Slimium: Debloating the Chromium Browser with Feature Subsetting - PowerPoint PPT Presentation

Slimium: Debloating the Chromium Browser with Feature Subsetting CHENXIONG QIAN, HYUNGJOON (KEVIN) KOO, CHANGSEOK OH, TAESOO KIM, WENKE LEE 1

Background • Chromium dominates Web browser market share. • Ever-increasing Features: • 2300+ Html/Javascript properties • 700+ CSS properties • Hundreds of experimental features 2

Problem • Not all features are used commonly. • Attack surface is increasing. Feature Policy 3

Slimium Remove code of unused features. Given a set of websites, generate a slim version of Chromium. 4

Overview Map code to features Remove unused features Entire Code F 2 F 1 Profile websites 5

Feature Code Mapping • Challenge • Large-scale & Complex • Code generation during compiling 6

Feature Code Mapping • Approach Feature B Feature A ➢ Manual Analysis aaa.cpp b.cpp c.cpp d.cpp dd.cpp • Investigate source code and documents. • Create an initial mapping between features and source code (i.e., files). aa.cpp 7

Feature Code Mapping • Approach Feature B Feature A ➢ Manual Analysis • Investigate source code and documents. aaa.cpp b.cpp c.cpp d.cpp dd.cpp • Create an initial mapping between features and source code (i.e., files). aa.cpp ➢ Static Analysis • Build the call graph b.cpp dd.cpp aaa.cpp c.cpp d.cpp • Compute a relation vector 𝑺 = (𝒔 𝒅 , 𝒔 𝒕 ) • 𝒔 𝒅 -- Call Invocation Relation (0 ~ 1) • 𝒔 𝒕 -- File Name Similarity (0 ~ 1) aa.cpp • If 𝒔 𝒅 and 𝒔 𝒕 are greater than the thresholds, dd l ’s pp ng. 8

Webpage Profiling • Challenge & Approach • Nondeterministic Code Identified nondeterministic code from visiting the top 1000 Alexa websites • Keep profiling until stable. • Performance • Ad p A L’s pp c . 9

Removing Unused Features • Keep nondeterministic code. • lc l ’s c d c v g b s d n p l ng s l s. • If the code coverage is greater than the threshold (i.e., 𝑼 ), keep the feature. • w s , v ’s n c d c d . • Rewrite the binary to remove code. 10

Evaluation ➢ Feature Code Mapping 42.3 MB 44.9 MB 57.0 MB Manual Analysis Static Analysis 11

Evaluation ➢ Code Reduction & Security Benefits • Visit 40 websites from 10 different groups. 12

Evaluation ➢ Feature Usages 13

Related Works • nyd ’s w k ’17 • “M s W bs s D n’ N d V b : A s - B n App c p v ng B ws c y” • Scope • API blocking vs Code removing 14

Limitations • Rely on manual analysis. • Not 100% guaranteed stable. 15

Questions? 16