Publications

2024

1. IMC

   Mutual TLS in Practice: A Deep Dive into Certificate Configurations and Privacy Issues

   Hongying Dong^*, Yizhe Zhang^*, Hyeonmin Lee, Kevin Du, Guancheng Tu, and Yixin Sun

   In Proceedings of the 2024 ACM on Internet Measurement Conference, Madrid, Spain, 2024

   Abs DOI

   Transport Layer Security (TLS) is widely recognized as the essential protocol for securing Internet communications. While numerous studies have focused on investigating server certificates used in TLS connections, our study delves into the less explored territory of mutual TLS (mTLS) where both parties need to provide certificates to each other. By utilizing TLS connection logs collected from a large campus network over 23 months, we identify over 2.2 million unique server certificates and over 3.4 million unique client certificates used in over 1.2 billion mutual TLS connections. By jointly analyzing TLS connection data (e.g., port numbers) and certificate data (e.g., issuers for server/client certificates), we quantify the prevalent use of untrusted certificates and uncover potential security concerns resulting from misconfigured certificates, sharing of certificates between servers and clients, and long-expired certificates. Furthermore, we present the first in-depth study on the wide range of information included in CommonName (CN) and Subject Alternative Name (SAN), drawing comparison between client and server certificates, as well as revealing sensitive information.

2. IMC

   Exploring the Ecosystem of DNS HTTPS Resource Records: An End-to-End Perspective

   Hongying Dong, Yizhe Zhang, Hyeonmin Lee, Shumon Huque, and Yixin Sun

   In Proceedings of the 2024 ACM on Internet Measurement Conference, Madrid, Spain, 2024

   Abs DOI

   The DNS HTTPS resource record is a new DNS record type designed for the delivery of configuration information and parameters required to initiate connections to HTTPS network services. In addition, it is a key enabler for TLS Encrypted ClientHello (ECH) by providing the cryptographic keying material needed to encrypt the initial exchange. To understand the adoption of this new DNS HTTPS record, we perform a longitudinal study on the server-side deployment of DNS HTTPS for Tranco top million domains, as well as an analysis of the client-side support for DNS HTTPS through snapshots from major browsers. To the best of our knowledge, our work is the first longitudinal study on DNS HTTPS server deployment, and the first known study on client-side support for DNS HTTPS. Despite the rapidly growing trend of DNS HTTPS adoption, our study highlights challenges and concerns in the deployment by both servers and clients, such as the complexity in properly maintaining HTTPS records and connection failure in browsers when the HTTPS record is not properly configured.

3. SPW

   Intercepting Bluetooth Traffic from Wearable Health Devices

   Qi Liu, Yizhe Zhang, and Yixin Sun

   In 2024 IEEE Security and Privacy Workshops (SPW), 2024

   DOI

2023

1. ACSAC

   Global Analysis with Aggregation-based Beaconing Detection across Large Campus Networks

   Yizhe Zhang, Hongying Dong, Alastair Nottingham, Molly Buchanan, Donald E. Brown, and Yixin Sun

   In Proceedings of the 39th Annual Computer Security Applications Conference, Austin, TX, USA, 2023

   Abs DOI

   We present a new approach to effectively detect and prioritize malicious beaconing activities in large campus networks by profiling the server activities through aggregated signals across multiple traffic protocols and networks. Key components of our system include a novel time-series analysis algorithm that uncovers hidden periodicity in aggregated signals, and a ranking-based detection pipeline that utilizes self-training and active-learning techniques. We evaluate our detection system on 10 months of real-world traffic collected at two large campus networks, comprising over 75 billion connections. On a daily average, we detect 43% more periodic domains by aggregating signals across multiple networks compared to single-network analysis. Furthermore, our ranking pipeline successfully identifies 1,387 unique malicious domains, out of which 781 (56%) were unknown to the major online threat intelligence platform, VirusTotal, at the time of our detection.

2. IMC

   Behind the Scenes: Uncovering TLS and Server Certificate Practice of IoT Device Vendors in the Wild

   Hongying Dong, Hao Shu, Vijay Prakash, Yizhe Zhang, Muhammad Talha Paracha, David Choffnes, Santiago Torres-Arias, Danny Yuxing Huang, and Yixin Sun

   In Proceedings of the 2023 ACM on Internet Measurement Conference, Montreal QC, Canada, 2023

   DOI

2019

1. ICCCN

   Advances in reliable file-stream multicasting over multi-domain software defined networks (SDN)

   Yuanlong Tan, Shuoshuo Chen, Steve Emmerson, Yizhe Zhang, and Malathi Veeraraghavan

   In 2019 28th International Conference on Computer Communication and Networks (ICCCN), 2019

   DOI
2. IRC

   Gilbreth 2.0: an industrial cloud robotics pick-and-sort application

   Yizhe Zhang, Lianjun Li, Jorge Nicho, Michael Ripperger, Andrea Fumagalli, and Malathi Veeraraghavan

   In 2019 Third IEEE International Conference on Robotic Computing (IRC), 2019

   DOI
3. IJSC

   Autonomous object pick-and-sort procedure for industrial robotics application

   Lianjun Li, Yizhe Zhang, Michael Ripperger, Jorge Nicho, Malathi Veeraraghavan, and Andrea Fumagalli

   International Journal of Semantic Computing, 2019

   DOI

2018

1. IRC

   Gilbreth: A conveyor-belt based pick-and-sort industrial robotics application

   Yizhe Zhang, Lianjun Li, Michael Ripperger, Jorge Nicho, Malathi Veeraraghavan, and Andrea Fumagalli

   In 2018 Second IEEE International Conference on Robotic Computing (IRC), 2018

   DOI