系统软件与安全实验室

  • 首页
  • 研究团队
    • 教师
    • 学生
  • 论文发表
  • 研究方向
  • 科研成果
    • 通用大模型安全天梯
    • 国标大模型安全测试集
    • 白泽·鉴微小程序安全检测平台
    • MCPZoo:MCP服务器运行样本库
    • WebAgent安全排行榜
  • 最新动态
  • 关于我们
    • 联系方式
    • 招生信息
    • 宣传视频
    • 教材《移动安全》

论文发表:2025

[SaTS 2025]Fast Play, Fast Profit: Unveiling the Prevalence of Aggressive Ad Behaviors in Mini-Game

Authors:
Chen, Pei; Hong, Geng; Qin, Yicheng; Wang, Huazhe; Wu, Mengying; Zhang, Yuan; Yang, Min; Zhao, Ziru; Zhu, Yuanpeng; Su, Tao
Publication:
This paper is included in ACM Workshop on Security and Privacy of AI-Empowered Mobile Super Apps

[CCS 2025]Be Aware of What You Let Pass: Demystifying URL-based Authentication Bypass Vulnerability in Java Web Applications

Authors:
Zhang, Qiyi; Liu, Fengyu; Lin, Zihan; Zhang, Yuan
Publication:
This paper is included in Proceedings of the 32nd ACM Conference on Computer and Communications Security

[ASE 2025]Security Debt in LLM Agent Applications: A Measurement Study of Vulnerabilities and Mitigation Trade-offs

Authors:
Shen Zhuoxiang; Dai, Jiarun; Zhang, Yuan; Yang, Min
Publication:
This paper is included in the 40th IEEE/ACM International Conference on Automated Software Engineering

[Security 2025]Mirage in the Eyes: Hallucination Attack on Multi-modal Large Language Models with Only Attention Sink

Authors:
Wang, Yining; Zhang, Mi; Sun, Junjie; Wang, Chenyue; Yang, Min; Xue, Hui; Tao, Jialing; Duan, Ranjie; Liu, Jiexi
Publication:
This paper is included in Proceedings of the 34th USENIX Security Symposium

[VehicleSec 2025]APSFUZZ: Simulation-Based Fuzzing Testing for Automated Parking Systems

Authors:
Bu, Tong; Dai, Jiarun; Luo, Jiaqi; Peng, Songyang; Huang, Zongan; Yang, Min
Publication:
This paper is included in the 3rd USENIX Symposium on Vehicle Security and Privacy

[CCS 2025]BACScan: Automatic Black-Box Detection of Broken-Access-Control Vulnerabilities in Web Applications

Authors:
Liu, Fengyu; Zhang, Yuan; Li, Enhao; Meng, Wei; Shi, Youkun; Wang, Qianheng; Wang, Chenlin; Lin, Zihan; Yang, Min
Publication:
This paper is included in Proceedings of the 32nd ACM Conference on Computer and Communications Security

[TIFS 2025]Locating Security Patch Variants with Two-Dimensional Code Commit Features

Authors:
Wang, Lin; Zhang, Yuan; Chen, Xiaoting; Yang, Min
Publication:
This paper is included in IEEE Transactions on Information Forensics and Security

[WWW 2025]Revisiting Backdoor Attacks on Time Series Classification in the Frequency Domain

Authors:
Huang, Yuanmin; Zhang, Mi; Wamg, Zhaoxiang; Li, Wenxuan; Yang, Min
Publication:
This paper is included in the 2025 ACM Web Conference

[S&P 2025]HouseFuzz: Service-Aware Grey-Box Fuzzing for Vulnerability Detection in Linux-Based Firmware

Authors:
Xiao, Haoyu; Wei, Ziqi; Dai, Jiarun; Li, Bowen; Zhang, Yuan; Yang, Min
Publication:
This paper is included in Proceedings of the 46th IEEE Symposium on Security and Privacy

[S&P 2025]Detecting Taint-Style Vulnerabilities in Microservice-Structured Web Applications

Authors:
Liu, Fengyu; Zhang, Yuan; Chen, Tian; Shi, Youkun; Yang, Guangliang; Lin, Zihan; Yang, Min; He, Junyao; Li, Qi
Publication:
This paper is included in Proceedings of the 46th IEEE Symposium on Security and Privacy

[FSE 2025]CXXCrafter: An LLM-Based Agent for Automated C/C++ Open Source Software Building

Authors:
Yu, Zhengmin; Zhang, Yuan; Wen, Ming; Nie, Yinan; Zhang, Wenhui; Yang, Min
Publication:
This paper is included in Proceedings of ACM International Conference on the Foundations of Software Engineering

[CVPR 2025]Detect-and-Guide: Self-regulation of Diffusion Models for Safe Text-to-Image Generation via Guideline Token Optimization

Authors:
Li, Feifei; Zhang, Mi; Sun, Yiming; Yang, Min
Publication:
This paper is included in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition 2025

[ICML 2025]InfoCons: Identifying Interpretable Critical Concepts in Point Clouds via Information Theory

Authors:
Li, Feifei; Zhang, Mi; Wang, Zhaoxiang; Yang, Min
Publication:
This paper is included in the 42nd International Conference on Machine Learning

[Security 2025]Demystifying the (In)Security of QR Code-based Login in Real-world Deployments

Authors:
Zhang, Xin; Zhang, Xiaohan; Zhao, Bo; Nan, Yuhong; Liu, Zhichen; Chen, Jianzhou; Zhou, Huijun; Yang, Min
Publication:
This paper is included in Proceedings of the 34th USENIX Security Symposium

[Security 2025]Beyond Exploit Scanning: A Functional Change-Driven Approach to Remote Software Version Identification

Authors:
Chen, Jinsong; Wu, Mengying; Hong, Geng, An, Baichao ; Liu, Mingxuan; Zhang, Lei; Liu, Baojun; Duan, Haixin; Yang, Min
Publication:
This paper is included in Proceedings of the 34th USENIX Security Symposium

[Security 2025]Pig in a Poke: Automatically Detecting and Exploiting Link Following Vulnerabilities in Windows File Operations

Authors:
Xiang, Bocheng; Zhang, Yuan; Liu, Fengyu; Huang, Hao; Lin, Zihan; Yang, Min
Publication:
This paper is included in Proceedings of the 34th USENIX Security Symposium

[Security 2025]XSSky: Detecting XSS Vulnerabilities through Local Path-Persistent Fuzzing

Authors:
Shi, Youkun; Zhang, Yuan; Bai, Tianhao; Xue, Feng; Dai, Jiarun; Liu, Fengyu; Zhang, Lei; Luo, Xiapu; Yang, Min
Publication:
This paper is included in Proceedings of the 34th USENIX Security Symposium

[Security 2025]Make Agent Defeat Agent: Automatic Detection of Taint-Style Vulnerabilities in LLM-based Agents

Authors:
Liu, Fengyul Zhang, Yuan; Luo, Jiaqi; Dai, Jiarun; Chen, Tian; Yuan, Letian; Yu, Zhangmin; Shi, Youkun; Li, Ke; Zhou, Chengyuan; Yang, Min
Publication:
This paper is included in Proceedings of the 34th USENIX Security Symposium

[NDSS 2025]The Skeleton Keys: A Large Scale Analysis of Credential Leakage in Mini-apps

Authors:
Shi Yizhe; Yang Zhemin; Zhong Kangwei; Yang Guangliang; Yang Yifan; Zhang Xiaohan; Yang Min
Publication:
This paper is included in in proceedings of the 32nd Network and Distributed System Security Symposium (NDSS 2025)

[NDSS 2025]An Empirical Study on Fingerprint API Misuse with Lifecycle Analysis in Real-world Android Apps

Authors:
Zhang Xin; Zhang Xiaohan; Liu Zhichen; Zhao Bo; Yang Zhemin; Yang Min
Publication:
This paper is included in proceedings of the 32nd Network and Distributed System Security Symposium (NDSS 2025)

[USENIX Security 2025]Demystifying the (In)Security of QR Code-based Login in Real-world Deployments

Authors:
Zhang Xin; Zhang Xiaohan; Zhao Bo; Nan Yuhong; Liu Zhichen; Chen Jianzhou; Zhou Huijun; Yang Min
Publication:
This paper is included in proceedings of the 34th USENIX Security Symposium (USENIX Security 2025)

[NDSS 2025]Revealing the black box of device search engine: scanning assets, strategies, and ethical consideration

Authors:
Wu Mengying; Hong Geng; Chen Jinsong; Liu Qi; Tang Shujun; L, Youhao; Liu Baojun; Duan Haixin; Yang Min
Publication:
This paper is included in proceedings of the 32nd Network and Distributed System Security Symposium (NDSS 2025)

[ICSE 2025]Exposing the Hidden Layer: Software Repositories in the Service of SEO Manipulation

Authors:
Wu, Mengying; Hong, Geng; Mai, Wuyuao; Wu, Xinyi; Zhang, Lei; Pu, Yingyuan; Chai, Huajun; Ying, Lingyun; Duan, Haixin; Yang, Min
Publication:
This paper is included in proceedings of the 47th IEEE/ACM International Conference on Software Engineering

[USENIX Security 2025] Careless Retention and Management: Understanding and Detecting Data Retention Denial-of-Service Vulnerabilities in Java Web Containers

Authors:
Lian Keke; Zhang Lei; Zhao Haoran; Cao Yinzhi; Liu Yongheng; Sun Fute; Zhang Yuan; Yang Min
Publication:
This paper is included in proceedings of the 34th USENIX Security Symposium (USENIX Security 2025)

[USENIX Security 2025]Towards Automatic Detection and Exploitation of Java Web Application Vulnerabilities via Concolic Execution guided by Cross-thread Object Manipulation

Authors:
Huang Xinyou; Zhang Lei; Liu Yongheng; Deng Peng; Cao Yinzhi; Zhang Yuan; Yang Min
Publication:
This paper is included in proceedings of the 34th USENIX Security Symposium (USENIX Security 2025)

[USENIX Security 2025]Effective Directed Fuzzing with Hierarchical Scheduling for Web Vulnerability Detection

Authors:
Lin Zihan; Zhang Yuan; Dai Jiarun; Huang Xinyou; Xiang Bocheng; Yang Guangliang; Yuan Letian; Zhang Lei; Liu Fengyu; Chen Tian; Yang Min
Publication:
This paper is included in proceedings of the 34th USENIX Security Symposium (USENIX Security 2025)

[NDSS 2025] Misdirection of Trust: Demystifying the Abuse of Dedicated URL Shortening Service

Authors:
Zhang Zhibo; Zhang Lei; Zhang Zhangyue; Hong Geng; Zhang Yuan; Yang Min
Publication:
This paper is included in proceedings of the 32nd Network and Distributed System Security Symposium (NDSS 2025)

[WWW 2025]You Can't Eat Your Cake and Have It Too: The Performance Degradation of LLMs with Jailbreak Defense

Authors:
Mai Wuyuao; Hong Geng; Chen Pei; Pan Xudong; Liu Baojun; Zhang Yuan; Duan Haixin; Yang Min
Publication:
This paper is included in proceedings of the 34th ACM Web Conference (WWW 2025)

[S&P 2025] EPScan: Automated Detection of Excessive RBAC Permissions in Kubernetes Applications

Authors:
Zhang Zhibo; Zhang Lei; Zhang Zhangyue; Hong Geng; Zhang Yuan; Yang Min
Publication:
This paper is included in proceedings of the 32nd Network and Distributed System Security Symposium (NDSS 2025)

[S&P 2025] MOCGuard: Automatically Detecting Missing-Owner-Check Vulnerabilities in Java Web Applications

Authors:
Liu Fengyu; Shi Youkun; Zhang Yuan; Yang Guangliang; Li Enhao; Yang Min
Publication:
This paper is included in proceedings of the 46th IEEE Symposium on Security and Privacy (S&P 2025)

[USENIX Security 2025]ChainFuzz: Exploiting Upstream Vulnerabilities in Open-Source Supply Chains

Authors:
Deng Peng; Zhang Lei; Meng Yuchuan; Yang Zhemin; Zhang Yuan; Yang Min
Publication:
This paper is included in proceedings of the 34th USENIX Security Symposium (USENIX Security 2025)

安全四大论文统计

  • 链接入口

安全

  • CCS (18)
  • NDSS (11)
  • S&P (14)
  • Security (29)
  • TIFS (6)
  • TDSC (1)
  • ACSAC (1)
  • ESORICS (2)
  • SecureComm (1)
  • SaTS (1)

软工

  • FSE (3)
  • ASE (3)
  • ICSE (3)
  • ISSTA (1)
  • ICSME (1)
  • SANER (1)

AI

  • AAAI (3)
  • ACL (1)
  • CVPR (4)
  • ICML (2)
  • NeurIPS (1)
  • TPAMI (2)

其他

  • KDD (3)
  • WWW (9)
  • ICDE (1)
  • ATC (1)
  • TKDE (1)
  • CIKM (3)
  • ICASSP (2)
  • ICDM (1)
  • SIGMETRICS (1)
  • VEE (1)
  • GLOBECOM (1)
  • LSTEC (1)
  • VehicleSec (1)

年份

  • 2026 (7)
  • 2025 (31)
  • 2024 (22)
  • 2023 (19)
  • 2022 (14)
  • 2021 (8)
  • 2020 (12)
  • 2019 (2)
  • 2018 (9)
  • 2017 (2)
  • 2016 (1)
  • 2015 (2)
  • 2014 (1)
  • 2013 (2)
  • 2012 (1)
  • 2011 (1)
  • 2008 (1)
  • 2007 (1)

关于实验室

具有一定全球影响力、文理学科融合发展的特色科研团队。

联系实验室

上海市 杨浦区 淞沪路2005号
复旦大学江湾校区二号交叉学科楼
六楼、七楼

联系邮件: wanqi_zhang@fudan.edu.cn

关注实验室公众号