Publications in software security

  1. ZendDiff: Differential Testing of PHP Interpreter.

    Yuancheng Jiang, Jianing Wang, Qiange Liu, Yeqi Fu, Jian Mao, Roland H. C. Yap, and Zhenkai Liang.

    In the 40th IEEE/ACM International Conference on Automated Software Engineering (ASE), 2025.

  2. TAPPecker: TAP Logic Inference and Violation Detection in Heterogeneous Smart Home Systems.

    Qixiao Lin, Jian Mao, Ziwen Liu, and Zhenkai Liang.

    In International Symposium on Research in Attacks, Intrusions, and Defenses (RAID), 2025.

  3. Evaluating Disassembly Errors With Only Binaries.

    Lambang Akbar, Yuancheng Jiang, Roland Yap, Zhenkai Liang, and Zhuohao Liu.

    In the 20th ACM ASIA Conference on Computer and Communications Security (AsiaCCS), 2025.

  4. Fuzzing the PHP Interpreter via Dataflow Fusion.

    Yuancheng Jiang, Chuqi Zhang, Bonan Ruan, Jiahao Liu, Manuel Rigger, Roland H. C. Yap, and Zhenkai Liang.

    In the 34th USENIX Security Symposium, 2025.

    Distinguished Paper Award

  5. Fork State-Aware Differential Fuzzing for Blockchain Consensus Implementations.

    Wonhoi Kim, Hocheol Nam, Muoi Tran, Amin Jalilov, Zhenkai Liang, Sang Kil Cha, and Min Suk Kang.

    In International Conference on Software Engineering (ICSE), 2025.

  6. UI-CTX: Understanding UI Behaviors with Code Contexts for Mobile Applications.

    Jiawei Li, Jiahao Liu, Jian Mao, Jun Zeng, and Zhenkai Liang.

    In the 32nd Annual Network and Distributed System Security Symposium (NDSS), 2025.

  7. MaskDroid: Robust Android Malware Detection with Masked Graph Representations.

    Jingnan Zheng, Jiahao Liu, An Zhang, Jun Zeng, Ziqi Yang, Zhenkai Liang, and Tat-Seng Chua.

    In the 39th IEEE/ACM International Conference on Automated Software Engineering (ASE), 2024.

  8. CrypTody: Cryptographic Misuse Analysis of IoT Firmware via Data-flow Reasoning.

    Jianing Wang, Shanqing Guo, Wenrui Diao, Yue Liu, Haixin Duan, Yichen Liu, and Zhenkai Liang.

    In International Symposium on Research in Attacks, Intrusions, and Defenses (RAID), 2024.

  9. Detecting Logic Bugs in Graph Database Management Systems via Injective and Surjective Graph Query Transformation.

    Yuancheng Jiang, Jiahao Liu, Jinsheng Ba, Roland Yap, Zhenkai Liang, and Manuel Rigger.

    In International Conference on Software Engineering (ICSE), 2024.

  10. Evaluating Disassembly Ground Truth Through Dynamic Tracing.

    Lambang Akbar, Yuancheng Jiang, Roland Yap, Zhenkai Liang, and Zhuohao Liu.

    In Workshop on Binary Analysis Research (BAR), 2024.

  11. Securing Web Inputs Using Parallel Session Attachments.

    Ziqi Yang, Ruite Xu, Qixiao Lin, Shikun Wu, Jian Mao, and Zhenkai Liang.

    In International Conference on Security and Privacy in Communication Networks (SecureComm), 2023.

  12. Learning Graph-based Code Representations for Source-level Functional Similarity Detection.

    Jiahao Liu, Jun Zeng, Xiang Wang, and Zhenkai Liang.

    In International Conference on Software Engineering (ICSE), 2023.

  13. Extensible Virtual Call Integrity.

    Yuancheng Jiang, Gregory J. Duck, Roland Yap, Zhenkai Liang, and Pinghai Yuan.

    In the 27th European Symposium on Research in Computer Security (ESORICS), 2022.

  14. FlowMatrix: GPU-Assisted Information-Flow Analysis through Matrix-Based Representation.

    Kaihang Ji, Jun Zeng, Yuancheng Jiang, Zhenkai Liang, Zheng Leong Chua, Prateek Saxena, and Abhik Roychoudhury.

    In the 31st USENIX Security Symposium, 2022.

  15. FreeWill: Automatically Diagnosing Use-after-free Bugs via Reference Miscounting Detection on Binaries.

    Liang He, Hong Hu, Purui Su, Yan Cai, and Zhenkai Liang.

    In the 31st USENIX Security Symposium, 2022.

  16. TeLL: Log Level Suggestions via Modeling Multi-level Code Block Information.

    Jiahao Liu, Jun Zeng, Xiang Wang, Kaihang Ji, and Zhenkai Liang.

    In the 31st ACM SIGSOFT International Symposium on Software Testing and Analysis (ISSTA), 2022.

  17. RecIPE: Revisiting the Evaluation of Memory Error Defenses.

    Yuancheng Jiang, Roland Yap, Zhenkai Liang, and Hubert Rosier.

    In the 17th ACM ASIA Conference on Computer and Communications Security (AsiaCCS), 2022.

  18. Identifying privacy weaknesses from multi-party trigger-action integration platforms.

    Kulani Mahadewa, Yanjun Zhang, Guangdong Bai, Lei Bu, Zhiqiang Zuo, Dileepa Fernando, Zhenkai Liang, and Jin Song Dong.

    In International Symposium on Software Testing and Analysis (ISSTA), 2021.

  19. LightSense: A Novel Side Channel for Zero-permission Mobile User Tracking.

    Quanqi Ye, Yan Zhang, Guangdong Bai, Naipeng Dong, Zhenkai Liang, Jin Song Dong, and Haoyu Wang.

    In Information Security Conference (ICS), 2019.

  20. Detecting Android Side Channel Probing Attacks Based on System States.

    Qixiao Lin, Jian Mao, Futian Shi, Shishi Zhu, and Zhenkai Liang.

    In International Conference on Wireless Algorithms, Systems, and Applications (WASA), 2019.

    Best Paper Award

  21. One Engine To Serve 'em All: Inferring Taint Rules Without Architectural Semantics.

    Zheng Leong Chua, Yanhao Wang, Teodora Baluta, Prateek Saxena, Zhenkai Liang, and Purui Su.

    In Network and Distributed System Security Symposium (NDSS), 2019.

    Distinguished Paper Award Honorable Mentions

  22. Fuzzing Program Logic Deeply Hidden in Binary Program Stages.

    Yanhao Wang, Zheng Leong Chua, Yuwei Liu, Purui Su, and Zhenkai Liang.

    In the 26th IEEE International Conference on Software Analysis, Evolution and Reengineering (SANER), 2019.

  23. DTaint: Detecting the Taint-Style Vulnerability in Embedded Device Firmware.

    Kai Cheng, Qiang Li, Lei Wang, Qian Chen, Yaowen Zheng, Limin Sun, and Zhenkai Liang.

    In the 48th IEEE/IFIP International Conference on Dependable Systems and Networks (DSN), 2018.

  24. HOMESCAN: Scrutinizing Implementations of Smart Home Integrations.

    Kulani Tharaka Mahadewa, Kailong Wang, Guangdong Bai, Ling Shi, Jin Song Dong, and Zhenkai Liang.

    In the 23rd International Conference on Engineering of Complex Computer Systems (ICECCS), 2018.

  25. A Novel Graph-based Mechanism for Identifying Traffic Vulnerabilities in Smart Home IoT.

    Yizhen Jia, Yinhao Xiao, Jiguo Yu, Xiuzhen Cheng, Zhenkai Liang, and Zhiguo Wan.

    In IEEE Conference on Computer Communications (INFOCOM), 2018.

  26. Automatically Assessing Crashes From Heap Overflows.

    Liang He, Yan Cai, Hong Hu, Purui Su, Zhenkai Liang, Yi Yang, Huafeng Huang, Jia Yan, Xiangkun Jia, and Dengguo Feng.

    In the 32nd IEEE/ACM International Conference on Automated Software Engineering (ASE), 2017.

  27. Neural Nets Can Learn Function Type Signatures From Binaries.

    Zheng Leong Chua, Shiqi Shen, Prateek Saxena, and Zhenkai Liang.

    In the 26th USENIX Security Symposium, 2017.

  28. "The Web/Local" Boundary Is Fuzzy: A Security Study of Chrome's Process-based Sandboxing.

    Yaoqi Jia, Zheng Leong Chua, Hong Hu, Shuo Chen, Prateek Saxena, and Zhenkai Liang.

    In ACM SIGSAC Conference on Computer and Communications Security (CCS), 2016.

  29. Data-Oriented Programming: On the Expressiveness of Non-control Data Attacks.

    Hong Hu, Shweta Shinde, Sendroiu Adrian, Zheng Leong Chua, Prateek Saxena, and Zhenkai Liang.

    In IEEE Symposium on Security and Privacy 2016 (S&P), 2016.

  30. Web-to-Application Injection Attacks on Android: Characterization and Detection.

    Behnaz Hassanshahi, Yaoqi Jia, Roland H. C. Yap, Prateek Saxena, and Zhenkai Liang.

    In European Symposium on Research in Computer Security 2015 (ESORICS), 2015.

  31. Identifying Arbitrary Memory Access Vulnerabilities in Privilege-Separated Software.

    Hong Hu, Zheng Leong Chua, Sendroiu Adrian, Prateek Saxena, and Zhenkai Liang.

    In European Symposium on Research in Computer Security 2015 (ESORICS), 2015.

  32. Automatic Generation of Data-Oriented Exploits.

    Hong Hu, Zheng Leong Chua, Sendroiu Adrian, Prateek Saxena, and Zhenkai Liang.

    In the 24th USENIX Security Symposium, 2015.

  33. You Can't Be Me: Enabling Trusted Paths and User Sub-origins in Web Browsers.

    Enrico Budianto, Yaoqi Jia, Xinshu Dong, Prateek Saxena, and Zhenkai Liang.

    In the 17th International Symposium on Research in Attacks, Intrusions and Defenses (RAID), 2014.

  34. Protecting sensitive web content from client-side vulnerabilities with CRYPTONS.

    Xinshu Dong, Zhaofeng Chen, Hossein Siadati, Shruti Tople, Prateek Saxena, and Zhenkai Liang.

    In the 20th ACM Conference on Computer and Communications Security (CCS), 2013.

  35. A Quantitative Evaluation of Privilege Separation in Web Browser Designs.

    Xinshu Dong, Hong Hu, Prateek Saxena, and Zhenkai Liang.

    In the 18th European Symposium on Computer Security (ESORICS), 2013.

  36. Codejail: Application-Transparent Isolation of Libraries with Tight Program Interactions.

    Yongzheng Wu, Sai Sathyanarayan, Roland H. C. Yap, and Zhenkai Liang.

    In the 17th European Symposium on Computer Security (ESORICS), 2012.

  37. A Framework to Eliminate Backdoors from Response-Computable Authentication.

    Shuaifu Dai, Tao Wei, Chao Zhang, Tielei Wang, Yu Ding, Zhenkai Liang, and Wei Zou.

    In the 33rd IEEE Symposium on Security and Privacy (S&P), 2012.

  38. Identifying and Analyzing Pointer Misuses for Sophisticated Memory-corruption Exploit Diagnosis.

    Mingwei Zhang, Aravind Prakash, Xiaolei Li, Zhenkai Liang, and Heng Yin.

    In the 19th Annual Network & Distributed System Security Symposium (NDSS), 2012.

  39. AdSentry: Comprehensive and Flexible Confinement of JavaScript-based Advertisements.

    Xinshu Dong, Minh Tran, Zhenkai Liang, and Xuxian Jiang.

    In the 27th Annual Computer Security Applications Conference (ACSAC), 2011.

  40. Towards Fine-Grained Access Control in JavaScript Contexts.

    Kailas Patil, Xinshu Dong, Xiaolei Li, Zhenkai Liang, and Xuxian Jiang.

    In the 31st IEEE International Conference on Distributed Computing Systems (ICDCS), 2011.

  41. Jump-Oriented Programming: A New Class of Code-Reuse Attack.

    Tyler Bletsch, Xuxian Jiang, Vince Freeh, and Zhenkai Liang.

    In the 6th ACM Symposium on Information, Computer and Communications Security (AsiaCCS), 2011.

  42. Heap Taichi: exploiting memory allocation granularity in heap-spraying attacks.

    Yu Ding, Tao Wei, Tielei Wang, Zhenkai Liang, and Wei Zou.

    In the 26th Annual Computer Security Applications Conference (ACSAC), 2010.

  43. Golden implementation driven software debugging.

    Ansuman Banerjee, Abhik Roychoudhury, Johannes A. Harlie, and Zhenkai Liang.

    In the 18th ACM SIGSOFT international symposium on Foundations of software engineering (FSE), 2010.

  44. Test generation to expose changes in evolving programs.

    Dawei Qi, Abhik Roychoudhury, and Zhenkai Liang.

    In the 25th IEEE/ACM International Conference on Automated Software Engineering, 2010.

  45. Towards Generating High Coverage Vulnerability-Based Signatures with Protocol-Level Constraint-Guided Exploration.

    Juan Caballero, Zhenkai Liang, Pongsin Poosankam, and Dawn Song.

    In the 12th International Symposium on Recent Advances in Intrusion Detection (RAID), 2009.

  46. DARWIN: an approach for debugging evolving programs.

    Dawei Qi, Abhik Roychoudhury, Zhenkai Liang, and Kapil Vaswani.

    In the 7th joint meeting of the European Software Engineering Conference and the ACM SIGSOFT International Symposium on Foundations of Software Engineering (ESEC/SIGSOFT FSE), 2009.

    Distinguished Paper Award

  47. BitBlaze: A New Approach to Computer Security via Binary Analysis.

    Dawn Xiaodong Song, David Brumley, Heng Yin, Juan Caballero, Ivan Jager, Min Gyung Kang, Zhenkai Liang, James Newsome, Pongsin Poosankam, and Prateek Saxena.

    In the 10th International Conference on Information and Communications Security (ICICS), 2008.

  48. HookFinder: Identifying and Understanding Malware Hooking Behaviors.

    Heng Yin, Zhenkai Liang, and Dawn Song.

    In the 15th Annual Network & Distributed System Security Symposium (NDSS), 2008.

  49. Polyglot: automatic extraction of protocol message format using dynamic binary analysis.

    Juan Caballero, Heng Yin, Zhenkai Liang, and Dawn Xiaodong Song.

    In the 14th ACM Conference on Computer and Communications Security (CCS), 2007.

  50. Towards Automatic Discovery of Deviations in Binary Implementations with Applications to Error Detection and Fingerprint Generation.

    David Brumley, Juan Caballero, Zhenkai Liang, and James Newsome.

    In the 16th USENIX Security Symposium, 2007.

    Best Paper Award

  51. Automatic Generation of Buffer Overflow Attack Signatures: An Approach Based on Program Behavior Models.

    Zhenkai Liang, and R. Sekar.

    In the 21th Annual Computer Security Applications Conference (ACSAC), 2005.

  52. Fast and automated generation of attack signatures: a basis for building self-protecting servers.

    Zhenkai Liang, and R. Sekar.

    In the 12th ACM Conference on Computer and Communications Security (CCS), 2005.

  53. One-Way Isolation: An Effective Approach for Realizing Safe Execution Environments.

    Weiqing Sun, Zhenkai Liang, V. N. Venkatakrishnan, and R. Sekar.

    In the 12th Annual Network & Distributed System Security Symposium (NDSS), 2005.

  54. Isolated Program Execution: An Application Transparent Approach for Executing Untrusted Programs.

    Zhenkai Liang, V. N. Venkatakrishnan, and R. Sekar.

    In the 19th Annual Computer Security Applications Conference (ACSAC), 2003.

    Outstanding Paper Award