deRop: removing return-oriented programming from malware. - Kangjie Lu; Dabi Zou; Weiping Wen; Debin Gao (ACSAC, 2011)

Packed, Printable, and Polymorphic Return-Oriented Programming. - Kangjie Lu; Dabi Zou; Weiping Wen; Debin Gao (RAID, 2011)

Jekyll on iOS: When Benign Apps Become Evil. - Tielei Wang; Kangjie Lu; Long Lu; Simon P. Chung; Wenke Lee (USENIX Security Symposium, 2013)

RopSteg: program steganography with return oriented programming. - Kangjie Lu; Siyang Xiong; Debin Gao (CODASPY, 2014)

ASLR-Guard: Stopping Address Space Leakage for Code Reuse Attacks. - Kangjie Lu; Chengyu Song; Byoungyoung Lee; Simon P. Chung; Taesoo Kim; Wenke Lee (CCS, 2015)

Software Watermarking using Return-Oriented Programming. - Haoyu Ma; Kangjie Lu; Xinjie Ma; Haining Zhang; Chunfu Jia; Debin Gao (AsiaCCS, 2015)

Checking More and Alerting Less: Detecting Privacy Leakages via Enhanced Data-flow Analysis and Peer Voting. - Kangjie Lu; Zhichun Li; Vasileios P. Kemerlis; Zhenyu Wu 003; Long Lu; Cong Zheng; Zhiyun Qian; Wenke Lee; Guofei Jiang (NDSS, 2015)

SUPOR: Precise and Scalable Sensitive User Input Detection for Android Apps. - Jianjun Huang 001; Zhichun Li; Xusheng Xiao; Zhenyu Wu 003; Kangjie Lu; Xiangyu Zhang 001; Guofei Jiang (USENIX Security Symposium, 2015)

UniSan: Proactive Kernel Memory Initialization to Eliminate Data Leakages. - Kangjie Lu; Chengyu Song; Taesoo Kim; Wenke Lee (CCS, 2016)

How to Make ASLR Win the Clone Wars: Runtime Re-Randomization. - Kangjie Lu; Wenke Lee; Stefan Nürnberger; Michael Backes 001 (NDSS, 2016)

Enforcing Kernel Security Invariants with Data Flow Integrity. - Chengyu Song; Byoungyoung Lee; Kangjie Lu; William Harris; Taesoo Kim; Wenke Lee (NDSS, 2016)

Toward Engineering a Secure Android Ecosystem: A Survey of Existing Techniques. - Meng Xu 001; Chengyu Song; Yang Ji 001; Ming-Wei Shih; Kangjie Lu; Cong Zheng; Ruian Duan; Yeongjin Jang; Byoungyoung Lee; Chenxiong Qian; Sangho Lee 001; Taesoo Kim (ACM Comput. Surv., 2016)

Unleashing Use-Before-Initialization Vulnerabilities in the Linux Kernel Using Targeted Stack Spraying. - Kangjie Lu; Marie-Therese Walter; David Pfaff; Stefan Nümberger; Wenke Lee; Michael Backes 001 (NDSS, 2017)

Bunshin: Compositing Security Mechanisms through Diversification. - Meng Xu 001; Kangjie Lu; Taesoo Kim; Wenke Lee (USENIX ATC, 2017)

Bunshin: Compositing Security Mechanisms through Diversification (with Appendix). - Meng Xu 001; Kangjie Lu; Taesoo Kim; Wenke Lee (CoRR, 2017)

Securing software systems by preventing information leaks. - Kangjie Lu (2017)

Check It Again: Detecting Lacking-Recheck Bugs in OS Kernels. - Wenwen Wang 001; Kangjie Lu; Pen-Chung Yew (CCS, 2018)

Precise and Scalable Detection of Double-Fetch Bugs in OS Kernels. - Meng Xu 001; Chenxiong Qian; Kangjie Lu; Michael Backes 001; Taesoo Kim (IEEE Symposium on Security and Privacy, 2018)

Where Does It Go?: Refining Indirect-Call Targets with Multi-Layer Type Analysis. - Kangjie Lu; Hong Hu 004 (CCS, 2019)

Automatically Identifying Security Checks for Detecting Kernel Semantic Bugs. - Kangjie Lu; Aditya Pakki; Qiushi Wu (ESORICS (2), 2019)

Detecting Missing-Check Bugs via Semantic- and Context-Aware Criticalness and Constraints Inferences. - Kangjie Lu; Aditya Pakki; Qiushi Wu (USENIX Security Symposium, 2019)

Exaggerated Error Handling Hurts! An In-Depth Study and Context-Aware Detection. - Aditya Pakki; Kangjie Lu (CCS, 2020)

Understanding the Security Risks of Docker Hub. - Peiyu Liu 003; Shouling Ji; Lirong Fu; Kangjie Lu; Xuhong Zhang 002; Wei-Han Lee; Tao Lu; Wenzhi Chen; Raheem Beyah (ESORICS (1), 2020)

MPTEE: bringing flexible and efficient memory protection to Intel SGX. - Wenjia Zhao; Kangjie Lu; Yong Qi; Saiyu Qi (EuroSys, 2020)

Precisely Characterizing Security Impact in a Flood of Patches via Symbolic Rule Comparison. - Qiushi Wu; Yang He; Stephen McCamant; Kangjie Lu (NDSS, 2020)

SEIMI: Efficient and Secure SMAP-Enabled Intra-process Memory Isolation. - Zhe Wang 017; Chenggang Wu 002; Mengyao Xie; Yinqian Zhang; Kangjie Lu; Xiaofeng Zhang; Yuanming Lai; Yan Kang 002; Min Yang 002 (SP, 2020)

Fuzzing Error Handling Code using Context-Sensitive Software Fault Injection. - Zu-Ming Jiang; Jia-Ju Bai; Kangjie Lu; Shi-Min Hu 001 (USENIX Security Symposium, 2020)

CPscan: Detecting Bugs Caused by Code Pruning in IoT Kernels. - Lirong Fu; Shouling Ji; Kangjie Lu; Peiyu Liu 003; Xuhong Zhang 002; Yuxuan Duan; Zihui Zhang; Wenzhi Chen; Yanjun Wu (CCS, 2021)

Detecting Missed Security Operations Through Differential Checking of Object-based Similar Paths. - Dinghao Liu; Qiushi Wu; Shouling Ji; Kangjie Lu; Zhenguang Liu; Jianhai Chen; Qinming He (CCS, 2021)

Demons in the Shared Kernel: Abstract Resource Attacks Against OS-level Virtualization. - Nanzi Yang; Wenbo Shen; Jinku Li; Yutian Yang; Kangjie Lu; Jietao Xiao; Tianyu Zhou; Chenggang Qin; Wang Yu; Jianfeng Ma 001; Kui Ren 001 (CCS, 2021)

IFIZZ: Deep-State and Efficient Fault-Scenario Generation to Test IoT Firmware. - Peiyu Liu 003; Shouling Ji; Xuhong Zhang 002; Qinming Dai; Kangjie Lu; Lirong Fu; Wenzhi Chen; Peng Cheng 001; Wenhai Wang; Raheem Beyah (ASE, 2021)

Detecting Kernel Memory Leaks in Specialized Modules with Ownership Reasoning. - Navid Emamdoost; Qiushi Wu; Kangjie Lu; Stephen McCamant (NDSS, 2021)

Static Detection of Unsafe DMA Accesses in Device Drivers. - Jia-Ju Bai; Tuo Li; Kangjie Lu; Shi-Min Hu 001 (USENIX Security Symposium, 2021)

UNIFUZZ: A Holistic and Pragmatic Metrics-Driven Platform for Evaluating Fuzzers. - Yuwei Li; Shouling Ji; Yuan Chen; Sizhuang Liang; Wei-Han Lee; Yueyao Chen; Chenyang Lyu; Chunming Wu 001; Raheem Beyah; Peng Cheng 001; Kangjie Lu; Ting Wang 006 (USENIX Security Symposium, 2021)

Detecting Kernel Refcount Bugs with Two-Dimensional Consistency Checking. - Xin Tan; Yuan Zhang 009; Xiyu Yang; Kangjie Lu; Min Yang 002 (USENIX Security Symposium, 2021)

Understanding and Detecting Disordered Error Handling with Precise Function Pairing. - Qiushi Wu; Aditya Pakki; Navid Emamdoost; Stephen McCamant; Kangjie Lu (USENIX Security Symposium, 2021)

On the Feasibility of Automated Built-in Function Modeling for PHP Symbolic Execution. - Penghui Li 001; Wei Meng 001; Kangjie Lu; Changhua Luo (WWW, 2021)

Stopping Memory Disclosures via Diversification and Replicated Execution. - Kangjie Lu; Meng Xu 001; Chengyu Song; Taesoo Kim; Wenke Lee (IEEE Trans. Dependable Secur. Comput., 2021)

Making Memory Account Accountable: Analyzing and Detecting Memory Missing-account bugs for Container Platforms. - Yutian Yang; Wenbo Shen; Xun Xie; Kangjie Lu; Mingsen Wang; Tianyu Zhou; Chenggang Qin; Wang Yu; Kui Ren 001 (ACSAC, 2022)

Non-Distinguishable Inconsistencies as a Deterministic Oracle for Detecting Security Bugs. - Qingyang Zhou; Qiushi Wu; Dinghao Liu; Shouling Ji; Kangjie Lu (CCS, 2022)

Context-Sensitive and Directional Concurrency Fuzzing for Data-Race Detection. - Zu-Ming Jiang; Jia-Ju Bai; Kangjie Lu; Shi-Min Hu 001 (NDSS, 2022)

EMS: History-Driven Mutation for Coverage-based Fuzzing. - Chenyang Lyu; Shouling Ji; Xuhong Zhang 002; Hong Liang; Binbin Zhao; Kangjie Lu; Raheem Beyah (NDSS, 2022)

Semantic-Informed Driver Fuzzing Without Both the Hardware Devices and the Emulators. - Wenjia Zhao; Kangjie Lu; Qiushi Wu; Yong Qi (NDSS, 2022)

SEDiff: scope-aware differential fuzzing to test internal function models in symbolic execution. - Penghui Li 001; Wei Meng 001; Kangjie Lu (ESEC/SIGSOFT FSE, 2022)

Goshawk: Hunting Memory Corruptions via Structure-Aware and Object-Centric Memory Operation Synopsis. - Yunlong Lyu; Yi Fang; Yiwei Zhang; Qibin Sun; Siqi Ma; Elisa Bertino; Kangjie Lu; Juanru Li (SP, 2022)

OS-Aware Vulnerability Prioritization via Differential Severity Analysis. - Qiushi Wu; Yue Xiao 007; Xiaojing Liao; Kangjie Lu (USENIX Security Symposium, 2022)

Unleashing Coveraged-Based Fuzzing Through Comprehensive, Efficient, and Faithful Exploitable-Bug Exposing. - Bowen Wang; Kangjie Lu; Qiushi Wu; Aditya Pakki (IEEE Trans. Dependable Secur. Comput., 2022)

Effective Covering Array Generation Using an Improved Particle Swarm Optimization. - Zhao Li; Yuhang Chen; Yi Song; Kangjie Lu; Jinwei Shen (IEEE Trans. Reliab., 2022)

GranularNF: Granular Decomposition of Stateful NFV at 100 Gbps Line Speed and Beyond. - Ziyan Wu 002; Tianming Cui; Arvind Narayanan; Yang Zhang 074; Kangjie Lu; Antonia Zhai; Zhi-Li Zhang (SIGMETRICS Perform. Evaluation Rev., 2022)

RetSpill: Igniting User-Controlled Data to Burn Away Linux Kernel Protections. - Kyle Zeng; Zhenpeng Lin; Kangjie Lu; Xinyu Xing 001; Ruoyu Wang 001; Adam Doupé; Yan Shoshitaishvili; Tiffany Bao (CCS, 2023)

Guiding Directed Fuzzing with Feasibility. - Weiheng Bai; Kefu Wu; Qiushi Wu; Kangjie Lu (EuroS&P Workshops, 2023)

How IoT Re-using Threatens Your Sensitive Data: Exploring the User-Data Disposal in Used IoT Devices. - Peiyu Liu 003; Shouling Ji; Lirong Fu; Kangjie Lu; Xuhong Zhang 002; Jingchang Qin; Wenhai Wang; Wenzhi Chen (SP, 2023)

Practical Program Modularization with Type-Based Dependence Analysis. - Kangjie Lu (SP, 2023)

ACTOR: Action-Guided Kernel Fuzzing. - Marius Fleischer; Dipanjan Das 002; Priyanka Bose; Weiheng Bai; Kangjie Lu; Mathias Payer; Christopher Kruegel; Giovanni Vigna (USENIX Security Symposium, 2023)

Silent Bugs Matter: A Study of Compiler-Introduced Security Bugs. - Jianhao Xu; Kangjie Lu; Zhengjie Du; Zhu Ding; Linke Li; Qiushi Wu; Mathias Payer; Bing Mao 001 (USENIX Security Symposium, 2023)

How ChatGPT is Solving Vulnerability Management Problem. - Peiyu Liu 003; Junming Liu; Lirong Fu; Kangjie Lu; Yifan Xia; Xuhong Zhang 002; Wenzhi Chen; Haiqin Weng; Shouling Ji; Wenhai Wang (CoRR, 2023)

FlashOcc: Fast and Memory-Efficient Occupancy Prediction via Channel-to-Height Plugin. - Zichen Yu; Changyong Shu; Jiajun Deng; Kangjie Lu; Zongdai Liu; Jiangyong Yu; Dawei Yang; Hui Li; Yan Chen (CoRR, 2023)

Dancing With Wolves: An Intra-Process Isolation Technique With Privileged Hardware. - Chenggang Wu 002; Mengyao Xie; Zhe Wang 017; Yinqian Zhang; Kangjie Lu; Xiaofeng Zhang; Yuanming Lai; Yan Kang 002; Min Yang 002; Tao Li 022 (IEEE Trans. Dependable Secur. Comput., 2023)

Boosting Practical Control-Flow Integrity with Complete Field Sensitivity and Origin Awareness. - Hao Xiang; Zehui Cheng 005; Jinku Li; Jianfeng Ma 001; Kangjie Lu (CCS, 2024)

Interp-flow Hijacking: Launching Non-control Data Attack via Hijacking eBPF Interpretation Flow. - Qirui Liu; Wenbo Shen; Jinmeng Zhou; Zhuoruo Zhang; Jiayi Hu; Shukai Ni; Kangjie Lu; Rui Chang (ESORICS (3), 2024)

GNNIC: Finding Long-Lost Sibling Functions with Abstract Similarity. - Qiushi Wu; Zhongshu Gu; Hani Jamjoom; Kangjie Lu (NDSS, 2024)

Exploring ChatGPT's Capabilities on Vulnerability Management. - Peiyu Liu 003; Junming Liu; Lirong Fu; Kangjie Lu; Yifan Xia; Xuhong Zhang 002; Wenzhi Chen; Haiqin Weng; Shouling Ji; Wenhai Wang (USENIX Security Symposium, 2024)

Improving Indirect-Call Analysis in LLVM with Type and Data-Flow Co-Analysis. - Dinghao Liu; Shouling Ji; Kangjie Lu; Qinming He (USENIX Security Symposium, 2024)

Detecting Kernel Memory Bugs through Inconsistent Memory Management Intention Inferences. - Dinghao Liu; Zhipeng Lu 001; Shouling Ji; Kangjie Lu; Jianhai Chen; Zhenguang Liu; Dexin Liu; Renyi Cai; Qinming He (USENIX Security Symposium, 2024)

SQLaser: Detecting DBMS Logic Bugs with Clause-Guided Fuzzing. - Jin Wei; Ping Chen; Kangjie Lu; Jun Dai; Xiaoyan Sun 003 (CoRR, 2024)

Exploring Automatic Cryptographic API Misuse Detection in the Era of LLMs. - Yifan Xia; Zichen Xie; Peiyu Liu 003; Kangjie Lu; Yan Liu 069; Wenhai Wang; Shouling Ji (CoRR, 2024)

APILOT: Navigating Large Language Models to Generate Secure Code by Sidestepping Outdated API Pitfalls. - Weiheng Bai; Keyang Xuan; Pengxiang Huang; Qiushi Wu; Jianing Wen; Jingjing Wu; Kangjie Lu (CoRR, 2024)

Understanding the AI-powered Binary Code Similarity Detection. - Lirong Fu; Peiyu Liu 003; Wenlong Meng; Kangjie Lu; Shize Zhou; Xuhong Zhang 002; Wenzhi Chen; Shouling Ji (CoRR, 2024)

mmSpyVR: Exploiting mmWave Radar for Penetrating Obstacles to Uncover Privacy Vulnerability of Virtual Reality. - Luoyu Mei; Ruofeng Liu; Zhimeng Yin 001; Qingchuan Zhao; Wenchao Jiang; Shuai Wang 008; Kangjie Lu; Tian He 001 (Proc. ACM Interact. Mob. Wearable Ubiquitous Technol., 2024)

Causally Consistent Normalizing Flow. - Qingyang Zhou; Kangjie Lu; Meng Xu 001 (AAAI, 2025)

Sheep's Clothing, Wolf's Data: Detecting Server-Induced Client Vulnerabilities in Windows Remote IPC. - Fangming Gu; Qingli Guo; Jie Lu; Qinghe Xie; Beibei Zhao; Kangjie Lu; Hong Li; Xiaorui Gong (NDSS, 2025)

BULKHEAD: Secure, Scalable, and Efficient Kernel Compartmentalization with PKS. - Yinggang Guo; Zicheng Wang; Weiheng Bai; Qingkai Zeng 002; Kangjie Lu (NDSS, 2025)

Beyond Static Pattern Matching? Rethinking Automatic Cryptographic API Misuse Detection in the Era of LLMs. - Yifan Xia; Zichen Xie; Peiyu Liu 003; Kangjie Lu; Yan Liu 069; Wenhai Wang; Shouling Ji (Proc. ACM Softw. Eng., 2025)

Type-Alias Analysis: Enabling LLVM IR with Accurate Types. - Jinmeng Zhou; Ziyue Pan; Wenbo Shen; Xingkai Wang; Kangjie Lu; Zhiyun Qian (Proc. ACM Softw. Eng., 2025)

Towards Understanding and Defeating Abstract Resource Attacks for Container Platforms. - Wenbo Shen; Yifei Wu; Yutian Yang; Qirui Liu; Nanzi Yang; Jinku Li; Kangjie Lu; Jianfeng Ma 001 (IEEE Trans. Dependable Secur. Comput., 2025)

SyzParam: Introducing Runtime Parameters into Kernel Driver Fuzzing. - Yue Sun; Yan Kang 002; Chenggang Wu 002; Kangjie Lu; Jiming Wang; Xingwei Li; Yuhao Hu; Jikai Ren; Yuanming Lai; Mengyao Xie; Zhe Wang 017 (CoRR, 2025)