Subdomain-Based Generality-Aware Debloating

Abstract

Programs are becoming increasingly complex and typically contain an abundance of unneeded features, which can degrade the performance and security of the software. Recently, we have witnessed a surge of debloating techniques that aim to create a reduced version of a program by eliminating the unneeded features therein. To de-bloat a program, most existing techniques require a usage profile of the program, typically provided as a set of inputs $I$. Unfortunately, these techniques tend to generate a reduced program that is overfitted to $I$ and thus fails to behave correctly for other inputs. To address this limitation, we propose Domgad, which has two main advantages over existing debloating approaches. First, it produces a reduced program that is guaranteed to work for subdomains, rather than for specific inputs. Second, it uses stochastic optimization to generate reduced programs that achieve a close-to-optimal tradeoff between reduction and generality (i.e., the extent to which the reduced program is able to correctly handle inputs in its whole domain). To assess the effectiveness of Domgad, we applied our approach to a benchmark of ten Unix utility programs. Our results are promising, as they show that Domgad could produce debloated programs that achieve, on average, 50% code reduction and 95% generality. Our results also show that Domgad performs well when compared with two state-of-the-art debloating approaches.