Qinying Wang

Postdoctoral Researcher

EPFL

About Me

I am a postdoctoral researcher at HexHive, EPFL, advised by Prof. Mathias Payer. I earned my Ph.D. with honour at Zhejiang University in 2024, advised by Prof. Shouling Ji. During my Ph.D., I was fortunate to collaborate with Prof. Yuan Tian (UCLA), and benefited greatly from her regular guidance.

My research spans software and systems security, with a focus on IoT and emerging connected systems. I develop techniques to identify and mitigate risks arising from complex interactions across system components and trust boundaries.

My work brings together systems research, program analysis, fuzzing, and large-scale empirical measurement, with applications in embedded and IoT systems, software systems, and AI-enabled services.

I am currently on the 2026–2027 job market and seeking faculty positions in computer security and related areas.

Recent News

[04/06/2026] Our paper was accepted by USENIX Security' 26!
[25/02/2026] Qinying joined the PC of ASE 2026 Industry Showcase!
[02/12/2025] Our paper was accepted by TOSEM!
[02/12/2025] Our paper was accepted by NDSS 2026!
[09/09/2025] Our paper was accepted by IEEE S&P 2026!
[14/08/2025] Our paper was accepted by NDSS 2026!
[11/07/2025] Qinying was invited to serve on the PC for USENIX Security' 26!

Interests

Software and system security
Embedded and IoT security
Security of AI-enabled services

Education

Ph.D. in Cyberspace Security, 2024
Zhejiang University
Visiting Ph.D. Student, 2022 - 2023
EPFL
B.E. in Information Security, 2018
Hunan University

Research Areas

Embedded and IoT Systems: IEEE S&P '26, USENIX Security '25, NDSS '25, BAR '24 🏆, IEEE S&P '24, USENIX Security '23, TDSC '22, ISSTA '22, USENIX Security '21.
Software Systems: TDSC '26, NDSS '26-1, NDSS '26-2, IEEE S&P '25 🏆, TOSEM '25, NDSS '24, USENIX Security '23.
AI-Enabled Services: USENIX Security '26, IJCAI '24.

Publications

Qinying Wang, Yong Yang, Yuan Chen, Shouling Ji, Mathias Payer (2026). When HTTP 402 Meets the Blockchain: Risks on Emerging x402 Payments. 35th USENIX Security Symposium (USENIX Security). Top-tier Security Conference.

Ximing Fan, Yong Fang, Peng Jia, Hongwei Li, Xi Peng, Yijia Xu, Qinying Wang, Binbin Zhao, Shouling Ji (2026). MPS-Fuzz: An Enhanced Fine-Grained Fuzzing Based on Units With Multiple Inputs and Outputs. IEEE Transactions on Dependable and Secure Computing, 23(2), 4195–4207. Top-tier Security Journal.

Gaoning Pan, Yiming Tao, Qinying Wang, Chunming Wu, Mingde Hu, Yizhi Ren, Shouling Ji (2026). Breaking Isolation: A New Perspective on Hypervisor Exploitation via Cross-Domain Attacks. NDSS 2026. Top-tier Security Conference.

Jiacheng Xu, He Sun, Shihao Jiang, Qinying Wang, Mingming Zhang, Xiang Li, Kaiwen Shen, Peng Cheng, Jiming Chen, Chao Zhang, Shouling Ji (2025). A Survey of Operating System Kernel Fuzzing. TOSEM 2025. Top-tier Software Engineering Journal.

Jianqiang Wang, Yi Xiang, Meng Wang, Qinying Wang, Ali Abbasi, Thorsten Holz (2025). SmuFuzz: Enable Deep System Management Mode Fuzzing in Fully Featured UEFI Runtime Environment. IEEE S&P 2026. Top-tier Security Conference.

Yuan Chen, Qinying Wang, Yong Yang, Yuanchao Chen, Yuwei Li, Shouling Ji (2025). Unveiling Security Vulnerabilities in Git Large File Storage Protocol. IEEE S&P 2025. Top-tier Security Conference Distinguished Paper Award.

Zezhong Ren, Han Zheng, Zhiyao Feng, Qinying Wang, Marcel Busch, Yuqing Zhang, Chao Zhang, Mathias Payer (2025). Sysyphuzz: the Pressure of More Coverage. NDSS 2026. Top-tier Security Conference.

Jianqiang Wang, Meng Wang, Qinying Wang, Nils Langius, Li Shi, Ali Abbasi, Thorsten Holz (2025). A Comprehensive Memory Safety Analysis of Bootloaders. NDSS 2025. Top-tier Security Conference.

PDF Code Slides

Jianqiang Wang, Qinying Wang, Tobias Scharnowski, Li Shi, Simon Woerner, Thorsten Holz (2025). AidFuzzer: Adaptive Interrupt-Driven Firmware Fuzzing via Run-Time State Recognition. 34th USENIX Security Symposium (USENIX Security). Top-tier Security Conference.

Qinying Wang, Jiacheng Xu, Yuwei Li, Zulie Pan, Yuqing Zhang, Chao Zhang, Shouling Ji (2024). A Review of Smart Fuzzing: Problem Exploration and Method Classification. Chinese Journal of Computers. Top-tier Journal in Chinese.

Han Bao, Xuhong Zhang, Qinying Wang, Kangming Liang, Zonghui Wang, Shouling Ji, Wenzhi Chen (2024). Pluggable Watermarking of Deepfake Models for Deepfake Detection. the 33rd International Joint Conference on Artificial Intelligence (IJCAI). Top-tier AI Conference.

Florian Hofhammer, Marcel Busch, Qinying Wang, Manuel Egele, Mathias Payer (2024). SURGEON: Performant, Flexible, and Accurate Re-Hosting via Transplantation. Workshop on Binary Analysis Research (BAR'24), Distinguished Paper Award.

Jiacheng Xu, Xuhong Zhang, Shouling Ji, Yuan Tian, Binbin Zhao, Qinying Wang, Peng Cheng, Jiming Chen (2023). MOCK: Optimizing Kernel Fuzzing Mutation with Context-aware Dependency. NDSS 2024. Top-tier Security Conference.

Qinying Wang, Boyu Chang, Shouling Ji, Yuan Tian, Xuhong Zhang, Binbin Zhao, Gaoning Pan, Chenyang Lyu, Mathias Payer, Wenhai Wang, Raheem Beyah (2023). SyzTrust: State-aware Fuzzing on Trusted OS Designed for IoT Devices. IEEE S&P 2024. Top-tier Security Conference.

Chenyang Lyu, Jiacheng Xu, Shouling Ji, Xuhong Zhang, Qinying Wang, Binbin Zhao, Gaoning Pan, Wei Cao, Peng Chen, Raheem Beyah (2023). MINER: A Hybrid Data-Driven Approach for REST API Fuzzing. 32nd USENIX Security Symposium (USENIX Security). Top-tier Security Conference.

Binbin Zhao, Shouling Ji, Xuhong Zhang, Yuan Tian, Qinying Wang, Yuwen Pu, Chenyang Lyu, Raheem Beyah (2023). UVSCAN: Detecting Third-Party Component Usage Violations in IoT Firmware. 32nd USENIX Security Symposium (USENIX Security). Top-tier Security Conference.

Binbin Zhao, Shouling Ji, Jiacheng Xu, Yuan Tian, Qiuyang Wei, Qinying Wang, Chenyang Lyu, Xuhong Zhang, Changting Lin, Jingzheng Wu, Raheem Beyah (2022). One Bad Apple Spoils the Barrel: Understanding the Security Risks Introduced by Third-Party Components in IoT Firmware. IEEE Transactions on Dependable and Secure Computing. Top-tier Security Journal.

PDF Dataset Slides

Shouling Ji, Qinying Wang, Anying Chen, Binbin Zhao, Tong Ye, Xuhong Zhang, Jingzheng Wu, Yun Li, Jianwei Yin, Yanjun Wu (2022). State-of-the-Art Survey of Open-source Software Supply Chain Security. Journal of Software. Top-tier Journal in Chinese.

Binbin Zhao, Shouling Ji, Jiacheng Xu, Yuan Tian, Qiuyang Wei, Qinying Wang, Chenyang Lyu, Xuhong Zhang, Changting Lin, Jingzheng Wu, Raheem Beyah (2022). A Large-Scale Empirical Analysis of the Vulnerabilities Introduced by Third-party Components in IoT Firmware. ISSTA 2022. Top-tier Software Engineering Conference.

PDF Code Dataset Slides

Qinying Wang, Shouling Ji, Yuan Tian, Xuhong Zhang, Binbin Zhao, Yuhong Kan, Zhaowei Lin, Changting Lin, Shuiguang Deng, Alex X. Liu, Raheem Beyah (2021). MPInspector: A Systematic and Automatic Approach for Evaluating the Security of IoT Messaging Protocols. 30th USENIX Security Symposium (USENIX Security 2021). Top-tier Security Conference.