publications

2025

1. Fuzzing for Stateful Protocol Programs Based on Constraints between States and Message Types

   Kunpeng Jian, Yanyan Zou, Menghao Li, and 1 more author

   Proceedings of the 16th International Conference on Internetware (INTERNETWARE 2025), 2025

   Bib

   @article{zou2025stateful-constraints,
     title = {Fuzzing for Stateful Protocol Programs Based on Constraints between States and Message Types},
     author = {Jian, Kunpeng and Zou, Yanyan and Li, Menghao and Huo, Wei},
     journal = {Proceedings of the 16th International Conference on Internetware (INTERNETWARE 2025)},
     year = {2025}
   }

2. State Significance-Guided Fuzzing for Stateful Protocol Program

   Kunpeng Jian, Yanyan Zou, Chen Wang, and 3 more authors

   Theoretical Aspects of Software Engineering (TASE 2025), 2025

   Bib

   @article{zou2025state-significance,
     title = {State Significance-Guided Fuzzing for Stateful Protocol Program},
     author = {Jian, Kunpeng and Zou, Yanyan and Wang, Chen and Li, Ning and Li, Menghao and Huo, Wei},
     journal = {Theoretical Aspects of Software Engineering (TASE 2025)},
     year = {2025}
   }

3. From Constraints to Cracks: Constraint Semantic Inconsistencies as Vulnerability Beacons for Embedded Systems

   Jiaxu Zhao, Yuekang Li, Yanyan Zou, and 7 more authors

   Proceedings of the 34th USENIX Security Symposium (USENIX Security 2025), 2025

   Bib

   @article{zou2025constraints-to-cracks,
     title = {From Constraints to Cracks: Constraint Semantic Inconsistencies as Vulnerability Beacons for Embedded Systems},
     author = {Zhao, Jiaxu and Li, Yuekang and Zou, Yanyan and Xiao, Yang and Jiang, Naijia and Li, Yeting and Zhong, Nanyu and Peng, Bingwei and Jian, Kunpeng and Huo, Wei},
     journal = {Proceedings of the 34th USENIX Security Symposium (USENIX Security 2025)},
     year = {2025},
   }

2024

1. Leveraging Semantic Relations in Code and Data to Enhance Taint Analysis of Embedded Systems

   Jiaxu Zhao, Yuekang Li, Yanyan Zou, and 8 more authors

   Proceedings of the 33rd USENIX Security Symposium (USENIX Security 2024), 2024

   Bib

   @article{zou2024taint-analysis,
     title = {Leveraging Semantic Relations in Code and Data to Enhance Taint Analysis of Embedded Systems},
     author = {Zhao, Jiaxu and Li, Yuekang and Zou, Yanyan and Liang, Zhaohui and Xiao, Yang and Li, Yeting and Peng, Bingwei and Zhong, Nanyu and Wang, Xinyi and Wang, Wei and Huo, Wei},
     journal = {Proceedings of the 33rd USENIX Security Symposium (USENIX Security 2024)},
     year = {2024},
   }

2. Fuzzing for Stateful Protocol Implementations: Are We There Yet?

   Kunpeng Jian, Yanyan Zou, Yeting Li, and 5 more authors

   Theoretical Aspects of Software Engineering (TASE 2024), 2024

   Bib

   @article{zou2024stateful-protocol-survey,
     title = {Fuzzing for Stateful Protocol Implementations: Are We There Yet?},
     author = {Jian, Kunpeng and Zou, Yanyan and Li, Yeting and Cao, Jialun and Li, Menghao and Sun, Jian and Shi, Jingyi and Huo, Wei},
     journal = {Theoretical Aspects of Software Engineering (TASE 2024)},
     year = {2024}
   }

3. TGRop: Top Gun of Return-Oriented Programming Automation

   Nanyu Zhong, Yueqi Chen, Yanyan Zou, and 7 more authors

   Computer Security - ESORICS 2024, 2024

   Bib

   @article{zou2024tgrop,
     title = {TGRop: Top Gun of Return-Oriented Programming Automation},
     author = {Zhong, Nanyu and Chen, Yueqi and Zou, Yanyan and Xing, Xinyu and Dong, Jinwei and Xian, Bingcheng and Zhao, Jiaxu and Li, Menghao and Liu, Binghong and Huo, Wei},
     journal = {Computer Security - ESORICS 2024},
     year = {2024}
   }

2023

1. Effective ReDoS Detection by Principled Vulnerability Modeling and Exploit Generation

   Xinyi Wang, Cen Zhang, Yeting Li, and 8 more authors

   2023 IEEE Symposium on Security and Privacy (S&P 2023), 2023

   Bib

   @article{zou2023redos,
     title = {Effective ReDoS Detection by Principled Vulnerability Modeling and Exploit Generation},
     author = {Wang, Xinyi and Zhang, Cen and Li, Yeting and Xu, Zhiwu and Huang, Shuailin and Liu, Yi and Yao, Yican and Xiao, Yang and Zou, Yanyan and Liu, Yang and Huo, Wei},
     journal = {2023 IEEE Symposium on Security and Privacy (S&P 2023)},
     year = {2023},
   }

2. PosFuzz: augmenting greybox fuzzing with effective position distribution

   Yanyan Zou, Wei Zou, Jiacheng Zhao, and 4 more authors

   Cybersecurity, 2023

   Bib

   @article{zou2023posfuzz,
     title = {PosFuzz: augmenting greybox fuzzing with effective position distribution},
     author = {Zou, Yanyan and Zou, Wei and Zhao, Jiacheng and Zhong, Nanyu and Zhang, Yu and Shi, Ji and Huo, Wei},
     journal = {Cybersecurity},
     year = {2023}
   }

3. RSFuzzer: Discovering Deep SMI Handler Vulnerabilities in UEFI Firmware with Hybrid Fuzzing

   Jiawei Yin, Menghao Li, Yuekang Li, and 6 more authors

   2023 IEEE Symposium on Security and Privacy (S&P 2023), 2023

   Bib

   @article{zou2023rsfuzzer,
     title = {RSFuzzer: Discovering Deep SMI Handler Vulnerabilities in UEFI Firmware with Hybrid Fuzzing},
     author = {Yin, Jiawei and Li, Menghao and Li, Yuekang and Yu, Yong and Lin, Boru and Zou, Yanyan and Liu, Yang and Huo, Wei and Xue, Jingling},
     journal = {2023 IEEE Symposium on Security and Privacy (S&P 2023)},
     year = {2023},
   }

4. 基于物联网设备局部仿真的反馈式模糊测试技术 [Feedback-driven Fuzzing Technology Based on Partial Simulation of IoT Devices]

   Yanyan Zou and others

   信息安全学报 [Journal of Cyber Security], 2023

   Bib

   @article{zou2023partial-simulation,
     title = {基于物联网设备局部仿真的反馈式模糊测试技术 [Feedback-driven Fuzzing Technology Based on Partial Simulation of IoT Devices]},
     author = {Zou, Yanyan and others},
     journal = {信息安全学报 [Journal of Cyber Security]},
     year = {2023}
   }

5. 一种针对网络设备的已知漏洞定位方法 [Locating 1-Day Vulnerabilities in Network Equipment]

   Yanyan Zou and others

   信息安全学报 [Journal of Cyber Security], 2023

   Bib

   @article{zou2023locating-1day,
     title = {一种针对网络设备的已知漏洞定位方法 [Locating 1-Day Vulnerabilities in Network Equipment]},
     author = {Zou, Yanyan and others},
     journal = {信息安全学报 [Journal of Cyber Security]},
     year = {2023}
   }

6. NDFuzz: a non-intrusive coverage-guided fuzzing framework for virtualized network devices

   Yu Zhang, Nanyu Zhong, Wei You, and 6 more authors

   Cybersecurity, 2023

   Bib

   @article{zou2023ndfuzz,
     title = {NDFuzz: a non-intrusive coverage-guided fuzzing framework for virtualized network devices},
     author = {Zhang, Yu and Zhong, Nanyu and You, Wei and Zou, Yanyan and Jian, Kunpeng and Xu, Jiahuan and Sun, Jian and Liu, Baoxu and Huo, Wei},
     journal = {Cybersecurity},
     year = {2023}
   }

2022

1. SiCsFuzzer：基于稀疏插桩的闭源软件模糊测试方法 [SiCsFuzzer: A Sparse-instrumentation-based Fuzzing Platform for Closed Source Software]

   Yanyan Zou and others

   信息安全学报 [Journal of Cyber Security], 2022

   Bib

   @article{zou2022sicsfuzzer,
     title = {SiCsFuzzer：基于稀疏插桩的闭源软件模糊测试方法 [SiCsFuzzer: A Sparse-instrumentation-based Fuzzing Platform for Closed Source Software]},
     author = {Zou, Yanyan and others},
     journal = {信息安全学报 [Journal of Cyber Security]},
     year = {2022}
   }

2021

1. ESRFuzzer: an enhanced fuzzing framework for physical SOHO router devices to discover multi-Type vulnerabilities

   Yu Zhang, Wei Huo, Kunpeng Jian, and 5 more authors

   Cybersecurity, 2021

   Bib

   @article{zou2021esrfuzzer,
     title = {ESRFuzzer: an enhanced fuzzing framework for physical SOHO router devices to discover multi-Type vulnerabilities},
     author = {Zhang, Yu and Huo, Wei and Jian, Kunpeng and Shi, Ji and Liu, Longquan and Zou, Yanyan and Zhang, Chao and Liu, Baoxu},
     journal = {Cybersecurity},
     year = {2021}
   }

2020

1. 变异策略感知的并行模糊测试研究 [Research on Mutator Strategy-aware Parallel Fuzzing]

   Yanyan Zou and others

   信息安全学报 [Journal of Cyber Security], 2020

   Bib

   @article{zou2020mutator-strategy,
     title = {变异策略感知的并行模糊测试研究 [Research on Mutator Strategy-aware Parallel Fuzzing]},
     author = {Zou, Yanyan and others},
     journal = {信息安全学报 [Journal of Cyber Security]},
     year = {2020}
   }

2018

1. 可编程模糊测试技术 [Programmable Fuzzing Technology]

   Yanyan Zou and others

   软件学报 [Journal of Software], 2018

   Bib

   @article{zou2018programmable-fuzzing,
     title = {可编程模糊测试技术 [Programmable Fuzzing Technology]},
     author = {Zou, Yanyan and others},
     journal = {软件学报 [Journal of Software]},
     year = {2018}
   }

2017

1. 动态资源感知的并行化模糊测试框架 [Dynamic Resource Awareness Framework for Parallel Fuzzing]

   Yanyan Zou and others

   计算机应用研究 [Application Research of Computers], 2017

   Bib

   @article{zou2017parallel-fuzzing,
     title = {动态资源感知的并行化模糊测试框架 [Dynamic Resource Awareness Framework for Parallel Fuzzing]},
     author = {Zou, Yanyan and others},
     journal = {计算机应用研究 [Application Research of Computers]},
     year = {2017}
   }