Jianwei Zhuge

Jianwei Zhuge

PKU->THU

Jianwei Zhuge (诸葛建伟)

博士, 副研究员, CCF杰出会员
FIT 4-204, 清华大学, 北京市海淀区, 100084
zhugejw [at] tsinghua -dot- edu -dot- cn

Headline

长期欢迎对安全感兴趣，自我驱动的访问学者、科研助理（工程师）、硕士研究生、客座研究生、实习生等，有意者邮件联系。 主要研究方向：工控安全、物联网安全、硬件安全等。

About

清华大学，网络科学与网络空间研究院，网络与信息安全实验室（NISL）副研究员，硕士生导师，中关村实验室双聘研究员。蓝莲花战队联合创始人及领队、XCTF国际联赛共同发起人及技术委员会主任。国内网络安全领域的知名技术书籍作者与译者。WitAwards互联网安全评选2017年度安全人物获奖者。

2006年6月毕业于北京大学，获理学博士学位，就读期间获得IBM Ph.D. Fellow, 微软学者, 惠普中国优秀学生, 北大五四青年科学奖等奖励，获得北京大学教职，在北大计算机研究所信息安全工程研究中心从事教学科研工作，2009年8月晋升为副研究员。2010年12月调入清华大学网络科学与网络空间研究院（原网络中心），主要承担网络与系统安全方向的教学与科研工作，及支持CCERT服务工作，目前是狩猎女神科研小组负责人。主要从事互联网安全威胁监测、安全漏洞检测分析、工控与IoT安全等基础技术的研究与工程实践工作。北京信息科学国家研究中心、清华大学下一代互联网核心网国家工程实验室科研基地的青年科研业务骨干教师，中国计算机学会杰出会员。

主持和参与国家自然科学基金、核高基子课题等国家纵向科研项目，以及腾讯、中国电信、西门子等横向项目共计40余项，2010年以来在清华主持或共同主持项目20多项，个人负责经费超过4000万元。

出版多本网络安全专著教材和翻译技术书籍，在USENIX Security、ACM CCS、IEEE S&P、ACSAC、AsiaCCS等网络与系统安全领域知名国际会议，ACL等AI领域顶级知名国际会议，ISSTA、ESEM等软件工程领域知名国际会议，及MONET、Future Internet、计算机学报、软件学报等国内外期刊上发表学术论文近100篇，截至2024年8月，Scholar引用1869次，H-index为22，国内外发明专利授权10项。

联合创建网络安全技术竞赛战队-蓝莲花战队，并作为领队带队成为中国历史上首支进入DEFCON CTF全球网络安全技术对抗赛（网络安全领域“世界杯”）总决赛的团队；2013年战队全球排位第6位，2013、2014年连续两年亚洲排名第一；2016年和上海交通大学0ops 联合组队b1o0p获得DEFCON CTF全球总决赛亚军。创建清华-紫荆花战队，在国内网络安全技术对抗赛多次获得冠军等成绩。

研究兴趣

  • 互联网安全威胁监测和响应
  • 多种类型恶意代码的采集、分析、检测与防御技术
  • 软件漏洞分析，检测与缓解
  • 工控与物联网安全

教育

  • 北京大学 计算机系 博士生. 2001-2006. 导师: 王选院士, 肖建国教授 Dissertation: Research on Technologies for Network Intrusion Detection and Behavior Correlation Analysis. 指导老师：阳振坤教授，潘爱民教授，邹维教授.
  • 北京大学 计算机系 本科生. 1997-2001.

职业经历

  • 2010 – 今，清华大学 网络研究院 / 北京信息科学与技术国家研究中心, 副研究员.
  • 2022 - 今，中关村实验室，双聘研究员.
  • 2019 – 2021，东南大学网络空间安全学院，校外博士生导师.
  • 2016 – 2018, 哈尔滨工业大学（威海）计算机学院，兼职教授.
  • 2009 – 2010. 北京大学计算机研究所，副研究员。
  • 2006 - 2009，北京大学计算机研究所，助理研究员。

发表国际会议论文

  • Yi He and Yunchao Guan(Co-first author), Ruoyu Lun, Shangru Song, Zhihao Guo, Jianwei Zhuge*, Jianjun Chen, Qiang Wei, Zehui Wu, Miao Yu, Hetian Shi, Qi Li. Demystifying the Security Implications in IoT Device Rental Services, USENIX Security 2024. (to appear)

  • Jiahe Zhang, Jianjun Chen, Qi Wang, Hangyu Zhang, Chuhan Wang, Jianwei Zhuge, Haixin Duan, Inbox Invasion: Exploiting MIME Ambiguities to Evade Email Attachment Detectors. 31th ACM Conference on Computer and Communications Security: CCS 2024 (to appear).

  • Hetian Shi, Yi He, Qing Wang, Jianwei Zhuge*, Qi Li, Xin Liu. Laser-Based Command Injection Attacks on Voice-Controlled Microphone Arrays. IACR Transactions on Cryptographic Hardware and Embedded Systems, 2024(2), 654-676. CHES 2024. (to appear)

  • Hetian Shi, Shangru Song, Jianwei Zhuge*, Xin Liu. Poster: Advanced Ultrasonic Jamming Technology for Privacy Protection: Dynamic Inter-modulation Modulation (DIM), IEEE S&P 2024.

  • Guo, Minglei; Xiao, Zhenghang; Liu, Xin; Zhuge, Jianwei*. Discovering and Understanding the Security Flaws of Authentication and Authorization in IoT Cloud APIs for Smart Home. SecureComm 2023, October 19-21, 2023, Hong Kong SAR, China.

  • Wang, Yuxuan; Li, Yishen; Zheng, Jihu; Zhuge, Jianwei*. CV2XFuzzer: C-V2X Parsing Vulnerability Discovery System Based on Fuzzing. SecureComm 2023, October 19-21, 2023, Hong Kong SAR, China.

  • Xin Liu, Yuan Tan, Zhenghang Xiao, Jianwei Zhuge*, Rui Zhou. Not The End of Story: An Evaluation of ChatGPT-Driven Vulnerability Description Mappings. ACL 2023, Toronto, Canada.

  • Shangru Song, Hetian Shi, Ruoyu Lun, Yunchao Guan, Xiang Li, Jihu Zheng, Jianwei Zhuge*. Demo: Ransom Vehicle through Charging Pile. Symposium on Vehicles Security and Privacy (VehicleSec) 2023, co-located with NDSS 2023, 27 February 2023, San Diego, CA, USA.

  • Xin Liu, Yixiong Wu, Qingchen Yu, Shangru Song, Yue Liu, Qingguo Zhou, Jianwei Zhuge*. PG-VulNet: Detect Supply Chain Vulnerabilities in IoT Devices using Pseudo-code and Graphs, ESEM 2022, Helsinki, Finland, 18 - 23 September 2022.

  • Hao Wang, Wenjie Qu, Gilad Katz, Wenyu Zhu, Zeyu Gao, Han Qiu, Jianwei Zhuge, Chao Zhang*，jTrans: Jump-Aware Transformer for Binary Code Similarity Detection，ISSTA 2022, 18-22 July 2022, Online.

  • H. Xu, M. Yu, Y. Wang, Y. Liu, Q. Hou, Z. Ma, H. Duan, J. Zhuge*, B. Liu. Trampoline Over the Air: Breaking in IoT Devices Through MQTT Brokers. EuroS&P 2022, Genoa, Italy, June 6-10, 2022.

  • Yixiong Wu, Jianwei Zhuge*, Tingting Yin, Tianyi Li, Junmin Zhu, Guannan Guo, Yue Liu, Jianju Hu. From Exposed to Exploited: Drawing the Picture of Industrial Control Systems Security Status in the Internet Age, ICISSP 2021, Online, February 2021, 237-248.

  • Gengqian Zhou, Jianwei Zhuge*, Adapting to local conditions: Similarities and differences in anonymous online market between Chinese and English Speaking Communities, 11th EAI International Conference on Digital Forensics and Cyber Crime, ICDF2C 2020, Lecture Notes of the Institute for Computer Sciences, Social Informatics and Telecommunications Engineering, vol 351 164-181.

  • Baozheng Liu , Chao Zhang* , Guang Gong , Yishun Zeng , Haifeng Ruan , Jianwei Zhuge* . FANS: Fuzzing Android Native System Services via Automated Interface Analysis, USENIX Security 2020.

  • Kun Yang, Hanqing Zhao, Chao Zhang, Jianwei Zhuge and Haixin Duan. Fuzzing IPC with Knowledge Inference. SRDS 2019. October 1-4.

  • Guannan Guo, Jianwei Zhuge*, Mengmeng Yang, Gengqian Zhou, Yixiong Wu. A Survey of Industrial Control System Devices on the Internet, The International Conference on Internet of Things, Embedded Systems and Communications (IINTEC 2018), Hammamet, Tunisia December 20-22, 2018.

  • Yukun Liu, Jianwei Zhuge*, and Chao Zhang. CBTracer: Continuously Building Datasets for Binary Vulnerability and ExploitResearch. AsiaCCS 1st Radical and Experiential Security Workshop, Incheon, Republic of Korea. 2018/6/4.

  • Kun Yang, Yuan Deng, Chao Zhang, Jianwei Zhuge, Haixin Duan. ICUFuzzer: Fuzzing ICU Library for Exploitable Bugs inMultiple Software. 21st Information Security Conference (ISC 2018). London(Guildford), UK. 9-12 Sep 2018.

  • Yang, Haiyu(#) ; Zhuge, Jianwei(*); Liu, Huiming; Liu, Wei, A TOOL FOR VOLATILE MEMORY ACQUISITION FROM ANDROID DEVICES, 12th IFIP WG 11.9 International Conference on Advances in Digital Forensics, 2016.

  • Kun Yang; Jianwei Zhuge (*); Yongke Wang; Lujue Zhou; Haixin Duan, Intent Fuzzer: Detecting Capability Leaks of Android Applications, ACM Symposium on Information, Computer and Communications Security(AsiaCCS) 2014., 2014.6.4-2014.6.8.

  • Yinzhi Cao; Xiang Pan; Yan Chen; Jianwei Zhuge, JShield: Towards Real-time and Vulnerability-based Detection of Polluted Drive-by Download Attacks, Annual Computer Security Applications Conference (ACSAC), 2014. 12.8-2014.12.10.

  • X. Lu(#) ; J. Zhuge(*); R. Wang; Y. Cao; Y. Chen, De-obfuscation and Detection of Malicious PDF Files with High Accuracy, HICSS-46 Forensics Analysis Track, 2013.1.7-2013.1.10.

  • J. Zhuge*, L. Gu, H. Duan, Investigating China’s Online Underground Economy. Conference on the Political Economy of Information Security in China, San Diego, US, Apr, 2012.

  • Z. Chen, G. Gu, J. Zhuge, J. Nazario, X. Han, WebPatrol: Automated Collection and Replay of Web-based Malware Scenarios, to appear inProceedings of the 6th ACM Symposium on Information, Computer and Communications Security (ASIACCS’11) , HongKong, China, March 2011.

  • C. Song, J. Zhuge*, X. Han, Z. Ye, Preventing Drive-by Download via Inter-Module Communication Monitoring, In Proceedings of the 5th ACM Symposium on Information, Computer and Communications Security (ASIACCS’10) , Beijing, China, Apr 2010.

  • C. Song, C. Qin, J. Zhuge*, et al, MwSandbox: On Improving the Efficiency of Automated Coarse-grained Dynamic Malware Analysis, Proceedings of the 14th Youth Conference on Communication, July 2009.

  • J. Zhuge*, T. Holz, C. Song, J. Guo, X. Han, and W. Zou. Studying Malicious Websites and the Underground Economy on the Chinese Web, In Proceedings of the 7th Workshop on the Economics of Information Security (WEIS’08), Hanover, NH, USA, June 2008.

  • J. Zhuge, Y. Zhou, J. Guo, et al. Malicious Websites on the Chinese Web: Overview and Case Study, 20th Annual FIRST Conference (FIRST’08), British Columbia, Canada, June 2008.

  • Y. Zhou, J. Zhuge*, et al. Matrix: a Distributed Honeynet and its Applications, 20th Annual FIRST Conference (FIRST’08), British Columbia, Canada, June 2008.

  • J. Zhuge*, T. Holz, X. Han, C. Song, and W. Zou. Collecting Autonomous Spreading Malware Using High-interaction Honeypots, In Proceedings of 9th International Conference on Information and Communications Security (ICICS’07), Zhengzhou, China, Lecture Notes in Computer Science 4861, 438~451. Dec 2007.

  • J. Zhuge*, X. Han, Y. Chen, Z. Ye, and W. Zou. Towards High Level Attack Scenario Graph through Honeynet Data Correlation Analysis, In Proceedings of the 7th IEEE Workshop on Information Assurance (IAW’06), West Point, New York, USA, 2006.

  • J. Zhuge, and R. Yao*. Security Mechanisms for Wireless Home Network, In Proceedings of IEEE Global Telecommunications Conference 2003 (GLOBECOM’03), Vol. 3, pp. 1527-1531, San Francisco, USA, 2003.

发表英文期刊论文

  • Qingchen Yu, Xin Liu, Qingguo Zhou, Jianwei Zhuge, Chunming Wu*, Code classification with graph neural networks: Have you ever struggled to make it work? Expert Systems with Applications, Volume 233, 15 December 2023.https://doi.org/10.1016/j.eswa.2023.120978.

  • Miao Yu, Jianwei Zhuge*, Ming Cao, Zhiwei Shi, and Lin Jiang. A Survey of Security Vulnerability Analysis, Discovery, Detection, and Mitigation on IoT Devices. Future Internet 2020, 12(2), 27; https://doi.org/10.3390/fi12020027.

  • Gengqian Zhou, Jianwei Zhuge*, Yunqian, Fan, Kun Du, Shuqiang Lu. A Market in Dream: The Rapid Development of Anonymous Cybercrime, Mobile Networks and Applications, 2020, 25(4). (SCI IF: 2.497)

  • YUAN WEI, SENLIN LUO, JIANWEI ZHUGE, JING GAO, ENNAN ZHENG, BO LI, LIMIN PAN. ARG: Automatic ROP chains Generation, IEEE Access ( Volume: 7 ): 120152 - 120163. 2019. (SCI IF: 4.098).

近期发表中文期刊论文

  • 郭军权，诸葛建伟*，孙东红，段海新. Spampot: 基于分布式蜜罐的垃圾邮件捕获系统，计算机研究与发展, 2014:51 (5), 1071-1080.
  • 诸葛建伟*,唐勇,韩心慧,段海新. 蜜罐技术研究与应用进展.软件学报,2013, 24(4):825-842.
  • 黎松, 诸葛建伟*, 李星. BGP安全研究, 软件学报, 24(1): 121-138, 2013.
  • 唐勇, 诸葛建伟, 陈曙晖, 卢锡城. 蠕虫正则表达式特征自动提取技术研究. 通信学报, 2013(3):141-147.
  • 诸葛建伟*, 陈力波, 田繁, 鲍由之, 陆恂. 基于类型的动态污点分析技术. 清华大学学报: 自然科学版, 52(10): 1320-1328, 2012.
  • 江健, 诸葛建伟*, 段海新, 吴建平. 僵尸网络机理与防御技术. 软件学报, 23(1), 82-96, 2012.
  • 李雪峰, 段海新, 诸葛建伟, 吴建平. 识别蜜罐网络的P2P僵尸网络构建机制, 清华大学学报: 自然科学版, 52(3): 385-389, 2012.

其他标准、论文和文章

  • 严明、周明、刘权、诸葛建伟、周庆根等，国家职业技能标准-信息安全测试员（职业编码4-04-04-04），2021年版。标准下载
  • 诸葛建伟, 以历史地理学方法考证诸葛氏之起源, 2019年全国第二十五届诸葛亮学术研讨会, 湖北，襄阳，2019年11月7日. 论文下载
  • 诸葛建伟, 汉晋时期官员制度演变与诸葛氏族仕官考, 瑞安历史学会微信公众号瑞安人文，2023年2月28日. 文章原文

出版书籍

  • 诸葛建伟编著. 网络攻防技术与实践，电子工业出版社，2011年6月。获全国密码学网络信息安全类优秀教材一等奖。
  • 诸葛建伟，王珩，孙松柏等译著. Metasploit渗透测试指南, 电子工业出版社, 2012年1月.2012年当当网信息安全类畅销书第3名。
  • 诸葛建伟，陈霖，许伟林等译著. Wireshark数据包分析实战（第2版）, 人民邮电出版社, 2013年3月. 2013年度China-pub销售榜网络类图书销售第2名。
  • 诸葛建伟，陈力波，孙松柏，王珩，田繁等著. Metasploit渗透测试魔鬼训练营，机械工业出版社，2013年9月。2013年当当网计算机/网络类新书畅销榜排名第1名。
  • 诸葛建伟，梁智溢译. 线上幽灵：世界头号黑客米特尼克自传，电子工业出版社，2014年1月。
  • 诸葛建伟，姜辉，张光凯译. 恶意代码分析实战，电子工业出版社，2014年4月.
  • 诸葛建伟，杨坤，肖梓航译. Android安全攻防权威指南, 人民邮电出版社图灵公司，2015年4月.
  • 诸葛建伟组织、审校，刘惠明, 刘跃译. Android 安全架构深究, 电子工业出版社, 2016年3月.
  • Book Chapter: Yixiong Wu, Shangru Song, Jianwei Zhuge*, Tingting Yin, Tianyi Li, Junmin Zhu, Guannan Guo, Yue Liu, Jianju Hu. ICScope: Detecting and Measuring Vulnerable ICS Devices Exposed on the Internet, In: Mori, P., Lenzini, G., Furnell, S. (eds) Information Systems Security and Privacy. ICISSP 2021 2022 (revised selected papers). Communications in Computer and Information Science, vol 1851. Springer, Cham. https://doi.org/10.1007/978-3-031-37807-2_1, First Online: 11 July 2023.
  • Book Chapter: J. Zhuge*, L. Gu, H. Duan, T. Reberts, Investigating China’s Online Underground Economy. In: China and Cybersecurity: Understanding the Political, Economic, and Strategic Dimensions, Oxford University Press, 2015.
  • Book Chapter: J. Zhuge*, T. Holz, C. Song, J. Guo, X. Han, and W. Zou. Studying Malicious Websites and the Underground Economy on the Chinese Web, In: Managing Information Risk and the Economics of Security”, Springer 2009.

教学

  • 高级网络攻防实践，网络研究院研究生课程，夏季小学期，2019-.
  • 恶意代码分析，网络研究院研究生课程，2019.
  • 网络攻防实践，计算机系本科生课程，夏季小学期，2015-2018.
  • 网络安全工程与实践，计算机系本科生课程，2011-2013.
  • 计算机网络安全技术，计算机研究生课程，2011-2013.
  • SRT (Student Research Training) , 清华大学本科生，2011-.
  • 网络攻防技术实践，北京大学信息学院研究生，2008-2010.

学术任职与公共服务

  • Book Reviewer: PHEI Press, Science Press, Since 2011.

  • Editor of ACM China Magazine, From 2014 to 2017. 《Future Internet》Special Issue Co-Guest Editor 2013.

  • WWW 2012 Security, Privacy, Trust, and Abuse Track， AsiaCCS SESP 2013，VARA 2015-2018，OS2ATC 2014-2015 PC Member.

  • Paper Reviewer: TDSC, Computer Networks, NWSC, TKDE, Chinese Journal of Electronics, Chinese Journal of Computer, Journal on Communications, NOMS 2016，APNOMS 2015, HICSS 2013, OSDA 2013, HICSS 46, CCFICoC’12, NetSec’12, etc.

  • The Honeynet Project Full Member, Chinese Chapter Leader. Since 2006.

  • Google Summer of Code 2009, 2010, 2012 Mentor, 2011 Org Admin.

  • Technical Committee Chair, Co-Founder of XCTF International League, Since 2015.

  • Judge of GeekPwn Since 2014, Judge of Tianfu Cup, WangDing Cup, QiangWang Since 2018, Judge of Butian Cup Since 2020, Judge of Tianwang Cup Since 2023, Judge of Matrix Cup since 2024.

  • Technical Committee Member/Judge of National College Students Information Security Competition Innovation Practice Competition, Since 2018.

奖励与荣誉

  • 学生网络安全竞赛奖励 (作为Blue-Lotus, RedBud, TQL, etc.指导老师)
  • 2022年中国通信学会科学技术奖一等奖, 中国通信学会
  • 2022年CVVD（车辆安全漏洞预警与分析平台）安全专家突出贡献奖, 国家智能网联汽车创新中心
  • WitAwards 2017 安全年度人物奖, 全国奖项, Freebuf
  • 2017年Hacker’s Hero Award，百度.
  • 2014、2018年最佳书籍作译者奖，电子工业出版社.
  • 2016年最佳书籍作译者奖，机械工业出版社。
  • 2014年成果转化奖，腾讯-清华大学联合实验室.
  • IBM Ph.D. Fellowship, 2005 (worldwide, honored by IBM Corp.)
  • Microsoft Research Asia Fellowship, 2004 (Asia Pacific-wide, honored by MSRA)
  • 2003年中国HP优秀学生奖学金 (全国奖项, HP China授予)