A Design Science Approach to Quantifying the Impact of Address Randomization on Unikernel Security

Date of Award

3-2026

Document Type

Dissertation

Degree Name

Doctor of Philosophy in Cyber Security

First Advisor

Kyle Cronin

Second Advisor

John Hastings

Third Advisor

Josh Stroschein

Abstract

Unikernels have emerged as a lightweight alternative to traditional virtual machines and containers by unifying application and operating system functionality into a single address space. While this architectural minimalism reduces overhead and improves deployment efficiency, it frequently results in the omission of established exploit mitigation techniques such as Address Space Layout Randomization, Data Execution Prevention, and stack canaries. As a result, many unikernels retain largely deterministic memory layouts that may enable reliable exploitation.

This research employs a design science methodology to implement and quantitatively evaluate address randomization within the OSv unikernel. A single-case mechanism experiment introduces randomized base and stack address selection through modifications to OSv’s memory management and program loading components. The resulting artifact is evaluated against an unmodified baseline using 599 executions to measure boot time, application runtime, memory usage, and address distribution behavior.

Statistical analysis demonstrates that the introduced mechanism produces uniformly distributed address values while incurring negligible performance and memory overhead. These results show that address randomization can be integrated into a production-oriented unikernel without undermining its core performance characteristics. This work establishes a reproducible methodology for implementing and empirically evaluating security mechanisms in unikernel environments, addressing a persistent gap between security assumptions and quantitative validation in unikernel research.

Link to Full Text

Share

COinS