Sysyphuzz: the Pressure of More Coverage
A kernel fuzzer designed to boost exploration of under-tested code regions.
学术论文
2026
FirmAgent: Leveraging Fuzzing to Assist LLM Agents with IoT Firmware Vulnerability Discovery
Leveraging fuzzing to assist LLM agents with IoT firmware vulnerability discovery.
2025
Improving LLM-based Log Parsing by Learning from Errors in Reasoning Traces
Improving LLM-based log parsing by learning from errors in reasoning traces.
Tady: A Neural Disassembler without Structural Constraint Violations
A neural disassembler without structural constraint violations based on post-dominance relations.
IDFUZZ: Intelligent Directed Grey-box Fuzzings
An intelligent directed grey-box fuzzing solution with neural network guided input mutation.
DecompileBench: A Comprehensive Benchmark for Evaluating Decompilers in Real-World Scenarios
A comprehensive benchmark for evaluating decompiler effectiveness in real-world reverse engineering scenarios.
Cowpox: Towards the Immunity of VLM-based Multi-Agent Systems
A defense approach to enhance robustness of multi-agent systems against adversarial attacks.
xFUZZ: A Flexible Framework for Fine-Grained, Runtime-Adaptive Fuzzing Strategy Composition
A flexible framework for fine-grained, runtime-adaptive fuzzing strategy composition.
Enhancing Smart Contract Security Analysis with Execution Property Graphs
Clue framework achieves superior smart contract security analysis with high true positive rates and low false positive rates using Execution Property Graphs.
BinQuery: A Novel Framework for Retrieving Binary Function with Natural Language Query
A novel framework for retrieving binary functions using natural language queries.
DCDiff: Enhancing JPEG Compression via Diffusion-based DC Coefficients Estimation
Enhancing JPEG compression via diffusion-based DC coefficients estimation method.
Your Scale Factors are My Weapon: Targeted Bit-Flip Attacks on Vision Transformers via Scale Factor Manipulation
Targeted bit-flip attacks on vision transformers via scale factor manipulation.
A Benchmark for Semantic Sensitive Information in LLM’s Outputs
A benchmark for semantic sensitive information in LLM’s outputs.
An Engorgio Prompt Makes Large Language Model Babble On
An engorgio prompt makes large language model babble on.
VulShield: Protecting Vulnerable Code Before Deploying Patches
Protecting vulnerable code before deploying patches with automated security policies.
Truman: Constructing Device Behavior Models from OS Drivers to Fuzz Virtual Devices
Constructing device behavior models from OS drivers to fuzz virtual devices.
EAGLEYE: Exposing Hidden Web Interfaces in IoT Devices via Routing Analysis
Exposing hidden web interfaces in IoT devices via routing analysis and LLM context understanding.
CCTAG: Configurable and Combinable Tagged Architecture
A configurable and combinable tagged architecture for memory safety protection.
2024
Sublinear Distributed Product Checks on Replicated Secret-Shared Data over Z2𝑘 Without Ring Extensions
Sublinear distributed product checks on replicated secret-shared data over Z2𝑘 without ring extensions.
Test Suites Guided Vulnerability Validation for Node.js Applications
Test suites guided vulnerability validation for Node.js applications.
CLAP: Learning Transferable Binary Code Representations with Natural Language Supervision
Learning transferable binary code representations with natural language supervision.
CEBin: A Cost-Effective Framework for Large-Scale Binary Code Similarity Detection
A cost-effective framework for large-scale binary code similarity detection.
Virtual Compiler Is All You Need For Assembly Code Search
Virtual compiler is all you need for assembly code search.
SDFUZZ: Target States Driven Directed Fuzzing
Target states driven directed fuzzing.
OptFuzz: Optimization Path Guided Fuzzing for JavaScript JIT Compilers
Optimization path guided fuzzing for JavaScript JIT compilers.
Improving ML-based Binary Function Similarity Detection by Assessing and Deprioritizing Control Flow Graph Features
Improving ml-based binary function similarity detection by assessing and deprioritizing control flow graph features.
Laser Shield: a Physical Defense with Polarizer against Laser Attacks on Autonomous Driving Systems
A physical defense with polarizer against laser attacks on autonomous driving systems.
Break the Wall from Bottom: Automated Discovery of Protocol-Level Evasion Vulnerabilities in Web Application Firewalls
Automated discovery of protocol-level evasion vulnerabilities in web application firewalls.
LABRADOR: Response Guided Directed Fuzzing for Black-box IoT Devices
Response guided directed fuzzing for black-box IoT devices.
ConFuzz: Towards Large Scale Fuzz Testing of Smart Contracts in Ethereum
Towards large scale fuzz testing of smart contracts in Ethereum.
On the Effectiveness of Function-Level Vulnerability Detectors for Inter-Procedural Vulnerabilities
On the effectiveness of function-level vulnerability detectors for inter-procedural vulnerabilities.
SHAPFUZZ: Efficient Fuzzing via Shapley-Guided Byte Selection
Efficient fuzzing via Shapley-guided byte selection.
REQSMINER: Automated Discovery of CDN Forwarding Request Inconsistencies and DoS Attacks with Grammar-based Fuzzing
Automated discovery of CDN forwarding request inconsistencies and DoS attacks with grammar-based fuzzing.
Beyond the Surface: Uncovering the Unprotected Components of Android Against Overlay Attack
Uncovering the unprotected components of android against overlay attack.
Faster and Better: Detecting Vulnerabilities in Linux-based IoT Firmware with Optimized Reaching Definition Analysis
Detecting vulnerabilities in linux-based iot firmware with optimized reaching definition analysis.
EnclaveFuzz: Finding Vulnerabilities in SGX Applications
Finding vulnerabilities in SGX applications.
2023
Unmasking Role-Play Attack Strategies in Exploiting Decentralized Finance (DeFi) Systems
Unmasking role-play attack strategies in exploiting decentralized finance systems.
Under the Dark: A Systematical Study of Stealthy Mining Pools (Ab)use in the Wild
A systematic study of stealthy mining pools abuse in the wild.
One Simple API Can Cause Hundreds of Bugs: An Analysis of Refcounting Bugs in All Modern Linux Kernels
An analysis of refcounting bugs in all modern Linux kernels.
One-bit Flip is All You Need: When Bit-flip Attack Meets Model Training
Exploring bit-flip attacks in the context of model training.
Thunderkaller: Profiling and Improving the Performance of Syzkaller
Profiling and improving the performance of syzkaller.
MTSan: A Feasible and Practical Memory Sanitizer for Fuzzing COTS Binaries
A feasible and practical memory sanitizer for fuzzing COTS binaries.
DDRace: Finding Concurrency UAF Vulnerabilities in Linux Drivers with Directed Fuzzing
Finding concurrency UAF vulnerabilities in Linux drivers with directed fuzzing.
Temporal CDN-Convex Lens: A CDN-Assisted Practical Pulsing DDoS Attack
A CDN-assisted practical pulsing DDoS attack.
AlphaEXP: An Expert System for Identifying Security-Sensitive Kernel Objects
An expert system for identifying security-sensitive kernel objects.
AIFORE: Smart Fuzzing Based on Automatic Input Format Reverse Engineering
Smart fuzzing based on automatic input format reverse engineering.
Aegis: Mitigating Targeted Bit-flip Attacks against Deep Neural Networks
Mitigating targeted bit-flip attacks against deep neural networks.
Efficient 3PC for Binary Circuits with Application to Maliciously-Secure DNN Inference
Efficient 3PC for binary circuits with application to maliciously-secure DNN inference.
KextFuzz: Fuzzing macOS Kernel EXTensions on Apple Silicon via Exploiting Mitigations
macOS closed-source driver fuzzing
1dFuzz: Reproduce 1-day Vulnerabilities with Directed Differential Fuzzing
Reproduce 1-day vulnerabilities with directed differential fuzzing.
RaceBench: A Triggerable and Observable Concurrency Bug Benchmark
A triggerable and observable concurrency bug benchmark.
PTStore: Lightweight Architectural Support for Page Table Isolation
Lightweight architectural support for page table isolation.
MPass: Bypassing Learning-based Static Malware Detectors
Bypassing learning-based static malware detectors.
ODDFUZZ: Discovering Java Deserialization Vulnerabilities via Structure-Aware Directed Greybox Fuzzing
Discovering Java deserialization vulnerabilities via structure-aware directed greybox fuzzing.
Callee: Recovering Call Graphs for Binaries with Transfer and Contrastive Learning
Recovering call graphs for binaries with transfer and contrastive learning.
2022
RoChBert: Towards Robust BERT Fine-tuning for Chinese
Towards robust bert fine-tuning for chinese.
PACMem: Enforcing Spatial and Temporal Memory Safety via ARM Pointer Authentication
Enforcing spatial and temporal memory safety via ARM pointer authentication.
Evocatio: Conjuring Bug Capabilities from a Single PoC
Conjuring bug capabilities from a single poc.
HTFuzz: Heap Operation Sequence Sensitive Fuzzing
heap temporal vulnerability fuzzing
PG-VulNet: Detect Supply Chain Vulnerabilities in IoT Devices using Pseudo-code and Graphs
we design and implement PG-VulNet, a tool for detecting Supply Chain Vulnerabilities in IoT Devices using Pseudo-code and Graphs.
AutoDA: Automated Decision-based Iterative Adversarial Attacks
Automated decision-based iterative adversarial attacks.
StateFuzz: System Call-Based State-Aware Linux Driver Fuzzing
state-aware fuzzing
PrIntFuzz: Fuzzing Linux Drivers via Automated Virtual Device Simulation
driver fuzzing based on virtual device simulation
NCScope: Hardware-Assisted Analyzer for Native Code in Android Apps
Hardware-assisted analyzer for native code in android apps.
jTrans: Jump-Aware Transformer for Binary Code Similarity Detection
Jump-aware transformer for binary code similarity detection.
BET: Black-box Efficient Testing for Convolutional Neural Networks
Black-box efficient testing for convolutional neural networks.
Trade or Trick? Detecting and Characterizing Scam Tokens on Uniswap Decentralized Exchange
Detecting and characterizing scam tokens on uniswap decentralized exchange.
An Empirical Study on Implicit Constraints in Smart Contract Static Analysis
Smart contracts static vulnerability detection
2021
面向缓解机制评估的自动化信息泄露方法
面向缓解机制评估的自动化信息泄露方法
ROLoad: Securing Sensitive Operations with Pointee Integrity
Protect sensitive operations with hardware support.
ZKCPlus: Optimized Fair-exchange Protocol Supporting Practical and Flexible Data Exchange
An optimized fair-exchange protocol
Igor: Crash Deduplication Through Root-Cause Clustering
deduplicate crash samples
VScape: Assessing and Escaping Virtual Call Protections
Bypass virtual protections towards AEG.
Sharing More and Checking Less: Leveraging Common Input Keywords to Detect Bugs in Embedded Systems
Finding vulnerabilities in embedded systems
MAZE: Towards Automated Heap Feng Shui
Manipulate heap layouts automatically.
RAProducer: Efficiently Diagnose and Reproduce Data Race Bugs for Binaries via Trace Analysis
diagnosing data race bugs
iDEV: Exploring and Exploiting Semantic Deviations in ARM Instruction Processing
discovering inconsistencies in ARM instruction processing
ARGUS: Assessing Unpatched Vulnerable Devices on the Internet via Efficient Firmware Recognition
Assessing unpatched vulnerable devices on the internet via efficient firmware recognition.
Weak Links in Authentication Chains: A Large-scale Analysis of Email Sender Spoofing Attacks
This work explored the vulnerabilities of the chain-based authentication structure in the email ecosystem. We conducted a large-scale analysis of 30 popular email services and 23 email clients.
Code is the (F)Law: Demystifying and Mitigating Blockchain Inconsistency Attacks Caused by Software Bugs
Exploit vulnerabilities in blockchains
Adapting to local conditions: Similarities and differences in anonymous online market between Chinese and English Speaking Communities
Similarities and differences in anonymous online market between Chinese and English Speaking Communities
CANCloak: Deceiving Two ECUs with One Frame
Deceiving two ECUs with one frame.
POP and PUSH: Demystifying and Defending against (Mach) Port-Oriented Programming
Mitigate port-oriented programming attacks for macOS
From Exposed to Exploited: Drawing the Picture of Industrial Control Systems Security Status in the Internet Age
we design and implement ICScope, a passive vulnerability assessment system based on device search engines.
Argot: Generating Adversarial Readable Chinese Texts
Generate adversarial Chinese texts with Glyph and Pinyin mutation.
2020
Talking with Familiar Strangers: An Empirical Study on HTTPS Context Confusion Attacks
HTTPS MITM attacks based on the shared TLS certificates as HTTPS Context Confusion Attack (SCC Attack)
Finding Cracks in Shields: On the Security of Control Flow Integrity Mechanisms
Measurement of CFI solutions’ security
Poison Over Troubled Forwarders: A Cache Poisoning Attack Targeting DNS Forwarding Devices
A cache poisoning attack targeting DNS forwarders.
GREYONE: Data Flow Sensitive Fuzzing
Improve fuzzing efficiency with lightweight data flow analysis.
FANS: Fuzzing Android Native System Services via Automated Interface Analysis
Fuzzing Android Binder services with automated interface analysis.
DRAMD: Detect Advanced DRAM-based Stealthy Communication Channels with Neural Networks
AI-based Side Channel and Covert Channel Detection.
A Large-Scale Empirical Study on Vulnerability Distribution within Projects and the Lessons Learned
Empirical Study on Vulnerability Distribution within Projects.
CDN Backfired: Amplification Attacks Based on HTTP Range Requests
Amplification Attacks Based on HTTP Range Requests
Poseidon: Mitigating Volumetric DDoS Attacks with Programmable Switches
Mitigating DDoS Attacks with P4
When Match Fields Do Not Need to Match: Buffered Packets Hijacking in SDN
Packet Hijacking in SDN
A Survey of Security Vulnerability Analysis, Discovery, Detection, and Mitigation on IoT Devices
A Survey of Security Vulnerability Analysis, Discovery, Detection, and Mitigation on IoT Devices. Selected as the journal issue cover Paper.
A Market in Dream: the Rapid Development of Anonymous Cybercrime
Measurement of a darknet market - dream market.
2019
SRFuzzer: An Automatic Fuzzing Framework for Physical SOHO Router Devices to Discover Multi-Type Vulnerabilities
An automatic fuzzing framework for physical SOHO router devices to discover multi-type vulnerabilities.
以历史地理学方法考证诸葛氏之起源
以历史地理学方法考证诸葛氏之起源，发表于2019年诸葛亮研究会年会
Detecting Fake Accounts in Online Social Networks at the Time of Registrations
Fake account detection for WeChat
Certificate Transparency in the Wild: Exploring the Reliability of Monitors
Exploring the Reliability of CT Monitors
Fuzzing IPC with Knowledge Inference
Fuzzing IPC with knowledge inference.
MOPT: Optimized Mutation Scheduling for Fuzzers
A fuzzing mutation scheduling strategy based on PSO.
The CrossPath Attack: Disrupting the SDN Control Channel via Shared Link
Shared channels in SDN: attacks and defense
2018
Revery: from Proof-of-Concept to Exploitable (One Step towards Automatic Exploit Generation)
Generate exploits for POCs that do not crash.
Abusing CDNs for Fun and Profit: Security Issues in CDNs’ Origin Validation
Security issues in CDNs origin validation.
ICUFuzzer: Fuzzing ICU Library for Exploitable Bugs in Multiple Software
Fuzzing ICU library for exploitable bugs in multiple software.
αDiff: Cross-Version Binary Code Similarity Detection with DNN
Detect binary code similarity with DNN.
CollAFL: Path Sensitive Fuzzing
Improve fuzzing efficiency with high accuracy control flow information.
2017
Towards Efficient Heap Overflow Discovery
Detect heap overflow vulnerabilities thoroughly with symbolic execution.
2016
VTrust: Regaining Trust on Virtual Calls
protecting virtual function calls for programs with source code
2015
JITScope: Protecting Web Users from Control-Flow Hijacking Attacks
a control flow integrity (CFI) solution for JIT code
VTint: Protecting Virtual Function Tables’ Integrity
protecting virtual function calls for binaries
Exploiting and Protecting Dynamic Code Generation
a control flow integrity (CFI) solution for JIT code
2014
The Store-and-Flood Distributed Reflective Denial of Service Attack
The store-and-flood distributed reflective denial of service attack.
Android Low Entropy Demystified
Demystifying low entropy issues in Android systems.
Splider: A Split-based Crawler of the BT-DHT Network and its Applications
A split-based crawler of the BT-DHT network and its applications.
2013
Practical Control Flow Integrity & Randomization for Binary Executables
a control flow integrity (CFI) solution for binaries
Protecting Function Pointers in Binary
Protecting function pointers in binary.
2012
A Framework to Eliminate Backdoors from Response-Computable Authentication
a framework to mitigate backdoor threats
2010
IntPatch: Automatically Fix Integer-Overflow-to-Buffer-Overflow Vulnerability at Compile-Time
Automatically fix integer-overflow-to-buffer-overflow vulnerability at compile-time.