一句话：提出 BASTION，通过保障系统调用的合法使用来防御控制流劫持与提权攻击。
系统调用是许多严重安全攻击的关键环节，如控制流劫持和权限提升；execve、mprotect 等安全敏感系统调用尤其常被攻击者用于完成攻击。然而现有防御工作很少关注确保这些系统调用的合法使用，使攻击者能够恶意利用系统调用。为此，论文提出 BASTION，目标是保护系统调用，从而阻断（大部分）依赖系统调用的攻击路径。摘要未具体说明 BASTION 的实现机制与实验评估结果，但将其定位为面向系统调用合法使用的防御方案。
System calls are a critical building block in many serious security attacks, such as control-flow hijacking and privilege escalation attacks. Security-sensitive system calls (e.g., execve, mprotect), especially play a major role in completing attacks. Yet, few defense efforts focus to ensure their legitimate usage, allowing attackers to maliciously leverage system calls in attacks.
@inproceedings{paperbot10100,
title = {Protect the System Call, Protect (Most of) the World with BASTION},
author = {Christopher Jelesnianski and Mohannad Ismail and Yeongjin Jang and Dan Williams and Changwoo Min},
booktitle = {ASPLOS},
year = {2023},
doi = {10.1145/3582016.3582066}
}