A project-centric view of my research works
The first to systematically uncover and measure the residential proxy (RESIP) ecosystem, revealing how millions of compromised residential hosts are abused as proxy exits for cybercrime — and how mobile devices are silently recruited into proxy networks through malicious SDKs in popular apps.
The first to uncover systemic security vulnerabilities in voice assistant ecosystems — including voice squatting, voice masquerading, and command hijacking attacks — and to expose how in-context learning in large language models can be adversarially evaded through black-box attacks.
Building systematic, data-driven measurement pipelines to discover, measure, and understand diverse online abuse operations at Internet scale — from bulletproof hosting and search poisoning to SMS spam and social media illicit promotion.
The first empirical security measurements of emerging decentralized network infrastructures — including decentralized cloud storage, peer-assisted content delivery, and open edge computing platforms — uncovering novel attack surfaces, privacy leaks, and systemic vulnerabilities.