Qinying Wang

Qinying Wang

Postdoctoral Researcher

EPFL

About Me

I am a postdoctoral researcher at HexHive, EPFL, advised by Prof. Mathias Payer. I earned my Ph.D. with honour at Zhejiang University in 2024, advised by Prof. Shouling Ji. Prior to that, I earned my bachelor’s degree with honour at Hunan University in 2018.

I am broadly interested in software and system security, with a particular focus on IoT security. My recent research centers around developing innovative technologies to understand and mitigate risks in modern and emerging systems. This includes IoT messaging protocols, embedded systems, bootloader, OS kernels, and trusted execution environments.

Recent News

  • [03/04/2024] Qinying was invited to serve on Oakland 2025 Poster PC!
  • [10/03/2025] Our paper was accepted by IEEE S&P 2025!
  • [15/10/2024] Our paper was accepted by NDSS 2025!
  • [26/09/2024] Our paper was accepted by USENIX Security 2025!
  • [08/07/2023] Our paper was accepted by NDSS 2024!
  • [07/10/2023] Our paper was accepted by IEEE S&P 2024!

Interests

  • Software and system security
  • IoT security
  • Social issues and security

Education

  • Visiting Ph.D. Student, 2022 - 2023

    EPFL

  • Ph.D. in Cyberspace Security, 2024

    Zhejiang University

  • B.E. in Information Security, 2018

    Hunan University

Publications

Yuan Chen, Qinying Wang, Yong Yang, Yuanchao Chen, Yuwei Li, Shouling Ji (2025). Unveiling Security Vulnerabilities in Git Large File Storage Protocol. IEEE S&P 2025, CCF-A.

Jianqiang Wang, Meng Wang, Qinying Wang, Nils Langius, Li Shi, Ali Abbasi, Thorsten Holz (2025). A Comprehensive Memory Safety Analysis of Bootloaders. NDSS 2025, CCF-A.

Jianqiang Wang, Qinying Wang, Tobias Scharnowski, Li Shi, Simon Woerner, Thorsten Holz (2025). AidFuzzer: Adaptive Interrupt-Driven Firmware Fuzzing via Run-Time State Recognition. 34th USENIX Security Symposium (USENIX Security), CCF-A.

Qinying Wang, Jiacheng Xu, Yuwei Li, Zulie Pan, Yuqing Zhang, Chao Zhang, Shouling Ji (2024). A Review of Smart Fuzzing: Problem Exploration and Method Classification. Chinese Journal of Computers, CCF-A in Chinese.

PDF

Han Bao, Xuhong Zhang, Qinying Wang, Kangming Liang, Zonghui Wang, Shouling Ji, Wenzhi Chen (2024). Pluggable Watermarking of Deepfake Models for Deepfake Detection. the 33rd International Joint Conference on Artificial Intelligence (IJCAI), CCF-A.

PDF Code

Florian Hofhammer, Marcel Busch, Qinying Wang, Manuel Egele, Mathias Payer (2024). SURGEON: Performant, Flexible, and Accurate Re-Hosting via Transplantation. Workshop on Binary Analysis Research (BAR'24), Distinguished paper award.

PDF Code

Jiacheng Xu, Xuhong Zhang, Shouling Ji, Yuan Tian, Binbin Zhao, Qinying Wang, Peng Cheng, Jiming Chen (2023). MOCK: Optimizing Kernel Fuzzing Mutation with Context-aware Dependency. NDSS 2024, CCF-A.

Qinying Wang, Boyu Chang, Shouling Ji, Yuan Tian, Xuhong Zhang, Binbin Zhao, Gaoning Pan, Chenyang Lyu, Mathias Payer, Wenhai Wang, Raheem Beyah (2023). SyzTrust: State-aware Fuzzing on Trusted OS Designed for IoT Devices. IEEE S&P 2024, CCF-A.

PDF Code

Chenyang Lyu, Jiacheng Xu, Shouling Ji, Xuhong Zhang, Qinying Wang, Binbin Zhao, Gaoning Pan, Wei Cao, Peng Chen, Raheem Beyah (2023). MINER: A Hybrid Data-Driven Approach for REST API Fuzzing. 32nd USENIX Security Symposium (USENIX Security), CCF-A.

PDF Code

Binbin Zhao, Shouling Ji, Xuhong Zhang, Yuan Tian, Qinying Wang, Yuwen Pu, Chenyang Lyu, Raheem Beyah (2023). UVSCAN: Detecting Third-Party Component Usage Violations in IoT Firmware. 32nd USENIX Security Symposium (USENIX Security), CCF-A.

Binbin Zhao, Shouling Ji, Jiacheng Xu, Yuan Tian, Qiuyang Wei, Qinying Wang, Chenyang Lyu, Xuhong Zhang, Changting Lin, Jingzheng Wu, Raheem Beyah (2022). One Bad Apple Spoils the Barrel: Understanding the Security Risks Introduced by Third-Party Components in IoT Firmware. IEEE Transactions on Dependable and Secure Computing, CCF-A.

PDF Dataset Slides

Shouling Ji, Qinying Wang, Anying Chen, Binbin Zhao, Tong Ye, Xuhong Zhang, Jingzheng Wu, Yun Li, Jianwei Yin, Yanjun Wu (2022). State-of-the-Art Survey of Open-source Software Supply Chain Security. Journal of Software, CCF-A in Chinese.

PDF

Binbin Zhao, Shouling Ji, Jiacheng Xu, Yuan Tian, Qiuyang Wei, Qinying Wang, Chenyang Lyu, Xuhong Zhang, Changting Lin, Jingzheng Wu, Raheem Beyah (2022). A Large-Scale Empirical Analysis of the Vulnerabilities Introduced by Third-party Components in IoT Firmware. ISSTA 2022, CCF-A.

PDF Code Dataset Slides

Qinying Wang, Shouling Ji, Yuan Tian, Xuhong Zhang, Binbin Zhao, Yuhong Kan, Zhaowei Lin, Changting Lin, Shuiguang Deng, Alex X. Liu, Raheem Beyah (2021). MPInspector: A Systematic and Automatic Approach for Evaluating the Security of IoT Messaging Protocols. 30th USENIX Security Symposium (USENIX Security 2021), CCF-A.

PDF Code

Experience

 
 
 
 
 

Visiting Ph.D. Student

HexHive, EPFL

Dec 2022 – Dec 2023 Lausanne, Switzerland

Contact