Papers

• Xiangpu Song, Yingpei Zeng, Xiaofeng Liu, Xiaolei Liu*, and Shanqing Guo*, PSFuzzer: A Multi-Party Protocol Fuzzer for Publish/Subscribe Protocols, IEEE Transactions on Software Engineering, 2026. [.pdf] [doi] Journal version of MBFuzzer, with revised design and supporting two extra Pub/Sub protocols
• Xiangpu Song, Longjia Pei, Jianliang Wu*, Yingpei Zeng, Gaoshuo He, Chaoshun Zuo, Xiaofeng Liu*, Qingchuan Zhao, Shanqing Guo*, ProtocolGuard: Detecting protocol non-compliance bugs via LLM-guided static analysis and dynamic verification, Network and Distributed System Security Symposium (NDSS), 2026 [.pdf] [code] Find 158 non-compliance bugs (bugs that are not conforming to RFCs) in 11 protocol implementations
• Zhewei Xia, Yingpei Zeng*, Xiangpu Song, Shanqing Guo*, Ting Wu, HSPFuzzer: High-Speed Network Protocol Fuzzing with Connection Reuse, IEEE Internet of Things Journal, Vol.12, No. 19, 2025[.pdf] [code] [doi] By reusing the connections when fuzzing network protocols, we achieve 1062x faster than AFLNet, much faster than any SOTA. We think we are very close to the speed limit.
• Xiangpu Song, Yingpei Zeng*, Jianliang Wu, Hao Lia, Chaoshun Zuo, Qingchuan Zhao, Shanqing Guo*, CSFuzzer: A Grey-Box Fuzzer for Network Protocol using Context-aware State Feedback, Computers & Security, Volume 157, October 2025, 104581. [.pdf] [code] We proposed a new coverage metric, context-aware state transition (CAST) coverage, for network protocol fuzzing, for reflecting the substates different messages.
• Xiangpu Song, Jianliang Wu*, Yingpei Zeng*, Hao Pan, Chaoshun Zuo, Qingchuan Zhao, Shanqing Guo*, MBFuzzer: A Multi-Party Protocol Fuzzer for MQTT Brokers, The 34th USENIX Security Symposium, August 13–15, Seattle, WA, USA, 2025 [.pdf] We deeply fuzzed the MQTT protocol (with multi-party, differential, and LLM-assisted) and discovered 73 bugs (11 CVEs)
• Haozhe Min, Yang Li, Weijun Li, Yingpei Zeng*, OTPPM: A One-time Pad-based Password Manager, The 10th International Conference on Cyber Security and Information Engineering (ICCSIE 2025), July 23-25, Xining, China, 2025 [.pdf] [code] We think using one-time pad to encrypt the password vaults of password managers is an interesting idea and we implement it
• Yijia Gao, Wenrui Zeng, Siyuan Liu, Yingpei Zeng*, AutoFuzz: Automatic Fuzzer-Sanitizer Scheduling with Multi-Armed Bandit, Software Quality Journal, Springer, Volume 33, Article 8, 2025 [.pdf] [code] Schedule multiple fuzzers and sanitizers for better performance automatically. It is a research project finished by three excellent undergraduate students
• Yang Li, Yingpei Zeng*, Xiangpu Song, Shanqing Guo*, Improving Seed Quality with Historical Fuzzing Results, Information and Software Technology, Volume 179, March 2025, 107651, Elsevier [.pdf] [code] We created a corpus minimization tool to replace afl-min when having fuzzing history
• Zhen Zhao, Xiangpu Song, Qiuyu Zhong, Yingpei Zeng*, Chengyu Hu, and Shanqing Guo*, TLS-DeepDiffer: Message Tuples-Based Deep Differential Fuzzing for TLS Protocol Implementations, The 31st edition of the IEEE International Conference on Software Analysis, Evolution, and Reengineering (SANER 2024), March 12-15 2024, Rovaniemi, Finland, 2024. Acceptance rate 25.6% (62/242) We fuzzed TLS libraries and found one CVE in matrixssl and 24 security or implementation issues
• Kuiliang Lin, Xiangpu Song, Yingpei Zeng*, and Shanqing Guo*, DeepDiffer: Find Deep Learning Compiler Bugs via Priority-guided Differential Fuzzing, The 23rd IEEE International Conference on Software Quality, Reliability, and Security (QRS), October 22-26, Chiang Mai, Thailand, 2023. Acceptance rate 23.47% (54/230) We fuzzed TVM and found 9 new bugs
• Yingpei Zeng, Fengming Zhu, Siyi Zhang, Yu Yang, Siyu Yi, Yufan Pan, Guojie Xie, Ting Wu, DAFuzz: Data-aware Fuzzing of In-Memory Data Stores, PeerJ Computer Science, 2023 [.pdf] [code] We fuzzed redis and memcached and found 4 new bugs/vulnerabilities
• Mingmin Lin, Yingpei Zeng*, Yang Li, RegFuzz: A Linear Regression-Based Approach for Seed Scheduling in Directed Fuzzing, Electronics, 2023, 12(17), 3650 [.pdf]
• Mingmin Lin, Yingpei Zeng*, Yang Li, RegFuzz: A Linear Regression-Based Approach for Seed Scheduling in Directed Fuzzing, 4th Information Communication Technologies Conference (ICTC), Nanjing, China, 2023, pp. 363-368
• Mingmin Lin, Yingpei Zeng*, Ting Wu, Qiuhua Wang, Linan Fang, Shanqing Guo, GSA-Fuzz: Optimize Seed Mutation with Gravitational Search Algorithm, Security and Communication Networks, Vol 2022, 1505842, 2022. [.pdf] [code]
• Yingpei Zeng, Shanqing Guo, Ting Wu, Qiuhua Zheng, DSM: Delayed Signature Matching in Deep Packet Inspection, Symmetry, Vol.12, No.12, 2011, 2020. [.pdf] [code]
• Yingpei Zeng, Mingmin Lin, Shanqing Guo, Yanzhao Shen, Tingting Cui, Ting Wu, Qiuhua Zheng, Qiuhua Wang, MultiFuzz: A Coverage-Based Multiparty-Protocol Fuzzer for IoT Publish/Subscribe Protocols, Sensors, Vol.20, No.18, 5194, 2020. [.pdf] [code] [desockmulti code] desockmulti is 10x faster than the widely used desock (Preeny) tool
• Yingpei Zeng, and Shanqing Guo, Deep Packet Inspection with Delayed Signature Matching in Network Auditing, International Conference on Information and Communications Security (ICICS '18), October 29-31, 2018, Lille, France. [.pdf] [code]
• Chao Chen, Wenrui Diao, Yingpei Zeng, Shanqing Guo and Chengyu Hu, DRLgencert: Deep Learning-based Automated Testing of Certificate Verification in SSL/TLS Implementations. The International Conference on Software Maintenance and Evolution (ICSME'18), September 23-19, 2018, Madrid, Spain. [.pdf]
  ---
• Yingpei Zeng, Jiannong Cao, Jue Hong, Shigeng Zhang, and Li Xie, Secure Localization and Location Verification in Wireless Sensor Networks: A Survey, The Journal of Supercomputing (TJSC), Vol.64, No.3, June 2013, pp. 685–701. [.pdf] [cited 130+]
• Shigeng Zhang, Jiannong Cao, Yingpei Zeng, Zuo Li, Lijun Chen, Daoxu Chen, On Accuracy of Region-based Localization Algorithms for Wireless Sensor Networks, Computer Communications (CC), Vol.33, No.12, 2010, pp 391-1403.
• Yingpei Zeng, Jiannong Cao, Shigeng Zhang, Shanqing Guo and Li Xie, Random-Walk Based Approach to Detect Clone Attacks in Wireless Sensor Networks, IEEE Journal on Selected Areas in Communications(JSAC), Vol.28, No.5, 2010, pp. 677-691. [.pdf] [cited 150+]
• Yingpei Zeng, Jiannong Cao, Shanqing Guo, Kai Yang, and Li Xie, SWCA: A Secure Weighted Clustering Algorithm in Wireless Ad Hoc Networks, IEEE Wireless Communications and Networking Conference (WCNC’09)，April 4-8, 2009. Budapest, Hungary. [.pdf]
• Yingpei Zeng, Jiannong Cao, Shigeng Zhang, Shanqing Guo, and Li Xie, Pollution Attack: A New Attack Against Localization in Wireless Sensor Networks, IEEE Wireless Communications and Networking Conference (WCNC’09)，April 4-8, 2009. Budapest, Hungary. [.pdf]
• Jue Hong, Jiannong Cao, Yingpei Zeng, Sanglu Lu, Daoxu Chen, and Zhuo Li, A Location-free Prediction-based Sleep Scheduling Protocol for Object Tracking in Sensor Networks, The 17th IEEE International Conference on Network Protocols (ICNP '09), October 13-16th, 2009, Princeton, New Jersey, USA.
• Yingpei Zeng, Jiannong Cao, Jue Hong, and Li Xie, Secure Localization and Location Verification in Wireless Sensor Networks (invited), The 2009 IEEE International Symposium on Trust, Security and Privacy for Pervasive Applications (TSP '09), in conjunction with MASS '09, October 12-14, 2009, Macau SAR, P.R.China.
• Yingpei Zeng, Jiannong Cao, Jue Hong, Shigeng Zhang, and Li Xie, SecMCL: A Secure Monte Carlo Localization Algorithm for Mobile Sensor Networks (invited), accepted by 5th IEEE International Workshop on Wireless and Sensor Networks Security (IEEE WSNS 2009), in conjunction with MASS '09, October 12th, 2009, Macau SAR, China. [.pdf]
• Shanqing Guo, Yingpei Zeng, Attribute-based Signature Scheme, International Conference on Information Security and Assurance (ISA) Workshop, 2008.
• Yingpei Zeng, Shigeng Zhang, Shanqing Guo, and Xie Li, Secure Hop-Count Based Localization in Wireless Sensor Networks. International Conference on Computational Intelligence and Security (CIS'07), Harbin, China. December 15-19, 2007. [.pdf]