Xuan Feng

I am a security researcher at the Trustworthy Systems group in the Systems and Networking research area at Microsoft Research Asia. I received my Ph.D. in Institute of Information Engineering (IIE), Chinese Academy of Sciences (CAS). My research interests include IoT security, cyber security, and network measurements, with the specific focus on using a data-driven approach to study threats, weakness, and abuse on network/IoT devices at global scale.

I am interested in proposing new methods or building tools to discover and secure exposed vulnerable network/IoT devices. Hoping our research can improve the security of the Internet’s core infrastructure or guide the design/deployment of widely used systems.

news

Sep 10, 2021	We are hiring full-time interns, who have strong interests in network security or IoT security. If you are interested, please send me an Email with your CV.
Nov 8, 2015	A long announcement with details

selected publications

SEC
Understanding and securing device vulnerabilities through automated bug report analysis

Feng, Xuan, Liao, Xiaojing, Wang, X, Wang, Haining, Li, Qiang, Yang, Kai, Zhu, Hongsong, and Sun, Limin

In Proceedings of the 28th USENIX Conference on Security Symposium (SEC) 2019

Bib PDF
@inproceedings{feng2019understanding, abbr = {SEC}, bibtex_show = {true}, title = {Understanding and securing device vulnerabilities through automated bug report analysis}, author = {Feng, Xuan and Liao, Xiaojing and Wang, X and Wang, Haining and Li, Qiang and Yang, Kai and Zhu, Hongsong and Sun, Limin}, booktitle = {Proceedings of the 28th USENIX Conference on Security Symposium (SEC)}, year = {2019}, selected = {true}, pdf = {/sec19winter-final110.pdf} }
S&P
Dangerous skills: Understanding and mitigating security risks of voice-controlled third-party functions on virtual personal assistant systems

Zhang, Nan, Mi, Xianghang, Feng, Xuan, Wang, XiaoFeng, Tian, Yuan, and Qian, Feng

In IEEE Symposium on Security and Privacy (SP) 2019

Bib PDF
@inproceedings{zhang2019dangerous, abbr = {S&P}, bibtex_show = {true}, title = {Dangerous skills: Understanding and mitigating security risks of voice-controlled third-party functions on virtual personal assistant systems}, author = {Zhang, Nan and Mi, Xianghang and Feng, Xuan and Wang, XiaoFeng and Tian, Yuan and Qian, Feng}, booktitle = {IEEE Symposium on Security and Privacy (SP)}, pages = {0}, year = {2019}, organization = {IEEE}, selected = {true}, pdf = {/sp19-zhang.pdf} }
SEC
Acquisitional Rule-based Engine for Discovering Internet-of-Things Devices

Feng, Xuan, Li, Qiang, Wang, Haining, and Sun, Limin

In Proceedings of the USENIX Security Symposium (SEC) 2018

Bib PDF
@inproceedings{xuan2018acquisitional, abbr = {SEC}, bibtex_show = {true}, author = {Feng, Xuan and Li, Qiang and Wang, Haining and Sun, Limin}, title = {Acquisitional Rule-based Engine for Discovering Internet-of-Things Devices}, booktitle = { Proceedings of the {USENIX} Security Symposium (SEC)}, year = {2018}, pages = {327-341}, url = {https://www.usenix.org/conference/usenixsecurity18/presentation/feng}, pdf = {/sec18-feng.pdf}, selected = {true} }