A Survey of Unikernel Security: Insights and Trends from a Quantitative Analysis

Unikernels, an evolution of LibOSs, are emerging as a virtualization technology to rival those currently used by cloud providers. Unikernels combine the user and kernel space into one "uni"fied memory space and omit functionality that is not necessary for its application to run, thus drastically reducing the required resources. The removed functionality is significant however, and includes components that have become common security technologies such as Address Space Layout Randomization (ASLR), Data Execution Prevention (DEP), and Non-executable bits (NX bits). This raises questions about the security of unikernels. This research presents a quantitative methodology using TF-IDF to analyze the focus of security discussions within unikernel research literature. An initial corpus of 51 unikernel-related papers spanning 2013-2023 was collected. The systematic selection process detailed in the methodology narrowed down to 33 core papers which were then analyzed for trends in security topics. Analysis found that Memory Protection Extensions (MPX) and DEP were the least frequently occurring topics, while Software Guard Extensions (SGX) was the most frequent topic. The findings quantify priorities and assumptions in unikernel security research, identifying potential risks from underexplored attack surfaces. This study represents the first application of TF-IDF analysis to quantitatively assess trends in unikernel security literature, offering novel insights into the field’s development and focus areas. In addition, this approach should be broadly applicable for revealing trends and gaps in other niche security domains.