I am an associate professor in the Computer Science & Engineering
Department of the University of Minnesota--Twin Cities.
I research and teach systems security. My primary research lies at
the intersection of security, software engineering, operating systems,
compilers, and machine learning.
I am a recipient of the NSF CAREER award 2021.
I earned my Ph.D. in Computer Science from Georgia Tech in 2017.
I'm looking for Ph.D. students, a postdoc, and visiting students.
If you are interested in systems and security, please feel free to
contact me! Seedetails.
Research
I am broadly interested in computer security, and my research
frequently intersects software engineering, operating systems,
machine learning, NLP, programming languages,
compilers, and ethics.
My research goal is to secure widely used systems and foundational
software, in a both principled and practical manner. My work has
resulted in many important updates in popular systems such as the
Linux kernel, the Android OS, Apple’s iOS, OpenSSL, and PHP. I have
been working towards my research goals in the following directions.
Program understanding
Foundational program analysis techniques: Indirect-call analysis, type-based analysis, etc.
AI-powered analysis of program artifacts, e.g., inferring code behaviors
General code-reasoning approaches: Cross-checking, contradictions, symbolic comparison, etc.
Secure-by-design defense
Enforcing security principles: Least privilege, control- and data-flow integrity, memory safety, etc.
Affordable and secure patch ecosystem: Patch prioritization, testing, propagation, etc.
Continuous and incremental testing, e.g., fuzzing and code-change analysis
Secure open-source ecosystem
Secure vulnerability disclosure
Supply-chain security, e.g., secure code generation and code verification
Ethics in security research with OSS
We are grateful for NSF for supporting the following projects.
Community-Engaged Design and Implementation of a Framework for Ethical Online Communities Research
Improving Decentralized Kernel Patch Ecosystems
CAREER: Whole-Kernel Analysis Against Developer- and Compiler-Introduced Errors
NFLambda -- A Granular, Scalable and Secure NFV Framework for High Performance Packet Processing at 100 Gbps and Beyond
Checking Security Checks in OS Kernels
MOSE: Automated Detection of Module-Specific Semantic Errors
Publications
2024
GNNIC: Finding Long-Lost Sibling Functions with Abstract Similarity Qiushi Wu, Zhongshu Gu, Hani Jamjoom, and Kangjie Lu. To appear in Proceedings of the 2024 Annual Network and Distributed System Security Symposium (NDSS'24). San Diego, CA, February 2024.
2023
RetSpill: Igniting User-Controlled Data to Burn Away Linux Kernel Protections Kyle Zeng, Zhenpeng Lin, Kangjie Lu, Xinyu Xing, Fish Wang, Adam Doupe, Yan Shoshitaishvili, and Tiffany Bao. To appear in Proceedings of the 30th ACM Conference on Computer and Communications Security (CCS'23). Copenhagen, Denmark, November 2023.
ACTOR: Action-Guided Kernel Fuzzing Marius Fleischer, Dipanjan Das, Priyanka Bose, Weiheng Bai, Kangjie Lu, Mathias Payer, Christopher Kruegel, and Giovanni Vigna. In Proceedings of the 32nd USENIX Security Symposium (Security'23). Anaheim, CA, August 2023.
Silent Bugs Matter: A Study of Compiler-Introduced Security Bugs Jianhao Xu, Kangjie Lu, Zhengjie Du, Zhu Ding, Linke Li, Qiushi Wu, Mathias Payer, and Bing Mao. In Proceedings of the 32nd USENIX Security Symposium (Security'23). Anaheim, CA, August 2023.
Guiding Directed Fuzzing with Feasibility Weiheng Bai, Kefu Wu, Qiushi Wu, and Kangjie Lu. In 2023 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW). Delft, Netherlands, July 2023.
Practical Program Modularization with Type-Based Dependence Analysis [PDF | Code] Kangjie Lu. In Proceedings of the 44th IEEE Symposium on Security and Privacy (Oakland'23). San Francisco, CA, May 2023.
How IoT Re-using Threatens Your Sensitive Data: Exploring the User-Data Disposal in Used IoT Devices Peiyu Liu, Shouling Ji, Lirong Fu, Kangjie Lu, Xuhong Zhang, Jingchang Qin, Wenhai Wang, and Wenzhi Chen. In Proceedings of the 44th IEEE Symposium on Security and Privacy (Oakland'23). San Francisco, CA, May 2023.
2022
Making Memory Account Accountable: Analyzing and Detecting Memory Missing-account bugs for Container Platforms [PDF | Code] Yutian Yang, Wenbo Shen, Xun Xie, Kangjie Lu, Mingsen Wang, Tianyu Zhou, Chenggang Qin, Wang Yu, and Kui Ren. In Proceedings of the Annual Computer Security Applications Conference (ACSAC'22). Austin, TX, December 2022. ★ Distinguished Paper Award
Non-Distinguishable Inconsistencies as a Deterministic Oracle for Detecting Security Bugs [PDF | Code] Qingyang Zhou, Qiushi Wu, Dinghao Liu, Shouling Ji, and Kangjie Lu. In Proceedings of the 29th ACM Conference on Computer and Communications Security (CCS'22). Los Angeles, CA, November 2022.
SEDiff: Scope-Aware Differential Fuzzing to Test Internal Function Models in Symbolic Execution [PDF] Penghui Li, Wei Meng, and Kangjie Lu. In Proceedings of the 21st ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering (ESEC/FSE'22). Singapore, November 2022.
OS-Aware Vulnerability Prioritization via Differential Severity Analysis [PDF] Qiushi Wu*, Yue Xiao*, Xiaojing Liao, and Kangjie Lu. In Proceedings of the 31st USENIX Security Symposium (Security'22). Boston, MA, August 2022. *Co-first authors
GranularNF: Granular Decomposition of Stateful NFV at 100 Gbps Line Speed and Beyond [PDF] Ziyan Wu, Tianming Cui, Arvind Narayanan, Yang Zhang, Kangjie Lu, Antonia Zhai, and Zhi-Li Zhang. ACM SIGMETRICS Performance Evaluation Review, August 2022.
Goshawk: Hunting Memory Corruptions via Structure-Aware and Object-Centric Memory Operation Synopsis [Code | PDF] Yunlong Lyu, Yi Fang, Yiwei Zhang, Qibin Sun, Siqi Ma, Elisa Bertino, Kangjie Lu, and Juanru Li. In Proceedings of the 43rd IEEE Symposium on Security and Privacy (Oakland'22). San Francisco, CA, May 2022.
Semantic-Informed Driver Fuzzing Without Both the Hardware Devices and the Emulators [PDF | Code] Wenjia Zhao, Kangjie Lu, Qiushi Wu, and Yong Qi. In Proceedings of the 2022 Annual Network and Distributed System Security Symposium (NDSS'22). San Diego, CA, April 2022.
Context-Sensitive and Directional Concurrency Fuzzing for Data-Race Detection [PDF] Zu-Ming Jiang, Jia-Ju Bai, Kangjie Lu, and Shi-Min Hu. In Proceedings of the 2022 Annual Network and Distributed System Security Symposium (NDSS'22). San Diego, CA, April 2022.
EMS: History-Driven Mutation for Coverage-based Fuzzing [PDF | Code] Chenyang Lyu, Shouling Ji, Xuhong Zhang, Hong Liang, Kangjie Lu, Binbin Zhao, and Raheem Beyah. In Proceedings of the 2022 Annual Network and Distributed System Security Symposium (NDSS'22). San Diego, CA, April 2022.
Dancing with wolves: An intra-process isolation technique with privileged hardware [Link] Chenggang Wu, Mengyao Xie, Zhe Wang, Yinqian Zhang, Kangjie Lu, Xiaofeng Zhang, Yuanming Lai, Yan Kang, Min Yang, and Tao Li. IEEE Transactions on Dependable and Secure Computing (TDSC'22), 2022.
2021
Detecting Missed Security Operations Through Differential Checking of Object-based Similar Paths [PDF] Dinghao Liu, Qiushi Wu, Shouling Ji, Kangjie Lu, Zhenguang Liu, Jianhai Chen, and Qinming He. In Proceedings of the 28th ACM Conference on Computer and Communications Security (CCS'21). Virtual Conference, November 2021.
CPscan: Detecting Bugs Caused by Code Pruning in IoT Kernels [PDF] Lirong Fu, Shouling Ji, Kangjie Lu, Peiyu Liu, Xuhong Zhang, Yuxuan Duan, Zihui Zhang, Wenzhi Chen, and Yanjun Wu. In Proceedings of the 28th ACM Conference on Computer and Communications Security (CCS'21). Virtual Conference, November 2021.
Demons in the Shared Kernel: Abstract Resource Attacks Against OS-level Virtualization [PDF] Nanzi Yang, Wenbo Shen, Jinku Li, Yutian Yang, Kangjie Lu, Jietao Xiao, Tianyu Zhou, Chenggang Qin, Wang Yu, Jianfeng Ma, and Kui Ren. In Proceedings of the 28th ACM Conference on Computer and Communications Security (CCS'21). Virtual Conference, November 2021.
iFIZZ: Deep-State and Efficient Fault-Scenario Generation to Test IoT Firmware [PDF] Peiyu Liu, Shouling Ji, Xuhong Zhang, Qinming Dai, Kangjie Lu, Lirong Fu, Wenzhi Chen, Peng Cheng, Wenhai Wang, and Raheem Beyah. In Proceedings of the 36th IEEE/ACM International Conference on Automated Software Engineering (ASE'21). Virtual conference, November 2021.
Understanding and Detecting Disordered Error Handling with Precise Function Pairing [PDF] Qiushi Wu, Aditya Pakki, Navid Emamdoost, Stephen McCamant, and Kangjie Lu. In Proceedings of the 30th USENIX Security Symposium (Security'21). Vancouver, Canada, August 2021.
Static Detection of Unsafe DMA Accesses in Device Drivers [PDF] Jia-Ju Bai, Tuo Li, Kangjie Lu, and Shi-Min Hu. In Proceedings of the 30th USENIX Security Symposium (Security'21). Vancouver, Canada, August 2021.
Detecting Kernel Refcount Bugs with Two-Dimensional Consistency Checking [PDF] Xin Tan, Yuan Zhang, Xiyu Yang, Kangjie Lu, and Min Yang. In Proceedings of the 30th USENIX Security Symposium (Security'21). Vancouver, Canada, August 2021.
UNIFUZZ: A Holistic and Pragmatic Metrics-Driven Platform for Evaluating Fuzzers [PDF] Yuwei Li, Shouling Ji, Yuan Chen, Sizhuang Liang, Wei-Han Lee, Yueyao Chen, Chenyang Lyu, Chunming Wu, Raheem Beyah, Peng Cheng, Kangjie Lu, and Ting Wang. In Proceedings of the 30th USENIX Security Symposium (Security'21). Vancouver, Canada, August 2021.
Unleashing Fuzzing Through Comprehensive, Efficient, and Faithful Exploitable-Bug Exposing [PDF | Link] Bowen Wang*, Kangjie Lu*, Qiushi Wu, and Aditya Pakki. IEEE Transactions on Dependable and Secure Computing (TDSC'21), May 2021. *Co-first authors
On the Feasibility of Automated Built-in Function Modeling for PHP Symbolic Execution [PDF] Penghui Li, Wei Meng, Kangjie Lu, and Changhua Luo. In Proceedings of the 30th International World Wide Web Conference (WWW'21). Virtual conference, April 2021.
Detecting Kernel Memory Leaks in Specialized Modules with Ownership Reasoning [PDF] Navid Emamdoost, Qiushi Wu, Kangjie Lu, and Stephen McCamant. In Proceedings of the 2021 Annual Network and Distributed System Security Symposium (NDSS'21). San Diego, CA, February 2021.
Cross-Architecture Testing for Compiler-Introduced Security Bugs [Link] Jianhao Xu, Kangjie Lu, and Bing Mao. In the 5th Workshop on Principles of Secure Compilation (PriSC'21), co-located with POPL'21. Online, January 2021.
2020
Exaggerated Error Handling Hurts! An In-Depth Study and Context-Aware Detection [PDF | Code] Aditya Pakki, and Kangjie Lu. In Proceedings of the 27th ACM Conference on Computer and Communications Security (CCS'20). Orlando, FL, November 2020.
Understanding the Security Risks of Docker Hub [PDF] Peiyu Liu, Shouling Ji, Lirong Fu, Kangjie Lu, Xuhong Zhang, Wei-Han Lee, Tao Lu, Wenzhi Chen, and Raheem Beyah. In Proceedings of the 25th European Symposium on Research in Computer Security (ESORICS'20). Guildford, UK, September 2020.
Fuzzing Error Handling Code using Context-Sensitive Software Fault Injection [PDF] Zu-Ming Jiang, Jia-Ju Bai, Kangjie Lu, and Shi-Min Hu. In Proceedings of the 29th USENIX Security Symposium (Security'20). Boston, MA, August 2020.
SEIMI: Efficient and Secure SMAP-Enabled Intra-process Memory Isolation [PDF] Zhe Wang, Chenggang Wu, Mengyao Xie, Yinqian Zhang, Kangjie Lu, Xiaofeng Zhang, Yuanming Lai, Yan Kang, and Min Yang. In Proceedings of the 41st IEEE Symposium on Security and Privacy (Oakland'20). San Francisco, CA, May 2020.
MPTEE: Bringing Flexible and Efficient Memory Protection to Intel SGX [PDF] Wenjia Zhao, Kangjie Lu, and Yong Qi. In Proceedings of the 15th European Conference on Computer Systems (EuroSys'20). Crete, Greece, April 2020.
Precisely Characterizing Security Impact in a Flood of Patches via Symbolic Rule Comparison [PDF] Qiushi Wu, Yang He, Stephen McCamant, and Kangjie Lu. In Proceedings of the 2020 Annual Network and Distributed System Security Symposium (NDSS'20). San Diego, CA, February 2020.
2019
Where Does It Go? Refining Indirect-Call Targets with Multi-Layer Type Analysis [PDF | Code] Kangjie Lu, and Hong Hu. In Proceedings of the 26th ACM Conference on Computer and Communications Security (CCS'19). London, UK, November 2019. ★ Best Paper Award (1/947)
Automatically Identifying Security Checks for Detecting Kernel Semantic Bugs [PDF | Code] Kangjie Lu, Aditya Pakki, and Qiushi Wu. In Proceedings of the 24th European Symposium on Research in Computer Security (ESORICS'19). Luxembourg, September 2019.
Detecting Missing-Check Bugs via Semantic- and Context-Aware Criticalness and Constraints Inferences [PDF | Code] Kangjie Lu, Aditya Pakki, and Qiushi Wu. In Proceedings of the 28th USENIX Security Symposium (Security'19). Santa Clara, CA, August 2019.
2018
Stopping Memory Disclosures via Diversification and Replicated Execution [PDF] Kangjie Lu, Meng Xu, Chengyu Song, Taesoo Kim, and Wenke Lee. IEEE Transactions on Dependable and Secure Computing (TDSC'18), October 2018.
Check it Again: Detecting Lacking-Recheck Bugs in OS Kernels [PDF | Code] Wenwen Wang, Kangjie Lu, and Pen-Chung Yew. In Proceedings of the 25th ACM Conference on Computer and Communications Security (CCS'18). Toronto, Canada, October 2018.
Precise and Scalable Detection of Double-Fetch Bugs in OS Kernels [PDF] Meng Xu, Chenxiong Qian, Kangjie Lu, Michael Backes, and Taesoo Kim. In Proceedings of the 39th IEEE Symposium on Security and Privacy (Oakland'18). San Francisco, CA, May 2018.
2017
Bunshin: Compositing Security Mechanisms through Diversification [PDF] Meng Xu, Kangjie Lu, Taesoo Kim, and Wenke Lee. In Proceedings of the 2017 USENIX Annual Technical Conference (ATC'17). Santa Clara, CA, July 2017.
Unleashing Use-Before-Initialization Vulnerabilities in the Linux Kernel Using Targeted Stack Spraying [PDF] Kangjie Lu, Marie-Therese Walter, David Pfaff, Stefan Nürnberger, Wenke Lee, and Michael Backes. In Proceedings of the 2017 Annual Network and Distributed System Security Symposium (NDSS'17). San Diego, CA, February 2017.
2016
UniSan: Proactive Kernel Memory Initialization to Eliminate Data Leakages [PDF | Code | Page] Kangjie Lu, Chengyu Song, Taesoo Kim, and Wenke Lee. In Proceedings of the 23rd ACM Conference on Computer and Communications Security (CCS'16). Vienna, Austria, October 2016.
Toward Engineering a Secure Android Ecosystem: A Survey of Existing Techniques [PDF] Meng Xu, Chengyu Song, Yang ji, Ming-Wei Shih, Kangjie Lu, Cong Zheng, Ruian Duan, Yeongjin Jang, Byoungyoung Lee, Chenxiong Qian, Sangho Lee, , and Taesoo Kim. ACM Computing Surveys (CSUR'16) 49(2), August 2016.
How to Make ASLR Win the Clone Wars: Runtime Re-Randomization [PDF | Code | Demo] Kangjie Lu, Stefan Nürnberger, Michael Backes, and Wenke Lee. In Proceedings of the 2016 Annual Network and Distributed System Security Symposium (NDSS'16). San Diego, CA, February 2016.
Enforcing Kernel Security Invariants with Data Flow Integrity [PDF] Chengyu Song, Byoungyoung Lee, Kangjie Lu, William R. Harris, Taesoo Kim, and Wenke Lee. In Proceedings of the 2016 Annual Network and Distributed System Security Symposium (NDSS'16). San Diego, CA, February 2016.
2015
ASLR-Guard: Stopping Address Space Leakage for Code Reuse Attacks [PDF | Page | Code] Kangjie Lu, Chengyu Song, Byoungyoung Lee, Simon P. Chung, Taesoo Kim, and Wenke Lee. In Proceedings of the 22nd ACM Conference on Computer and Communications Security (CCS'15). Denver, Colorado, October 2015.
SUPOR: Precise and Scalable Sensitive User Input Detection for Android Apps [PDF] Jianjun Huang, Zhichun Li, Xusheng Xiao, Zhenyu Wu, Kangjie Lu, Xiangyu Zhang, and Guofei Jiang. In Proceedings of the 24th USENIX Security Symposium (Security'15). Washington, DC, August 2015.
Software Watermarking using Return-Oriented Programming [PDF] Haoyu Ma, Kangjie Lu, Xinjie Ma, Haining Zhang, Chunfu Jia, and Debin Gao. In Proceedings of the 10th ACM Symposium on Information, Computer and Communications Security (ASIACCS'15). Singapore, April–June 2015.
Checking more and alerting less: Detecting privacy leakages via enhanced data-flow analysis and peer voting [PDF] Kangjie Lu, Zhichun Li, Vasileios Kemerlis, Zhenyu Wu, Long Lu, Cong Zheng, Zhiyun Qian, Wenke Lee, and Guofei Jiang. In Proceedings of the 2015 Annual Network and Distributed System Security Symposium (NDSS'15). San Diego, CA, February 2015.
2014
RopSteg: Program Steganography with Return Oriented Programming [PDF] Kangjie Lu, Siyang Xiong, and Debin Gao. In Proceedings of the 4th ACM Conference on Data and Application Security and Privacy (CODASPY'14). San Antonio, Texas, USA, March 2014.
2013
Jekyll on iOS: When Benign Apps Become Evil [PDF] Tielei Wang, Kangjie Lu, Long Lu, Simon Chung, and Wenke Lee. In Proceedings of the 22th USENIX Security Symposium (Security'13). Washington, DC, August 2013.
2011
deRop: Removing Return-Oriented Programming from Malware [PDF] Kangjie Lu, Dabi Zou, Weiping Wen, and Debin Gao. In Proceedings of the 27th Annual Computer Security Applications Conference (ACSAC'11). Orlando, Florida, USA, December 2011.
Packed, Printable, and Polymorphic Return-Oriented Programming [PDF] Kangjie Lu, Dabi Zou, Weiping Wen, and Debin Gao. In Proceedings of the 14th International Symposium on Recent Advances in Intrusion Detection (RAID'11). Menlo Park, California, USA, September 2011.
