BYTEWEIGHT: Learning to Recognize Functions in Binary Code. - Tiffany Bao; Jonathan Burket; Maverick Woo; Rafael Turner; David Brumley (USENIX Security Symposium, 2014)

How Shall We Play a Game?: A Game-theoretical Model for Cyber-warfare Games. - Tiffany Bao; Yan Shoshitaishvili; Ruoyu Wang 001; Christopher Kruegel; Giovanni Vigna; David Brumley (CSF, 2017)

Your Exploit is Mine: Automatic Shellcode Transplant for Remote Exploits. - Tiffany Bao; Ruoyu Wang 001; Yan Shoshitaishvili; David Brumley (IEEE Symposium on Security and Privacy, 2017)

Matched and Mismatched SOCs: A Qualitative Study on Security Operations Center Issues. - Faris Bugra Kokulu; Ananta Soneji; Tiffany Bao; Yan Shoshitaishvili; Ziming Zhao 001; Adam Doupé; Gail-Joon Ahn (CCS, 2019)

Understanding and Predicting Private Interactions in Underground Forums. - Zhibo Sun; Carlos E. Rubio-Medrano; Ziming Zhao 001; Tiffany Bao; Adam Doupé; Gail-Joon Ahn (CODASPY, 2019)

HoneyPLC: A Next-Generation Honeypot for Industrial Control Systems. - Efrén López-Morales; Carlos E. Rubio-Medrano; Adam Doupé; Yan Shoshitaishvili; Ruoyu Wang 001; Tiffany Bao; Gail-Joon Ahn (CCS, 2020)

Scam Pandemic: How Attackers Exploit Public Fear through Phishing. - Marzieh Bitaab; Haehyun Cho; Adam Oest; Penghui Zhang; Zhibo Sun; Rana Pourmohamad; Doowon Kim; Tiffany Bao; Ruoyu Wang 001; Yan Shoshitaishvili; Adam Doupé; Gail-Joon Ahn (eCrime, 2020)

Not All Coverage Measurements Are Equal: Fuzzing by Coverage Accounting for Input Prioritization. - Yanhao Wang; Xiangkun Jia; Yuwei Liu; Kyle Zeng; Tiffany Bao; Dinghao Wu; Purui Su (NDSS, 2020)

Exploiting Uses of Uninitialized Stack Variables in Linux Kernels to Leak Kernel Pointers. - Haehyun Cho; Jinbum Park; Joonwon Kang; Tiffany Bao; Ruoyu Wang 001; Yan Shoshitaishvili; Adam Doupé; Gail-Joon Ahn (WOOT @ USENIX Security Symposium, 2020)

Everything You Ever Wanted to Know About Bitcoin Mixers (But Were Afraid to Ask). - Jaswant Pakki; Yan Shoshitaishvili; Ruoyu Wang 001; Tiffany Bao; Adam Doupé (Financial Cryptography (1), 2021)

MuTent: Dynamic Android Intent Protection with Ownership-Based Key Distribution and Security Contracts. - Pradeep Kumar Duraisamy Soundrapandian; Tiffany Bao; Jaejong Baek; Yan Shoshitaishvili; Adam Doupé; Ruoyu Wang 001; Gail-Joon Ahn (HICSS, 2021)

Favocado: Fuzzing the Binding Code of JavaScript Engines Using Semantically Correct Test Cases. - Sung Ta Dinh; Haehyun Cho; Kyle Martin; Adam Oest; Kyle Zeng; Alexandros Kapravelos; Gail-Joon Ahn; Tiffany Bao; Ruoyu Wang 001; Adam Doupé; Yan Shoshitaishvili (NDSS, 2021)

SyML: Guiding Symbolic Execution Toward Vulnerable States Through Pattern Learning. - Nicola Ruaro; Kyle Zeng; Lukas Dresel; Mario Polino; Tiffany Bao; Andrea Continella; Stefano Zanero; Christopher Kruegel; Giovanni Vigna (RAID, 2021)

Having Your Cake and Eating It: An Analysis of Concession-Abuse-as-a-Service. - Zhibo Sun; Adam Oest; Penghui Zhang; Carlos E. Rubio-Medrano; Tiffany Bao; Ruoyu Wang 001; Ziming Zhao 001; Yan Shoshitaishvili; Adam Doupé; Gail-Joon Ahn (USENIX Security Symposium, 2021)

ViK: practical mitigation of temporal memory safety violations through object ID inspection. - Haehyun Cho; Jinbum Park; Adam Oest; Tiffany Bao; Ruoyu Wang 001; Yan Shoshitaishvili; Adam Doupé; Gail-Joon Ahn (ASPLOS, 2022)

I'm SPARTACUS, No, I'm SPARTACUS: Proactively Protecting Users from Phishing by Intentionally Triggering Cloaking Behavior. - Penghui Zhang; Zhibo Sun; Sukwha Kyung; Hans Walter Behrens; Zion Leonahenahe Basque; Haehyun Cho; Adam Oest; Ruoyu Wang 001; Tiffany Bao; Yan Shoshitaishvili; Gail-Joon Ahn; Adam Doupé (CCS, 2022)

Mitigating Threats Emerging from the Interaction between SDN Apps and SDN (Configuration) Datastore. - Sana Habib; Tiffany Bao; Yan Shoshitaishvili; Adam Doupé (CCSW, 2022)

Context-Auditor: Context-sensitive Content Injection Mitigation. - Faezeh Kalantari; Mehrnoosh Zaeifi; Tiffany Bao; Ruoyu Wang 001; Yan Shoshitaishvili; Adam Doupé (RAID, 2022)

"Flawed, but like democracy we don't have a better system": The Experts' Insights on the Peer Review Process of Evaluating Security Papers. - Ananta Soneji; Faris Bugra Kokulu; Carlos E. Rubio-Medrano; Tiffany Bao; Ruoyu Wang 001; Yan Shoshitaishvili; Adam Doupé (SP, 2022)

Expected Exploitability: Predicting the Development of Functional Vulnerability Exploits. - Octavian Suciu; Connor Nelson; Zhuoer Lyu; Tiffany Bao; Tudor Dumitras (USENIX Security Symposium, 2022)

Arbiter: Bridging the Static and Dynamic Divide in Vulnerability Discovery on Binary Programs. - Jayakrishna Vadayath; Moritz Eckert; Kyle Zeng; Nicolaas Weideman; Gokulkrishna Praveen Menon; Yanick Fratantonio; Davide Balzarotti; Adam Doupé; Tiffany Bao; Ruoyu Wang 001; Christophe Hauser; Yan Shoshitaishvili (USENIX Security Symposium, 2022)

Playing for K(H)eaps: Understanding and Improving Linux Kernel Exploit Reliability. - Kyle Zeng; Yueqi Chen 001; Haehyun Cho; Xinyu Xing 001; Adam Doupé; Yan Shoshitaishvili; Tiffany Bao (USENIX Security Symposium, 2022)

CrawlPhish: Large-Scale Analysis of Client-Side Cloaking Techniques in Phishing. - Penghui Zhang; Adam Oest; Haehyun Cho; Zhibo Sun; RC Johnson; Brad Wardman; Shaown Sarker; Alexandros Kapravelos; Tiffany Bao; Ruoyu Wang 001; Yan Shoshitaishvili; Adam Doupé; et al. (IEEE Secur. Priv., 2022)

RetSpill: Igniting User-Controlled Data to Burn Away Linux Kernel Protections. - Kyle Zeng; Zhenpeng Lin; Kangjie Lu; Xinyu Xing 001; Ruoyu Wang 001; Adam Doupé; Yan Shoshitaishvili; Tiffany Bao (CCS, 2023)

Beyond Phish: Toward Detecting Fraudulent e-Commerce Websites at Scale. - Marzieh Bitaab; Haehyun Cho; Adam Oest; Zhuoer Lyu; Wei Wang; Jorij Abraham; Ruoyu Wang 001; Tiffany Bao; Yan Shoshitaishvili; Adam Doupé (SP, 2023)

Toss a Fault to Your Witcher: Applying Grey-box Coverage-Guided Mutational Fuzzing to Detect SQL and Command Injection Vulnerabilities. - Erik Trickel; Fabio Pagani; Chang Zhu; Lukas Dresel; Giovanni Vigna; Christopher Kruegel; Ruoyu Wang 001; Tiffany Bao; Yan Shoshitaishvili; Adam Doupé (SP, 2023)

Greenhouse: Single-Service Rehosting of Linux-Based Firmware Binaries in User-Space Emulation. - Hui Jun Tay; Kyle Zeng; Jayakrishna Menon Vadayath; Arvind S. Raj; Audrey Dutcher; Tejesh Reddy; Wil Gibbs; Zion Leonahenahe Basque; Fangzhou Dong; Zack Smith; Adam Doupé; Tiffany Bao; et al. (USENIX Security Symposium, 2023)

Exploring the Limits of ChatGPT in Software Security Applications. - Fangzhou Wu; Qingzhao Zhang; Ati Priya Bajaj; Tiffany Bao; Ning Zhang; Ruoyu Wang 001; Chaowei Xiao (CoRR, 2023)

Deep Dive into Client-Side Anti-Phishing: A Longitudinal Study Bridging Academia and Industry. - Rana Pourmohamad; Steven Wirsz; Adam Oest; Tiffany Bao; Yan Shoshitaishvili; Ruoyu Wang 001; Adam Doupé; Rida A. Bazzi (AsiaCCS, 2024)

Fuzz to the Future: Uncovering Occluded Future Vulnerabilities via Robust Fuzzing. - Arvind S. Raj; Wil Gibbs; Fangzhou Dong; Jayakrishna Menon Vadayath; Michael Tompkins; Steven Wirsz; Yibo Liu; Zhenghao Hu; Chang Zhu; Gokulkrishna Praveen Menon; Brendan Dolan-Gavitt; Adam Doupé; et al. (CCS, 2024)

Nothing Personal: Understanding the Spread and Use of Personally Identifiable Information in the Financial Ecosystem. - Mehrnoosh Zaeifi; Faezeh Kalantari; Adam Oest; Zhibo Sun; Gail-Joon Ahn; Yan Shoshitaishvili; Tiffany Bao; Ruoyu Wang 001; Adam Doupé (CODASPY, 2024)

SandPuppy: Deep-State Fuzzing Guided by Automatic Detection of State-Representative Variables. - Vivin Paliath; Erik Trickel; Tiffany Bao; Ruoyu Wang 001; Adam Doupé; Yan Shoshitaishvili (DIMVA, 2024)

From Victims to Defenders: An Exploration of the Phishing Attack Reporting Ecosystem. - Zhibo Sun; Faris Bugra Kokulu; Penghui Zhang; Adam Oest; Gianluca Stringhini; Tiffany Bao; Ruoyu Wang 001; Yan Shoshitaishvili; Adam Doupé; Gail-Joon Ahn (RAID, 2024)

"Watching over the shoulder of a professional": Why Hackers Make Mistakes and How They Fix Them. - Irina Ford; Ananta Soneji; Faris Bugra Kokulu; Jayakrishna Vadayath; Zion Leonahenahe Basque; Gaurav Vipat; Adam Doupé; Ruoyu Wang 001; Gail-Joon Ahn; Tiffany Bao; Yan Shoshitaishvili (SP, 2024)

AirTaint: Making Dynamic Taint Analysis Faster and Easier. - Qian Sang; Yanhao Wang; Yuwei Liu; Xiangkun Jia; Tiffany Bao; Purui Su (SP, 2024)

Ahoy SAILR! There is No Need to DREAM of C: A Compiler-Aware Structuring Algorithm for Binary Decompilation. - Zion Leonahenahe Basque; Ati Priya Bajaj; Wil Gibbs; Jude O'Kain; Derron Miao; Tiffany Bao; Adam Doupé; Yan Shoshitaishvili; Ruoyu Wang 001 (USENIX Security Symposium, 2024)

Take a Step Further: Understanding Page Spray in Linux Kernel Exploitation. - Ziyi Guo; Dang K. Le; Zhenpeng Lin; Kyle Zeng; Ruoyu Wang 001; Tiffany Bao; Yan Shoshitaishvili; Adam Doupé; Xinyu Xing 001 (USENIX Security Symposium, 2024)

TYGR: Type Inference on Stripped Binaries using Graph Neural Networks. - Chang Zhu; Ziyang Li; Anton Xue; Ati Priya Bajaj; Wil Gibbs; Yibo Liu; Rajeev Alur; Tiffany Bao; Hanjun Dai; Adam Doupé; Mayur Naik; Yan Shoshitaishvili; et al. (USENIX Security Symposium, 2024)

ARVO: Atlas of Reproducible Vulnerabilities for Open Source Software. - Xiang Mei; Pulkit Singh Singaria; Jordi Del Castillo; Haoran Xi; Abdelouahab Benchikh; Tiffany Bao; Ruoyu Wang 001; Yan Shoshitaishvili; Adam Doupé; Hammond Pearce; Brendan Dolan-Gavitt (CoRR, 2024)

ScamNet: Toward Explainable Large Language Model-Based Fraudulent Shopping Website Detection. - Marzieh Bitaab; Alireza Karimi; Zhuoer Lyu; Ahmadreza Mosallanezhad; Adam Oest; Ruoyu Wang 001; Tiffany Bao; Yan Shoshitaishvili; Adam Doupé (AAAI, 2025)

Teamwork Makes the Defense Work: Comprehensive Vulnerability Defense Resource Allocation. - Siyu Liu; Rida A. Bazzi; Fei Fang; Tiffany Bao (AAMAS, 2025)

SCAMMAGNIFIER: Piercing the Veil of Fraudulent Shopping Website Campaigns. - Marzieh Bitaab; Alireza Karimi; Zhuoer Lyu; Adam Oest; Dhruv Kuchhal; Muhammad Saad 001; Gail-Joon Ahn; Ruoyu Wang 001; Tiffany Bao; Yan Shoshitaishvili; Adam Doupé (NDSS, 2025)

"It's almost like Frankenstein": Investigating the Complexities of Scientific Collaboration and Privilege Management within Research Computing Infrastructures. - Souradip Nath; Ananta Soneji; Jaejong Baek; Tiffany Bao; Adam Doupé; Carlos E. Rubio-Medrano; Gail-Joon Ahn (SP, 2025)

Generating Synthetic Malware Samples Using Generative AI. - Tiffany Bao; Kylie Trousil; Quang Duy Tran; Fabio Di Troia; Younghee Park (IEEE Access, 2025)