Experiences and Lessons Learned for Late-Stage Software Transformation and Customization

The Office of Naval Research (ONR) Total Platform Cyber Protection (TPCP) program has led to the development of numerous tools for late-stage software customization and debloating. These tools were originally developed by ONR-sponsored academic research to remove unused code and unwanted features from software as well as harden containers. Several performers were funded by this project to generalize and mature selected late-stage software transformation and customization tools. In this paper, we distill the experiences we accumulated as the developers on the project into lessons learned, and present them through a case study on Java debloating. We provide several key recommendations to inform future work and considerations to be made when transitioning academic prototypes of systems security tools to real world use.