Author Archive

What brought you to UCI?
I joined UCI right after my Ph.D. at University of Michigan, Ann Arbor. UCI students are the biggest reason for me to choose UCI over my other offers: during my job interview at UCI,  I found that UCI students are the most energetic among all my interviews, including the ones in top 10 CS universities. In my talk, almost all students in the room were proactively participating and asking good questions, which is exactly the atmosphere I am looking for as a faculty.

Besides good students, UCI also has an impressive number of excellent faculties in research areas related to mine, for example security, software engineering, and embedded systems, which creates enormous collaboration opportunities. In addition, Irvine is a wonderful place to live with good weather and location. I am extremely fortunate to have the opportunity to work in a school with both strong academics and a wonderful life.

What is your major focus area as a researcher, and why?
My research area is computer and network security. Most recently, as computer technology is increasingly adopted in our physical living environments such as homes and cars, my research starts to focus more on security problems in emerging IoT/CPS systems such as smart home systems, smart transportation systems, and autonomous vehicle systems.

I enjoy security research since it is like playing games and one can play both attacker and defender roles. At the same time, security is also extremely important since security problems in today’s computer systems can lead to severe economical, societal, and even safety damages — imagining that in the near future you are a passenger riding a self-driving taxi on the highway and a remote attacker suddenly manages to take full control of it.

In one sentence, what is the most important question you want to address?
While today’s defense mechanisms are mostly ad hoc and reactive, how to develop more systematic and more principled defense approaches that can proactively discover and address security challenges in existing and future computer technology?

What has been (or will be) the impact of your research?
My research has high impact in both academic and industry with over 10 top-tier conference papers (covering all top-tier security conferences), a US DHS (Department of Homeland Security) US-CERT alert, 2 CVEs (Common Vulnerabilities and Exposures), 7 Android bug tracking records, email acknowledgements from security teams in Apply, Microsoft, and Comcast, and over 50 news articles by major news media such as Fortune, BBC News, Ars Technica, CNET News, and Wired.

What is innovative about your research?
From the research topic perspective, I am the first to study security problem in many emerging computer technologies such as smart traffic light control, autonomous driving, and new gTLDs. From the research style perspective, my research aims at proactively addressing security challenges through systematic problem analysis and design, leveraging techniques such as static/dynamic program analysis, software testing, and data-driven approaches. My research has developed such approaches to systematically discover, analyze, detect, and fix vulnerabilities in a wide range of important computer systems and components such as smartphone OSes, network protocols, DNS, GUI systems, access control systems, and very recently smart traffic signal control systems.

What papers do you have coming through in the next year?
Two of my papers will appear in Mobisys’19 on IoT malware and smartphone malware. At the same time, I expect to submit papers on in-vehicle software security, autonomous vehicle perception security, and autonomous vehicle localization security to Usenix Security’19 and CCS’19.

What brought you to UCI?
I was a principal research scientist at an industrial research laboratory called RSA Labs before coming to UCI, focusing on developing new technologies that can be transferred to company’s products. The main reason for moving from industry to university is that I can work on very challenging problems calling for very innovative solutions, different from industrial research which tends to be short-term and less risky. This makes me quite excited. Another reason is that I’ll have chance to teach and mentor students and see them advancing to the next level.

I chose UCI because it has very strong programs related to computing technologies and especially information security. The students and faculty are very talented and many great works have been done at UCI. And of course, Irvine is a wonderful place to live.

What is your major focus area as a researcher, and why?
My main focus is the intersection between data and security. I believe there are a lot of open problems to solve at this intersection. Now data are generated at an amazing pace by various computing devices and there is strong need to develop new data-driven methods that can solve challenging problems, like the ones in security.

In one sentence, what is the most important question you want to address?
The questions I’m trying to answer include: how to unlock the power from big data to catch the cyber-attackers so our computing systems could be more secure? what new threats are emerged because of the data generated by the new computing devices/hardware?

What has been (or will be) the impact of your research?
Some of my research at RSA Labs have been transferred into company’s products in security analytics. The techniques we built enabled the detection of very sophisticated hacking activities. Besides, my research has identified critical vulnerabilities underlying new computing devices/hardware like smartwatch, mobile payment and GPU, due to data leakage. We worked with the vendors to fix the vulnerabilities and make their devices more secure.  

What is innovative about your research?
The key challenge I’m facing in most of the projects is how to make best use of data. To this end, I built many customized machine-learning models to address different security problems. As an example, one research during my time at RSA Labs combined supervised learning, temporal analysis and graph-based inference together to identify malicious domains visited by employees. It is able to examine tera-bytes of log data generated every day from enterprise devices and find most of malicious domains with very high accuracy.

What papers do you have coming through in the next year?
I have one paper accepted by NDSS’19 on security analysis of Bluetooth protocols and another one accepted by IEEE S&P’19 reveals the fraudulent behaviors of residential IP proxy so far.

What brought you to UCI?
UCI is an amazing institution, with top-notch software and security research, which are my two main areas of research interest. This means the researchers at UCI are outstanding. Additionally, Southern California and Irvine are wonderful places to live. I grew up in Southern California and count myself as extremely lucky to have continued to be at such an excellent institution, even in a career that tends to prevent you from having much choice about where I live.

What is your major focus area as a researcher, and why?
I am a software-engineering researcher focusing on software security, testing, analysis, and design. I have been primarily researching mobile security for the last several years.

In one sentence, what is the most important question you want to address?
To what extent can software analysis and design be improved to achieve high accuracy and scalability for software security and other software qualities?

What has been (or will be) the impact of your research?
My research tools and datasets have been used by dozens of researchers, agencies, and companies around the world—including universities in Argentina, Australia, Brazil, Canada, China, Europe, and the United States, and by companies and government agencies such as Boeing, Bosch, Google, IBM, Microsoft, Northrop Grumman, the FBI, the Department of Homeland Security, and NASA.

What is innovative about your research?
In the area of mobile security, my approach, called LetterBomb, is the first automatic exploit-generation approach for Android apps, with the ability to generate over 180 zero-day exploits from a random selection of 10,000 apps, including popular apps with up to 10,000,000 downloads. Types of vulnerabilities for which we utilized automatically generated exploits include privilege escalations, denial of service, and spoofing vulnerabilities. We further created an Android malware-detection and family-identification approach, called RevealDroid, that is highly accurate, scalable, and obfuscation-resilient—with results superior to the top 60 commercial anti-virus tools and state-of-the-research approaches. RevealDroid has the novel ability to analyze unconventional code mechanisms, i.e., reflection (the ability of a program to inspect or modify itself) and native code, using lightweight static program analysis.

What papers do you have coming through in the next year?
We are leveraging LetterBomb and automatic program repair to automatically fix vulnerabilities in Android apps. We will also be presenting the first approach, called Darcy, for detecting and repairing architectural inconsistencies in modern Java programs, which now contain modules that allow engineers to specify exposed interfaces, which has novel security implications. Specifically,  we found 146 instances of inconsistencies among 38 Java applications. By automatically fixing these inconsistencies, we were able to measurably improve various attributes of the subject applications’ architectures, e.g., reducing the attack surface of applications by 61%, producing deployable applications that consume 17% less memory, and improving the encapsulation of applications by 28%.