Yanyan Zou

Senior Engineer

Institute of Information Engineering, CAS

zouyanyan@iie.ac.cn

Dr. Yanyan Zou (邹燕燕) is a Senior Engineer at the Institute of Information Engineering, Chinese Academy of Sciences (IIE, CAS).

My research focuses on network security evaluation, software security analysis, and device vulnerability discovery — in particular, fuzzing and vulnerability analysis techniques for network devices, IoT device firmware, UEFI firmware, and stateful protocol implementations.

I received my Ph.D. degree from the University of Chinese Academy of Sciences in 2023.

I recruit graduate students in Cyberspace Security (083900) in the direction of network security evaluation. Feel free to send me an email if you are interested.

Research Interests

Network Security Evaluation
Software Security Analysis
Device Vulnerability Discovery

Education

Ph.D., University of Chinese Academy of Sciences (2017–2023)
M.Sc., University of Science and Technology of China (2011–2014)
B.Eng., Chongqing University (2007–2011)

Experience

Senior Engineer, Institute of Information Engineering, CAS (2022–present)
Assistant Researcher, Institute of Information Engineering, CAS (2016–2022)
Research Intern, Institute of Information Engineering, CAS (2014–2016)

Teaching

Compiler Principles (lectures and exercise sessions)
Vulnerability Exploitation and Attack-Defense Practice

Contact

Email: zouyanyan@iie.ac.cn
Address: No. 19 Shucun Road, Haidian District, Beijing, 100085, China

news

Sep 20, 2026	Our new website is online.

selected publications

From Constraints to Cracks: Constraint Semantic Inconsistencies as Vulnerability Beacons for Embedded Systems

Jiaxu Zhao, Yuekang Li, Yanyan Zou, and 7 more authors

Proceedings of the 34th USENIX Security Symposium (USENIX Security 2025), 2025

Bib

@article{zou2025constraints-to-cracks,
  title = {From Constraints to Cracks: Constraint Semantic Inconsistencies as Vulnerability Beacons for Embedded Systems},
  author = {Zhao, Jiaxu and Li, Yuekang and Zou, Yanyan and Xiao, Yang and Jiang, Naijia and Li, Yeting and Zhong, Nanyu and Peng, Bingwei and Jian, Kunpeng and Huo, Wei},
  journal = {Proceedings of the 34th USENIX Security Symposium (USENIX Security 2025)},
  year = {2025},
}

Leveraging Semantic Relations in Code and Data to Enhance Taint Analysis of Embedded Systems

Jiaxu Zhao, Yuekang Li, Yanyan Zou, and 8 more authors

Proceedings of the 33rd USENIX Security Symposium (USENIX Security 2024), 2024

Bib

@article{zou2024taint-analysis,
  title = {Leveraging Semantic Relations in Code and Data to Enhance Taint Analysis of Embedded Systems},
  author = {Zhao, Jiaxu and Li, Yuekang and Zou, Yanyan and Liang, Zhaohui and Xiao, Yang and Li, Yeting and Peng, Bingwei and Zhong, Nanyu and Wang, Xinyi and Wang, Wei and Huo, Wei},
  journal = {Proceedings of the 33rd USENIX Security Symposium (USENIX Security 2024)},
  year = {2024},
}

Effective ReDoS Detection by Principled Vulnerability Modeling and Exploit Generation

Xinyi Wang, Cen Zhang, Yeting Li, and 8 more authors

2023 IEEE Symposium on Security and Privacy (S&P 2023), 2023

Bib

@article{zou2023redos,
  title = {Effective ReDoS Detection by Principled Vulnerability Modeling and Exploit Generation},
  author = {Wang, Xinyi and Zhang, Cen and Li, Yeting and Xu, Zhiwu and Huang, Shuailin and Liu, Yi and Yao, Yican and Xiao, Yang and Zou, Yanyan and Liu, Yang and Huo, Wei},
  journal = {2023 IEEE Symposium on Security and Privacy (S&P 2023)},
  year = {2023},
}

RSFuzzer: Discovering Deep SMI Handler Vulnerabilities in UEFI Firmware with Hybrid Fuzzing

Jiawei Yin, Menghao Li, Yuekang Li, and 6 more authors

2023 IEEE Symposium on Security and Privacy (S&P 2023), 2023

Bib

@article{zou2023rsfuzzer,
  title = {RSFuzzer: Discovering Deep SMI Handler Vulnerabilities in UEFI Firmware with Hybrid Fuzzing},
  author = {Yin, Jiawei and Li, Menghao and Li, Yuekang and Yu, Yong and Lin, Boru and Zou, Yanyan and Liu, Yang and Huo, Wei and Xue, Jingling},
  journal = {2023 IEEE Symposium on Security and Privacy (S&P 2023)},
  year = {2023},
}