Yizhe Zhang

I am actively seeking Summer 2025 internship opportunities. For details, please visit my CV page.

Research Interests

I have a broad interest in network security and privacy, machine learning, and large-scale internet measurement.

Network Security and Privacy. I am broadly interested in enhancing network security and privacy across diverse protocols and applications, such as DNS, TLS, and IoT systems, as well as in developing effective defense mechanisms.

Machine Learning and Data Science. I leverage advanced machine learning techniques and time series analysis to tackle complex cybersecurity issues, developing models and pipelines optimized for deployment in real-world network settings.

Large-Scale Internet Measurement. I investigate security vulnerabilities and privacy practices of various network protocols and applications through large-scale data analysis.

Contacts:

Email me to collaborate!

news

Jan 24, 2025	Our group’s talk is accepted at DNS-OARC 44 DNS-OARC 44 !
Jul 31, 2024	We have two papers accepted at ACM IMC 2024 .
May 23, 2024	I presented our work at 2024 IEEE Security and Privacy Workshops.

Selected Publications

IMC

Exploring the Ecosystem of DNS HTTPS Resource Records: An End-to-End Perspective

Hongying Dong, Yizhe Zhang, Hyeonmin Lee, Shumon Huque, and Yixin Sun

In Proceedings of the 2024 ACM on Internet Measurement Conference, Madrid, Spain, 2024

Abs DOI

The DNS HTTPS resource record is a new DNS record type designed for the delivery of configuration information and parameters required to initiate connections to HTTPS network services. In addition, it is a key enabler for TLS Encrypted ClientHello (ECH) by providing the cryptographic keying material needed to encrypt the initial exchange. To understand the adoption of this new DNS HTTPS record, we perform a longitudinal study on the server-side deployment of DNS HTTPS for Tranco top million domains, as well as an analysis of the client-side support for DNS HTTPS through snapshots from major browsers. To the best of our knowledge, our work is the first longitudinal study on DNS HTTPS server deployment, and the first known study on client-side support for DNS HTTPS. Despite the rapidly growing trend of DNS HTTPS adoption, our study highlights challenges and concerns in the deployment by both servers and clients, such as the complexity in properly maintaining HTTPS records and connection failure in browsers when the HTTPS record is not properly configured.
ACSAC

Global Analysis with Aggregation-based Beaconing Detection across Large Campus Networks

Yizhe Zhang, Hongying Dong, Alastair Nottingham, Molly Buchanan, Donald E. Brown, and Yixin Sun

In Proceedings of the 39th Annual Computer Security Applications Conference, Austin, TX, USA, 2023

Abs DOI

We present a new approach to effectively detect and prioritize malicious beaconing activities in large campus networks by profiling the server activities through aggregated signals across multiple traffic protocols and networks. Key components of our system include a novel time-series analysis algorithm that uncovers hidden periodicity in aggregated signals, and a ranking-based detection pipeline that utilizes self-training and active-learning techniques. We evaluate our detection system on 10 months of real-world traffic collected at two large campus networks, comprising over 75 billion connections. On a daily average, we detect 43% more periodic domains by aggregating signals across multiple networks compared to single-network analysis. Furthermore, our ranking pipeline successfully identifies 1,387 unique malicious domains, out of which 781 (56%) were unknown to the major online threat intelligence platform, VirusTotal, at the time of our detection.