Kangjie Lu

Research

For efficiency and flexibility purposes, widely used software systems such as operating systems and web servers are implemented in unsafe programming languages, and system designers often prioritize performance over security. As a result, these systems inherently suffer from a variety of vulnerabilities and insecure designs that have been exploited by adversaries to launch critical system attacks. System attacks constitute a major threat to our cyber world. The past several years have continuously witnessed critical system attacks targeting systems belonging to individuals, enterprises, and government agencies.

My research aims to secure widely used software systems in an automated and practical manner: to help users automatically uncover and address security problems without requiring manual effort, and to protect widely used systems (e.g., the Linux kernel) while preserving their reliability and efficiency. I have worked towards my research goal in the following directions.

Enabling precise and scalable whole-kernel analysis

• MLTA precisely identifies indirect-call targets in large programs like kernels and browsers using a new layered type analysis.
• CheQ can infer critical semantics in OS kernels, e.g., custom error codes, error handling, and security checks.

Detecting vulnerabilities and insecure designs

• Crix and CheQ employ cross-checking to find more than 400 new kernel bugs such as missing check and NULL-pointer dereferencing.
• LRSan detects lacking-recheck bugs (a checked variable is further modified before being used). 19 new bugs found.
• Deadline defines and detects double-fetch bugs in OS kernels using both static analysis and symbolic execution. 24 new bugs found.
• Target spraying reliably exploits uninitialized-use vulnerabilities by employing tailored symbolic execution and guided fuzzing.
• Jekyll uncovers insecurity with Apple's code signing and app review mechanisms, leading Apple to harden iOS.

Hardening software systems

• Bunshin enforces different and even conflicting security mechanisms in a program efficiently, using N-version programming.
• UniSan eliminates the most common information-leak vulnerabilities is OS kernels.
• ASLR-Guard and RuntimeASLR harden programs to prevent code-pointers leaks, using compiler techniques and dynamic instrumentation.
• DFI protects data-flow integrity for critical data in OS kernels.

Identifying privacy leaks

• AAPL employs enhanced data-flow analysis and peer-voting to detect suspicous privacy leaks in Android apps.
• SUPOR automatically infers sensitive user inputs on a large scale.

Analyzing malware

• deROP automatically transforms ROP payload into traditional attack payload, facilitating malware analysis.
• Packed ROP, Software Watermarking, and RopSteg transform and obfuscate programs.

Publications

Teaching

• Spring 2019: CSCI 4061: Introduction to Operating Systems
• Fall 2018: CSCI 5271: Introduction to Computer Security
• Spring 2018: CSCI 8980: Topics in Systems Security

Professional Experience

Assistant Professor	University of Minnesota, Minneapolis	2017.8 - Present
Visiting Scholar	MPI-SWS & CISPA, Saarland University, Saarbrücken, Germany	2016.5 - 2016.8
Visiting Scholar	MPI-SWS & CISPA, Saarland University, Saarbrücken, Germany	2015.5 - 2015.8
Research Intern	Samsung Research America, Santa Clara	2014.5 - 2014.8
Research Intern	NEC Labs America, Princeton	2013.5 - 2013.8
Research Assistant	Georgia Institute of Technology, Atlanta	2012.8 - 2017.8
Research Engineer	Singapore Management University, Singapore	2011.11 - 2012.6
Research Assistant	Singapore Management University, Singapore	2010.7 - 2011.8
Research Assistant	Peking University, Beijing, China	2009.9 - 2010.7

Professional Services