]
(under the none category in Figure 4) depend solely on static analysis
techniques to pinpoint unneeded functionalities, eliminating the need for
explicit expression of these functionalities. Thus, we consider functionality
as an optional component of the debloating strategy stage in the workflow. In
particular, all these tools use only static analysis and identify unused code
by performing a reachability analysis on call graphs [Agadakos et al.(2019),
Jiang et al.(2018)] or dependency graphs [Koishybayev and Kapravelos(2020)].

Figure 3: I/O artifacts type mappings across tools.

Figure 4: Strategies to identify functionality across tools.

####  3.2.2 Analysis

This component describes program analysis techniques that have been utilized
by various software debloating tools.

  * •

Static Analysis. This analysis focuses on building various types of graphs,
such as call graphs, Control Flow Graphs (CFGs), and dependency graphs, to
identify dependencies at multiple levels of granularity. C2C [Ghavamnia et
al.(2022)] generates a CFG and performs data flow analysis during its
analysis. Additionally, an important aspect of static analysis is the
optimization and elimination of unnecessary dependencies. For example, LMCAS
[Alhanahnah et al.(2022)], OCCAM [Navas and Gehani(2023)], and Trimmer [Ahmad
et al.(2022)] implement LLVM passes to simplify and remove unneeded code.

  * •

Dynamic Analysis. In this analysis technique, run-time data is collected to
identify essential dependencies that must be preserved. This technique
typically involves instrumenting the application before execution. Various
tools have been used to aid in dynamic analysis. For example, LMCAS
[Alhanahnah et al.(2022)] and LightBlue [Wu et al.(2021)] employ symbolic
execution, whereas other tools such as Slimium [Qian et al.(2020)] have
developed their own dynamic analysis methods.

  * •

ML-Assisted Static/Dynamic Analysis. Machine Learning (ML), distinct from
prior techniques, is often employed in conjunction with program analysis. An
example of this is Chisel [Heo et al.(2018)], which combines delta debugging
with reinforcement learning.

A variety of tools have utilized a blend of static and dynamic analyses,
sometimes supplemented with machine learning (ML). For instance, Confine
[Ghavamnia et al.(2020a)] and Piece-Wise [Quach et al.(2018)] employ hybrid
analysis techniques for debloating containers and libraries. BlankIt [Porter
et al.(2020)], another hybrid analysis tool, focuses on debloating shared
libraries and incorporates ML, specifically decision trees, to predict the
functions required at a particular call site during execution. Figure 6
presents the number of debloating tools that fall under the different analysis
categories.

####  3.2.3 Removal Granularity

Software debloating tools aim to eliminate unnecessary code and dependencies,
but they do so at different levels of granularity. As shown in Figure 2, there
are four distinct levels of removal granularity in the context of software
debloating: (1) instruction or statement, (2) basic block, (3) function or
library, and (4) file, including class or dependency management. Notably, some
tools, such as Confine [Ghavamnia et al.(2020a)], temporal-specialization
[Ghavamnia et al.(2020b)], and SPEAKER [Lei et al.(2017)], primarily aim to
reduce syscalls rather than directly removing code elements.

Figure 5: Analysis techniques across tools.

Figure 6: Evaluation criteria across tools.

###  3.3 Evaluation Criteria

In this stage of the workflow, measurable metrics are applied to the artifact
before and after debloating to assess its effectiveness from multiple
perspectives. As shown in Figure 6, the following are the main evaluation
criteria used in the reviewed literature:

  * •

Performance. This metric evaluates the performance of the debloated program in
terms of its memory usage, CPU utilization, bandwidth, and runtime.

  * •

Security. Tools for software debloating, particularly those created by the
security community, are designed primarily to improve security and minimize
potential attack vectors. Their security assessment predominantly revolves
around quantifying the count of Common Vulnerability Exposures (CVEs) and
gadgets.

  * •

Robustness. This metric is analyzed from various viewpoints: correctness and
generality. The latter evaluates how accurately a debloated program functions
with inputs that were not part of the original usage profile [Xin et
al.(2023)]. Methods like fuzzing and test cases are used to assess the
correctness. Tools like LMCAS [Alhanahnah et al.(2022)] and Razor [Qian et
al.(2019)] also examine for undesirable behaviors, including incorrect
operations, infinite loops, crashes, and missing output.

  * •

Usability. This metric focuses on assessing the resources needed by the
debloating tool (not the debloated artifact), examined from the perspective of
runtime and functionality requirements. For example, Chisel [Heo et al.(2018)]
utilizes reinforcement learning along with delta debugging, thus increasing
the overhead of running it.

  * •

Integration. BLADE [Ali et al.(2023a)] views software debloating as essential
for ecosystems such as clouds, requiring rapid analysis to support integration
with continuous integration and continuous delivery (CI/CD) infrastructures.
Consequently, this metric evaluates the capacity of debloating tools to
integrate with established ecosystem infrastructures. Despite BLADE’s vision,
its evaluation did not encompass demonstrating integration capabilities.

  * •

Sustainability. This metric evaluates the quality of debloated programs based
on carbon footprint and energy reduction. We found only one debloating tool
[Chung et al.(2001)] that primarily targets energy reduction and thus focuses
on only evaluating this factor.

##  4 Future Research

This section presents open problems in software debloating and calls for
solutions that are practical, usable, and secure.

###  4.1 Software Robustness

Software debloating tools typically prioritize the preservation of error-free
paths by utilizing test cases that reflect the intended behavior or providing
accurate configurations. As a result, event handler procedures can be removed
from the debloated programs, affecting the reliability and robustness of the
application. Ancile [Biswas et al.(2021)] includes the reachable exception
handlers in the final binary. Carve [Brown and Pande(2019)] avoids introducing
vulnerabilities by replacing debloated code with replacement code that
preserves high-level program properties. In some cases, during the debloating
process, Carve replaces the switch block with exception handling code that
traps execution before code blocks that become vulnerable after debloating.
However, more work is needed to balance robustness and removal [Zhang et
al.(2023)].

###  4.2 SBOM Generation

The generation of Software Bills of Materials (SBOMs) has gained significant
importance as regulatory bodies like the US National Telecommunications and
Information Administration (NTIA) mandate the disclosure of primary and
transitive dependencies, thereby documenting the entire code provenance
[nti([n. d.])]. MMLB [Zhang et al.(2024)] constructs dependency trees for ML
containers to investigate the impact of debloating on the number of direct and
transitive dependencies. Recent dependency management approaches, such as
DepsRAG, advocate the use of large language models (LLMs) and knowledge graphs
(KGs) to support the generation of SBOMs [Alhanahnah et al.(2024)].
Identifying software dependencies constitutes a fundamental aspect of the
debloating process, positioning it as a potential facilitator for SBOM
generation. The intersection highlights the necessity for further research in
this domain.

###  4.3 ML for Debloating

Our investigation indicates that only a limited number of tools (7 out of 48)
utilize machine learning (ML) to support debloating. Given the widespread
adoption of ML, particularly LLMs, in tasks such as code generation and
program repair, there is a compelling need to explore how LLMs can enhance the
debloating process.

###  4.4 Debloating Impact on Sustainability

In our literature review, we found only one debloating tool [Chung et
al.(2001)] specifically designed to reduce energy consumption. This
underscores the need for increased focus and effort in this area.
Consequently, we consider this to be an open problem that is worth
investigating, especially if new debloating methods can significantly decrease
energy use and, as a result, cut down on carbon emissions. Subsequently,
researchers might investigate the creation of debloating-driven methods aimed
at eliminating software dependencies to achieve energy savings.

###  4.5 CI/CD Integration

Software debloating has often been approached in a siloed manner, which has
limited its widespread adoption in real-world scenarios. In today’s Software
Development Lifecycle (SDLC) and software supply chains, there is a focus on
transparency and automation, incorporating practices like CI/CD. CI involves
regularly merging code changes from various developers into a central
repository, often multiple times per day. CD ensures that the code in the
repository is always ready for release, having passed automated tests and
quality assessments. Consequently, there are several challenges to address for
integrating software debloating tools into CI/CD pipelines [Ali et
al.(2023a)]. For example, determining which test cases should validate a
release that includes a debloated version of the application and deciding the
necessary security analyses are key considerations.

##  5 Conclusion

Software debloating is an essential dependency management approach for
enhancing both security and performance by removing unnecessary code from
applications. Our SoK highlights the diverse techniques and tools available,
identifies significant advancements, and points out continuing challenges. We
provide a foundational reference, aiming to guide future research and
improvements in software debloating.

## Acknowledgement

This material is based upon work supported by the National Science Foundation
(NSF) under Grant ACI-1440800 and the Office of Naval Research (ONR) under
Contracts N68335-17-C-0558 and N00014-24-1-2049. Any opinions, findings,
conclusions, or recommendations expressed in this material are those of the
authors and do not necessarily reflect the views of NSF or ONR.

## References

  * [1]
  * [TPC([n. d.])] [n. d.].  defense.gov.  https://media.defense.gov/2020/May/18/2002302043/-1/-1/1/NPG17.PDF.  [Accessed 15-06-2024].
  * [nti([n. d.])] [n. d.].  ntia.doc.gov.  https://www.ntia.doc.gov/files/ntia/publications/sbom_minimum_elements_report.pdf.  [Accessed 15-06-2024].
  * [Agadakos et al.(2019)] Ioannis Agadakos, Di Jin, David Williams-King, Vasileios P. Kemerlis, and Georgios Portokalidis. 2019\.  Nibbler: Debloating Binary Shared Libraries. In _35th Annual Computer Security Applications Conference_ (San Juan, Puerto Rico, USA) _(ACSAC ’19)_. Association for Computing Machinery, New York, NY, USA, 70–83.  https://doi.org/10.1145/3359789.3359823
  * [Ahmad et al.(2022)] Aatira Anum Ahmad, Abdul Rafae Noor, Hashim Sharif, Usama Hameed, Shoaib Asif, Mubashir Anwar, Ashish Gehani, Fareed Zaffar, and Junaid Haroon Siddiqui. 2022.  Trimmer: An Automated System for Configuration-Based Software Debloating.  _IEEE Transactions on Software Engineering_ 48, 9 (2022), 3485–3505.  https://doi.org/10.1109/TSE.2021.3095716
  * [Alhanahnah et al.(2024)] Mohannad Alhanahnah, Yazan Boshmaf, and Benoit Baudry. 2024\.  DepesRAG: Towards Managing Software Dependencies using Large Language Models.  _arXiv preprint arXiv:2405.20455_ (2024).
  * [Alhanahnah et al.(2022)] Mohannad Alhanahnah, Rithik Jain, Vaibhav Rastogi, Somesh Jha, and Thomas Reps. 2022\.  Lightweight, Multi-Stage, Compiler-Assisted Application Specialization. In _2022 IEEE 7th European Symposium on Security and Privacy (EuroS &P)_. 251–269.  https://doi.org/10.1109/EuroSP53844.2022.00024
  * [Ali et al.(2023a)] Muaz Ali, Rumaisa Habib, Ashish Gehani, Sazzadur Rahaman, and Zartash Uzmi. 2023a.  Blade: Scalable Source Code Debloating Framework. In _2023 IEEE Secure Development Conference (SecDev)_.
  * [Ali et al.(2023b)] Muaz Ali, Muhammad Muzammil, Faraz Karim, Ayesha Naeem, Rukhshan Haroon, Muhammad Haris, Huzaifah Nadeem, Waseem Sabir, Fahad Shaon, Fareed Zaffar, et al. 2023b.  SoK: A Tale of Reduction, Security, and Correctness-Evaluating Program Debloating Paradigms and Their Compositions. ESORICS.
  * [Biswas et al.(2021)] Priyam Biswas, Nathan Burow, and Mathias Payer. 2021\.  Code Specialization through Dynamic Feature Observation. In _11th ACM Conference on Data and Application Security and Privacy_ (Virtual Event, USA) _(CODASPY ’21)_. Association for Computing Machinery, New York, NY, USA, 257–268.  https://doi.org/10.1145/3422337.3447844
  * [Brown et al.(2024)] Michael D. Brown, Adam Meily, Brian Fairservice, Akshay Sood, Jonathan Dorn, Eric Kilmer, and Ronald Eytchison. 2024.  A Broad Comparative Evaluation of Software Debloating Tools.  arXiv:2312.13274
  * [Brown and Pande(2019)] Michael D. Brown and Santosh Pande. 2019.  CARVE: Practical Security-Focused Software Debloating Using Simple Feature Set Mappings. In _3rd ACM Workshop on Forming an Ecosystem Around Software Transformation_ (London, United Kingdom) _(FEAST’19)_. Association for Computing Machinery, New York, NY, USA, 1–7.  https://doi.org/10.1145/3338502.3359764
  * [Bruce et al.(2020)] Bobby R. Bruce, Tianyi Zhang, Jaspreet Arora, Guoqing Harry Xu, and Miryung Kim. 2020.  JShrink: In-Depth Investigation into Debloating Modern Java Applications. In _28th ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Software Engineering_ (Virtual Event, USA) _(ESEC/FSE 2020)_. Association for Computing Machinery, New York, NY, USA, 135–146.  https://doi.org/10.1145/3368089.3409738
  * [Christensen et al.(2020)] Jake Christensen, Ionut Mugurel Anghel, Rob Taglang, Mihai Chiroiu, and Radu Sion. 2020\.  DECAF: Automatic, Adaptive De-bloating and Hardening of COTS Firmware. In _29th USENIX Security Symposium (USENIX Security 20)_. USENIX Association, 1713–1730.
  * [Chung et al.(2001)] Eui-Young Chung, Luca Benini, and Giovanni De Micheli. 2001\.  Automatic Source Code Specialization for Energy Reduction. In _International Symposium on Low Power Electronics and Design_ (Huntington Beach, California, USA) _(ISLPED ’01)_. Association for Computing Machinery, New York, NY, USA, 80–83.  https://doi.org/10.1145/383082.383099
  * [Düsing and Hermann(2022)] Johannes Düsing and Ben Hermann. 2022.  Analyzing the Direct and Transitive Impact of Vulnerabilities onto Different Artifact Repositories.  _Digital Threats_ 3, 4, Article 38 (feb 2022), 25 pages.  https://doi.org/10.1145/3472811
  * [Farzat et al.(2021)] Fábio de A. Farzat, Márcio de O. Barros, and Guilherme H. Travassos. 2021.  Evolving JavaScript Code to Reduce Load Time.  _IEEE Transactions on Software Engineering_ 47, 8 (2021), 1544–1558.  https://doi.org/10.1109/TSE.2019.2928293
  * [Ghaffarinia and Hamlen(2019)] Masoud Ghaffarinia and Kevin W. Hamlen. 2019.  Binary Control-Flow Trimming. In _ACM SIGSAC Conference on Computer and Communications Security_ (London, United Kingdom) _(CCS ’19)_. Association for Computing Machinery, New York, NY, USA, 1009–1022.  https://doi.org/10.1145/3319535.3345665
  * [Ghavamnia et al.(2020a)] Seyedhamed Ghavamnia, Tapti Palit, Azzedine Benameur, and Michalis Polychronakis. 2020a.  Confine: Automated System Call Policy Generation for Container Attack Surface Reduction. In _23rd International Symposium on Research in Attacks, Intrusions and Defenses (RAID 2020)_. USENIX Association, San Sebastian, 443–458.
  * [Ghavamnia et al.(2020b)] Seyedhamed Ghavamnia, Tapti Palit, Shachee Mishra, and Michalis Polychronakis. 2020b.  Temporal System Call Specialization for Attack Surface Reduction. In _29th USENIX Conference on Security Symposium_ _(SEC’20)_. USENIX Association, USA, Article 99, 18 pages.
  * [Ghavamnia et al.(2022)] Seyedhamed Ghavamnia, Tapti Palit, and Michalis Polychronakis. 2022.  C2C: Fine-Grained Configuration-Driven System Call Filtering. In _ACM SIGSAC Conference on Computer and Communications Security_ (Los Angeles, CA, USA) _(CCS ’22)_. Association for Computing Machinery, New York, NY, USA, 1243–1257.  https://doi.org/10.1145/3548606.3559366
  * [Hassan et al.(2023)] Muhammad Hassan, Talha Tahir, Muhammad Farrukh, Abdullah Naveed, Anas Naeem, Fahad Shaon, Fareed Zaffar, Ashish Gehani, and Sazzadur Rahaman. 2023.  Evaluating Container Debloaters.  _8th IEEE Secure Development Conference (SecDev)_ (2023).  https://doi.org/10.1109/SecDev56634.2023.00023
  * [Heo et al.(2018)] Kihong Heo, Woosuk Lee, Pardis Pashakhanloo, and Mayur Naik. 2018\.  Effective Program Debloating via Reinforcement Learning. In _ACM SIGSAC Conference on Computer and Communications Security_ (Toronto, Canada) _(CCS ’18)_. Association for Computing Machinery, New York, NY, USA, 380–394.  https://doi.org/10.1145/3243734.3243838
  * [Hu and Dolan-Gavitt(2022)] Zhenghao Hu and Brendan Dolan-Gavitt. 2022.  IRQDebloat: Reducing Driver Attack Surface in Embedded Devices. In _2022 IEEE Symposium on Security and Privacy (SP)_. 1608–1622.  https://doi.org/10.1109/SP46214.2022.9833695
  * [Hu et al.(2023)] Zhenghao Hu, Sangho Lee, and Marcus Peinado. 2023.  Hacksaw: Hardware-Centric Kernel Debloating via Device Inventory and Dependency Analysis. In _ACM SIGSAC Conference on Computer and Communications Security_ _(CCS ’23)_. Association for Computing Machinery, New York, NY, USA, 1994–2008.  https://doi.org/10.1145/3576915.3623208
  * [Jiang et al.(2018)] Yufei Jiang, Qinkun Bao, Shuai Wang, Xiao Liu, and Dinghao Wu. 2018.  RedDroid: Android Application Redundancy Customization Based on Static Analysis. In _2018 IEEE 29th International Symposium on Software Reliability Engineering (ISSRE)_. 189–199.  https://doi.org/10.1109/ISSRE.2018.00029
  * [Jiang et al.(2016)] Yufei Jiang, Dinghao Wu, and Peng Liu. 2016.  JRed: Program Customization and Bloatware Mitigation Based on Static Analysis. In _2016 IEEE 40th Annual Computer Software and Applications Conference (COMPSAC)_ , Vol. 1. 12–21.  https://doi.org/10.1109/COMPSAC.2016.146
  * [Kalhauge and Palsberg(2019)] Christian Gram Kalhauge and Jens Palsberg. 2019.  Binary Reduction of Dependency Graphs. In _27th ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Software Engineering_ (Tallinn, Estonia) _(ESEC/FSE 2019)_. Association for Computing Machinery, New York, NY, USA, 556–566.  https://doi.org/10.1145/3338906.3338956
  * [Koishybayev and Kapravelos(2020)] Igibek Koishybayev and Alexandros Kapravelos. 2020.  Mininode: Reducing the Attack Surface of Node.js Applications. In _23rd International Symposium on Research in Attacks, Intrusions and Defenses (RAID 2020)_. USENIX Association, San Sebastian, 121–134.
  * [Koo et al.(2019)] Hyungjoon Koo, Seyedhamed Ghavamnia, and Michalis Polychronakis. 2019\.  Configuration-Driven Software Debloating. In _12th European Workshop on Systems Security_ (Dresden, Germany) _(EuroSec ’19)_. Association for Computing Machinery, New York, NY, USA, Article 9, 6 pages.  https://doi.org/10.1145/3301417.3312501
  * [Kroes et al.(2018)] Taddeus Kroes, Anil Altinay, Joseph Nash, Yeoul Na, Stijn Volckaert, Herbert Bos, Michael Franz, and Cristiano Giuffrida. 2018.  BinRec: Attack Surface Reduction Through Dynamic Binary Recovery. In _Workshop on Forming an Ecosystem Around Software Transformation_ (Toronto, Canada) _(FEAST ’18)_. Association for Computing Machinery, New York, NY, USA, 8–13.  https://doi.org/10.1145/3273045.3273050
  * [Le et al.(2019)] Nham Le, Ashish Gehani, Arie Gurfinkel, Susmit Jha, and Jorge Navas. 2019.  Reinforcement Learning Guided Software Debloating.  _2nd Workshop on Machine Learning for Systems_ (2019).
  * [Lei et al.(2017)] Lingguang Lei, Jianhua Sun, Kun Sun, Chris Shenefiel, Rui Ma, Yuewu Wang, and Qi Li. 2017.  SPEAKER: Split-phase execution of application containers. In _Detection of Intrusions and Malware, and Vulnerability Assessment: 14th International Conference, DIMVA 2017, Bonn, Germany, July 6-7, 2017, Proceedings 14_. Springer, 230–251.
  * [Ligatti et al.(2005)] J Ligatti, M Abadi, M Bidiu, and U Erlingsson. 2005\.  Control Flow integrity. In _12th ACM Conference on Computer and communications security_.
  * [Liu et al.(2023)] Jiakun Liu, Xing Hu, Ferdian Thung, Shahar Maoz, Eran Toch, Debin Gao, and David Lo. 2023.  AutoDebloater: Automated Android App Debloating. In _2023 38th IEEE/ACM International Conference on Automated Software Engineering (ASE)_. IEEE, 2090–2093.
  * [Liu et al.(2024)] Jiakun Liu, Zicheng Zhang, Xing Hu, Ferdian Thung, Shahar Maoz, Debin Gao, Eran Toch, Zhipeng Zhao, and David Lo. 2024.  MiniMon: Minimizing Android Applications with Intelligent Monitoring-Based Debloating. In _2024 IEEE/ACM 46th International Conference on Software Engineering (ICSE)_. IEEE Computer Society, 990–990.
  * [Malecha et al.(2015)] Gregory Malecha, Ashish Gehani, and Natarajan Shankar. 2015\.  Automated Software Winnowing.  _30th ACM Symposium on Applied Computing (SAC)_ (2015).  https://doi.org/10.1145/2695664.2695751
  * [Mishra and Polychronakis(2020)] Shachee Mishra and Michalis Polychronakis. 2020.  Saffire: Context-sensitive Function Specialization against Code Reuse Attacks. In _2020 IEEE European Symposium on Security and Privacy (EuroS &P)_. 17–33.  https://doi.org/10.1109/EuroSP48549.2020.00010
  * [Mohagheghi et al.(2004)] Parastoo Mohagheghi, Reidar Conradi, Ole M Killi, and Henrik Schwarz. 2004.  An empirical study of software reuse vs. defect-density and stability. In _Proceedings. 26th International Conference on Software Engineering_. IEEE, 282–291.
  * [Navas and Gehani(2023)] Jorge A. Navas and Ashish Gehani. 2023.  OCCAM-v2: Combining Static and Dynamic Analysis for Effective and Efficient Whole-Program Specialization.  _Commun. ACM_ 66, 4 (mar 2023), 40–47.  https://doi.org/10.1145/3583112
  * [Pashakhanloo et al.(2022)] Pardis Pashakhanloo, Aravind Machiry, Hyonyoung Choi, Anthony Canino, Kihong Heo, Insup Lee, and Mayur Naik. 2022\.  PacJam: Securing Dependencies Continuously via Package-Oriented Debloating. In _ACM Asia Conference on Computer and Communications Security_ (Nagasaki, Japan) _(ASIA CCS ’22)_. Association for Computing Machinery, New York, NY, USA, 903–916.  https://doi.org/10.1145/3488932.3524054
  * [Porter et al.(2023)] Chris Porter, Sharjeel Khan, and Santosh Pande. 2023\.  Decker: Attack Surface Reduction via On-Demand Code Mapping. In _28th ACM International Conference on Architectural Support for Programming Languages and Operating Systems, Volume 2_ (Vancouver, BC, Canada) _(ASPLOS 2023)_. Association for Computing Machinery, New York, NY, USA, 192–206.  https://doi.org/10.1145/3575693.3575734
  * [Porter et al.(2020)] Chris Porter, Girish Mururu, Prithayan Barua, and Santosh Pande. 2020.  BlankIt Library Debloating: Getting What You Want Instead of Cutting What You Don’t. In _41st ACM SIGPLAN Conference on Programming Language Design and Implementation_ (London, UK) _(PLDI 2020)_. Association for Computing Machinery, New York, NY, USA, 164–180.  https://doi.org/10.1145/3385412.3386017
  * [Qian et al.(2019)] Chenxiong Qian, Hong Hu, Mansour Alharthi, Pak Ho Chung, Taesoo Kim, and Wenke Lee. 2019\.  RAZOR: A Framework for Post-deployment Software Debloating. In _28th USENIX Security Symposium (USENIX Security 19)_. USENIX Association, Santa Clara, CA, 1733–1750.
  * [Qian et al.(2020)] Chenxiong Qian, Hyungjoon Koo, ChangSeok Oh, Taesoo Kim, and Wenke Lee. 2020.  Slimium: Debloating the Chromium Browser with Feature Subsetting. In _ACM SIGSAC Conference on Computer and Communications Security_ (Virtual Event, USA) _(CCS ’20)_. Association for Computing Machinery, New York, NY, USA, 461–476.  https://doi.org/10.1145/3372297.3417866
  * [Quach et al.(2018)] Anh Quach, Aravind Prakash, and Lok Yan. 2018.  Debloating Software through Piece-Wise Compilation and Loading. In _27th USENIX Security Symposium (USENIX Security 18)_. USENIX Association, Baltimore, MD, 869–886.
  * [Rastogi et al.(2017)] Vaibhav Rastogi, Drew Davidson, Lorenzo De Carli, Somesh Jha, and Patrick McDaniel. 2017.  Cimplifier: Automatically Debloating Containers. In _11th Joint Meeting on Foundations of Software Engineering_ (Paderborn, Germany) _(ESEC/FSE 2017)_. Association for Computing Machinery, New York, NY, USA, 476–486.  https://doi.org/10.1145/3106237.3106271
  * [Redini et al.(2019)] Nilo Redini, Ruoyu Wang, Aravind Machiry, Yan Shoshitaishvili, Giovanni Vigna, and Christopher Kruegel. 2019.  Bintrimmer: Towards static binary debloating through abstract interpretation. In _Detection of Intrusions and Malware, and Vulnerability Assessment: 16th International Conference, DIMVA 2019, Gothenburg, Sweden, June 19–20, 2019, Proceedings 16_. Springer, 482–501.
  * [Regehr et al.(2012)] John Regehr, Yang Chen, Pascal Cuoq, Eric Eide, Chucky Ellison, and Xuejun Yang. 2012\.  Test-Case Reduction for C Compiler Bugs. In _33rd ACM SIGPLAN Conference on Programming Language Design and Implementation_ (Beijing, China) _(PLDI ’12)_. Association for Computing Machinery, New York, NY, USA, 335–346.  https://doi.org/10.1145/2254064.2254104
  * [Shankar and Gehani(2012)] Natarajan Shankar and Ashish Gehani. 2012.  Static Previrtualization.  _12th High Confidence Software and Systems Conference (HCSS)_ (2012).
  * [Snow et al.(2013)] Kevin Z Snow, Fabian Monrose, Lucas Davi, Alexandra Dmitrienko, Christopher Liebchen, and Ahmad-Reza Sadeghi. 2013.  Just-in-time code reuse: On the effectiveness of fine-grained address space layout randomization. In _2013 IEEE symposium on security and privacy_. IEEE, 574–588.
  * [Soto-Valero et al.(2023)] César Soto-Valero, Thomas Durieux, Nicolas Harrand, and Benoit Baudry. 2023.  Coverage-Based Debloating for Java Bytecode.  _ACM Trans. Softw. Eng. Methodol._ 32, 2, Article 38 (apr 2023), 34 pages.  https://doi.org/10.1145/3546948
  * [Soto-Valero et al.(2021)] César Soto-Valero, Nicolas Harrand, Martin Monperrus, and Benoit Baudry. 2021.  A comprehensive study of bloated dependencies in the maven ecosystem.  _Empirical Software Engineering_ 26, 3 (2021), 45\.
  * [Sun et al.(2018)] Chengnian Sun, Yuanbo Li, Qirun Zhang, Tianxiao Gu, and Zhendong Su. 2018.  Perses: Syntax-Guided Program Reduction. In _2018 IEEE/ACM 40th International Conference on Software Engineering (ICSE)_. 361–371.  https://doi.org/10.1145/3180155.3180236
  * [Tang et al.(2022)] Yutian Tang, Hao Zhou, Xiapu Luo, Ting Chen, Haoyu Wang, Zhou Xu, and Yan Cai. 2022.  XDebloat: Towards Automated Feature-Oriented App Debloating.  _IEEE Transactions on Software Engineering_ 48, 11 (2022), 4501–4520.  https://doi.org/10.1109/TSE.2021.3120213
  * [Wang et al.(2023)] Xiaoke Wang, Tao Hui, Lei Zhao, and Yueqiang Cheng. 2023\.  Input-Driven Dynamic Program Debloating for Code-Reuse Attack Mitigation. In _31st ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering_ _(ESEC/FSE 2023)_. Association for Computing Machinery, New York, NY, USA, 934–946.  https://doi.org/10.1145/3611643.3616274
  * [Williams et al.(2021)] Ryan Williams, Tongwei Ren, Lorenzo De Carli, Long Lu, and Gillian Smith. 2021.  Guided Feature Identification and Removal for Resource-Constrained Firmware.  _ACM Trans. Softw. Eng. Methodol._ 31, 2, Article 28 (dec 2021), 25 pages.  https://doi.org/10.1145/3487568
  * [Wu et al.(2021)] Jianliang Wu, Ruoyu Wu, Daniele Antonioli, Mathias Payer, Nils Ole Tippenhauer, Dongyan Xu, Dave (Jing) Tian, and Antonio Bianchi. 2021\.  LIGHTBLUE: Automatic Profile-Aware Debloating of Bluetooth Stacks. In _30th USENIX Security Symposium (USENIX Security 21)_. USENIX Association, 339–356.
  * [Xin et al.(2021)] Qi Xin, Myeongsoo Kim, Qirun Zhang, and Alessandro Orso. 2021\.  Subdomain-Based Generality-Aware Debloating. In _35th IEEE/ACM International Conference on Automated Software Engineering_ (Virtual Event, Australia) _(ASE ’20)_. Association for Computing Machinery, New York, NY, USA, 224–236.  https://doi.org/10.1145/3324884.3416644
  * [Xin et al.(2023)] Qi Xin, Qirun Zhang, and Alessandro Orso. 2023.  Studying and Understanding the Tradeoffs Between Generality and Reduction in Software Debloating. In _37th IEEE/ACM International Conference on Automated Software Engineering_ (Rochester, MI, USA) _(ASE ’22)_. Association for Computing Machinery, New York, NY, USA, Article 99, 13 pages.  https://doi.org/10.1145/3551349.3556970
  * [Ye et al.(2021)] Renjun Ye, Liang Liu, Simin Hu, Fangzhou Zhu, Jingxiu Yang, and Feng Wang. 2021\.  JSLIM: Reducing the known vulnerabilities of Javascript application by debloating. In _International Symposium on Emerging Information Security and Applications_. Springer, 128–143.
  * [Zhang et al.(2024)] Huaifeng Zhang, Mohannad Alhanahnah, Fahmi Abdulqadir Ahmed, Dyako Fatih, Philipp Leitner, and Ahmed Ali-Eldin. 2024.  Machine Learning Systems are Bloated and Vulnerable.  _Proc. ACM Meas. Anal. Comput. Syst._ 8, 1, Article 6 (feb 2024), 30 pages.  https://doi.org/10.1145/3639032
  * [Zhang et al.(2023)] Huaifeng Zhang, Mohannad Alhanahnah, and Ahmed Ali-Eldin. 2023\.  BLAFS: A Bloat Aware File System.  (2023).  arXiv:2305.04641
  * [Zhang et al.(2022)] Haotian Zhang, Mengfei Ren, Yu Lei, and Jiang Ming. 2022\.  One Size Does Not Fit All: Security Hardening of MIPS Embedded Systems via Static Binary Debloating for Shared Libraries. In _27th ACM International Conference on Architectural Support for Programming Languages and Operating Systems_ (Lausanne, Switzerland) _(ASPLOS ’22)_. Association for Computing Machinery, New York, NY, USA, 255–270.  https://doi.org/10.1145/3503222.3507768