工学博士 (计算机系统结构)， 清华大学， 中国，2000
工学硕士 (计算机系统结构)， 哈尔滨工业大学， 中国， 1996
工学学士 (计算机科学与技术)，哈尔滨工业大学，中国， 1994
中国网络空间安全协会理事
中国互联网协会安全工作委员会委员
中国密码学会安全协议专委会委员
担任ACM CCS, ACM AsiaCCS，IEEE DSC， IEEE ICICS，ESORICS， SECURECOMM， SecDev等多个国际学术会议TPC成员
网络协议安全、人工智能安全、网络测量、入侵检测、地下产业检测、物联网安全，漏洞挖掘，互联网治理
1. 国家级科研平台，直接参与国家重大专项项目，科研经费充足
2. 高水平研究团队指导，有机会在国际顶级学术会议发表论文
1. 2026届应届硕士毕业生，有意报考东南大学博士研究生专项计划，对项目团队的研究方向感兴趣
有意申请者，请将个人简历邮件发送至zhangmm [at] zgclab.edu.cn（中关村实验室，张明明副研究员）、wangchuhan [at] seu.edu.cn（东南大学，王楚涵副研究员） ，标题请注明【东南大学2026博士申请】。收到简历后，团队将与符合条件的申请人联系。
1. 网络基础设施安全：发现了互联网基础设施的系列安全漏洞，提出的解决方案被国际工业界广泛采纳，提高了互联网基础设施的安全。其中包括1）发现了幽灵域名（Ghost Domain）等DNS协议设计漏洞并提出了解决方案，在工业界普遍部署，提高了DNS服务的安全性。2）提出内容分发网络（CDN）系统设计缺陷和转发循环攻击，可导致大规模网络瘫痪，并提出了解决方案，在世界学术和工业界引起了普遍重视，提高了CDN的安全性。研究成果获得四大国际安全顶级会议NDSS 2016杰出论文奖，这是中国学者在国际顶级安全会议上获得的第一个最佳论文奖。
2. 端到端协议安全：发现了端到端协议在现实中间盒子网络中存在的系列安全漏洞并提出了解决方案，促进了主流浏览器、内容分发网络（CDN）等产品和协议标准的更新，提高了网络通信协议的安全。重点包括：1）发现中间盒子在HTTP协议实现中的歧义漏洞可致严重攻击，并提出了解决方案，提高了主流CDN、防火墙产品和开源软件的安全。研究成果促进工业界相关厂商改进设计，提高了网络安全产品的安全，引起了世界IT媒体的广泛重视。2） 发现HTTPS中Cookie完整性问题的严重危害和解决方案，推动了Google等厂商和IETF国际标准组织提高了浏览器和标准的安全。研究成果引起了相关产业和媒体的广泛关注。3）提出了HTTPS在CDN授权服务中的安全问题及解决方案，推动了学术和工业界的深入研究并推动了国际标准的制定和更新。该研究引起了工业界主流CDN厂商的广泛关注和进一步研究，并推动IETF开始研究新的安全标准。
3. 地下经济和网络犯罪检测：用自动化的方法大规模检测网络犯罪相关的地下经济，检测结果应用于百度等互联网企业，净化了网络空间。重点包括：1）提出了“蜘蛛池”检测方法，并部署到百度相关产品，净化了搜索结果。2）提出了地下经济中“黑词”的自动化检测方法并部署在百度搜索引擎，净化了搜索结果。 作为联合创始人创建了网络安全攻防战队“蓝莲花”、网络安全国际学术交流组织 “网络安全研究国际学术论坛（InForSec）”，通过组织学术报告、安全竞赛等形式，促进了实战型和创新型网络安全人才的培养，促进了国内外、学术和工业界的学术和技术交流。
中央网信办首届“网络安全优秀人才”奖
国际顶级安全学术会议NDSS 2016杰出论文奖
国际著名安全学术会议DSN 2020 最佳论文奖
学术论文
2. DBLP
2024
1. Linkai Zheng, Xiang Li, Chuhan Wang Run Guo, Haixin Duan, Jianjun Chen, Chao Zhang, Kaiwen Shen, ReqsMiner: Automated Discovery of CDN Forwarding Request Inconsistencies and DoS Attacks with Grammar-based Fuzzing, NDSS 2024
2. Mingxuan Liu, Yiming Zhang, Xiang Li, Chaoyi Lu Baojun Liu, Haixin Duan, Xiaofeng Zheng., Understanding the Implementation and Security Implications of Protective DNS Services, NDSS 2024
3. Chuhan Wang, Yasuhiro Kuranaga, Yihang Wang, Mingming Zhang, Linkai Zheng, Xiang Li, Jianjun Chen, Haixin Duan, Yanzhong Lin, Qingfeng Pan,BreakSPF: How Shared Infrastructures Magnify SPF Vulnerabilities Across the Internet， NDSS 2024
4. Xiang Li, Dashuai Wu, Haixin Duan, Qi Li DNSBomb: A New Practical-and-Powerful Pulsing DoS Attack Exploiting DNS Queries-and-Responses, Security&Privacy 2024
5. Xiang Li, Wei Xu, Baojun Liu, Mingming Zhang, Zhou Li, Jia Zhang, Deliang Chang, Xiaofeng Zheng, Chuhan Wang, Jianjun Chen, Haixin Duan, Qi Li. TuDoor Attack: Systematically Exploring and Exploiting Logic Vulnerabilities in DNS Response Pre-processing with Malformed Packets. Security & Privacy 2024
6. Yacong Gu, Lingyun Ying, Huajun Chai, Yingyuan Pu, Haixin Duan, Xing Gao, More Haste, Less Speed: Cache Related Security Threats in Continuous Integration Services, Security&Privacy 2024
7. Enze Wang, Jianjun Chen, Wei Xie, Chuhan Wang, Yifei Gao, Zhenhua Wang, Haixin Duan, Yang Liu, Baosheng Wang. Where URLs Become Weapons: Automated Discovery of SSRF Vulnerabilities in Web Applications, Security & Privacy 2024
8. Qi Wang, Jianjun Chen, Zheyu Jiang, Run Guo, Ximeng Liu, Chao Zhang, Haixin Duan, Break the Wall from bottom: Automated Discovery of Protocol-Level Evasion Vulnerabilities in Web Application Firewalls, Security&Privacy 2024
9. Yunyi Zhang, Baojun Liu, Haixin Duan, Min Zhang, Xiang Li, Fan Shi and Chengxi Xu, Eihal Alowaisheq, Rethinking the Security Threats of Stale DNS Glue Records, USENIX Security 2024
10. Yunyi Zhang, Mingxuan Liu, Baojun Liu, Tsinghua University, Yiming Zhang, Haixin Duan, Min Zhang, Hui Jiang, Yanzhe Li, Fan Shi, nto the Dark: Unveiling Internal Site Search Abused for Black Hat SEO， USENIX Security 2024
11. Qifan Zhang and Xuesong Bai, Xiang Li, Haixin Duan, Qi Li, Zhou Li, ResolverFuzz: Automated Discovery of DNS Resolver Vulnerabilities with Query-Response Fuzzing, USENIX Security 2024
12. Yijing Liu, Yiming Zhang, Baojun Liu, Haixin Duan, Qiang Li, Mingxuan Liu, Ruixuan Li, Jia Yao, Tickets or Privacy? Understand the Ecosystem of Chinese Ticket Grabbing Apps, USENIX Security 2024
13. Yunyi Zhang, Mingming Zhang, Baojun Liu, Zhan Liu and Jia Zhang, Haixin Duan, Min Zhang, Fan Shi, and Chengxi Xu, Cross the Zone: Toward a Covert Domain Hijacking via Shared DNS Infrastructure, USENIX Security 2024
14. Zidong Zhang ,Qinsheng Hou, Lingyun Ying ,Wenrui Diao ,Yacong Gu, Rui Li, Shanqing Guo, aixin Duan , MiniCAT: Understanding and Detecting Cross-Page Request Forgery Vulnerabilities in Mini-Programs CCS 2024
15. Chenyang Zhang,Huajun Chai, Yingyun Ying, Haixin Duan, Jun Tao, Ruijie Li. PowerPeeler: A Precise and General Dynamic Deobfuscation Method for PowerShell Scripts, CCS 2024
16. Xiaofan Li, Yacong Gu, Chu Qiao, Zhenkai Zhang , Daiping Liu, Lingyun Ying， Haixin Duan, Xing Gao. Toward Understanding the Security of Plugins in Continuous Integration Services, CCS 2024
17. Jiahe Zhang , Jianjun Chen , Qi Wang，Hangyu Zhang, Chuhan Wang Jianwei Zhuge, Haixin Duan. Inbox Invasion: Exploiting MIME Ambiguities to Evade Email Attachment Detectors. CCS 2024
18. Yuejia Liang,Jianjun Chen ,Run Guo , Kaiwen Shen, Hui Jiang ,Man Hou ,Yue Yu , Haixin Duan. Internet’s Invisible Enemy: Detecting and Measuring Web Cache Poisoning in the Wild, CCS 2024
19. Ruixuan Li, Shaodong Xiao, Baojun Liu, Yanzhong Lin, Haixin Duan, Qingfeng Pan, Jianjun Chen, Jia Zhang, Ximeng Liu, Xiuqi Lu, Jun Shao, Bounce in the Wild: A Deep Dive into Email Delivery Failures from a Large Email Service Provider, ACM on Internet Measurement Conference(IMC), 2024
20. Yunpeng Xing, Chaoyi Lu, Baojun Liu, Haixin Duan, Junzhe Sun, Zhou Li, Yesterday Once More: Global Measurement of Internet Traffic Shadowing Behaviors., ACM on Internet Measurement Conference(IMC), 2024
21. Jianing Wang, Shanqing Guo, Wenrui Diao, Yue Liu, Haixin Duan, Yichen Liu, Zhenkai Liang. CrypTody: Cryptographic Misuse Analysis of IoT Firmware via Data-flow Reasoning, RAID 2024
22. Mingxuan Liu, Zhenglong Jin, Jiahai Yang, Baoiun Liu, Haixin Duan, Ying Liu, Ximeng Liu, Shujun Tang, ChatScam: Unveiling the Rising Impact of ChatGPT on Domain Name Abuse, DSN 2024
23. Yaru Yang, Yiming Zhang, Tao Wan, Chuhan Wang, Haixin Duan, Jianjun Chen, Yishen Li, Uncovering Security Vulnerabilities in Real-world Implementation and Deployment of 5G Messaging Services, 17th ACM Conference on Security and Privacy in Wireless and Mobile Networks(WiSec) 2024
24. Xiaoyin Liu, Wenzhi Li, Qinsheng Hou, Shishuai Yang, Lingyun Ying, Wenrui Diao, Yanan Li, Shanqing Guo, Haixin Duan. From Promises to Practice: Evaluating the Private Browsing Modes of Android Browser Apps, ACM on Web Conference 2024
25. Ruixuan Li, Baojun Liu, Chaoyi Lu, Haixin Duan, Jun Shao, A Worldwide View on the Reachability of Encrypted DNS Services, ACM on Web Conference 2024
26. Fenglu Zhang, Baojun Liu, Chaoyi Lu, Yunpeng Xing, Haixin Duan, Ying Liu, Liyuan, Investigating Deployment Issues of DNS Root Server Instances from a China-wide View, IEEE Transactions on Dependable and Secure Computing, 2024/3/5
