Huge congrats to Meghna Pancholi for presenting our paper, Santa -- a language-agnostic approach to system call policy learning for microservices -- at
#DIMVA2026 (the Conference on Detection of Intrusions and Malware & Vulnerability Assessment) in Chania, Crete! 🇬🇷
Cloud teams securing microservices are usually stuck choosing between heavy isolation that hurts latency, or system call filters that are either too loose (based on static analysis) or too brittle (based on dynamic tracing). Our work, Santa, resolves this by running two versions of an app side-by-side: a fast production version and a "hardened" security-oracle version (instrumented, for example, to catch memory-safety and concurrency errors). When the production service hits a syscall outside its current policy, Santa re-runs the request against the hardened oracle -- if it's benign, the policy is safely expanded; if it's bogus, an attack is caught and blocked. This lets Santa build tight, workload-specific syscall allow-lists on the fly, without paying the full cost of heavyweight hardening in steady-state traffic.
Joint work with Andreas D. Kellas, Kostis Kaffes,
@SteveBellovin@infosec.exchange and Simha Sethumadhavan!
Thanks to
@sotiris@ioc.exchange and Michalis Diamantaris for organizing a great conference! It was a real pleasure attending and catching up with so many friends and colleagues along the way.
✳️ Paper:
https://cs.brown.edu/people/vpk/papers/santa.dimva26.pdf
💾 Code:
https://github.com/meghna-pancholi/santa-ebpf
#dimva2026 #browncs #brownssl
