电子邮件： xiaoyang@iie.ac.cn
通信地址： 北京市海淀区树村路19号
邮政编码： 100095
总体介绍
肖扬，中国科学院信息工程研究所副研究员，聚焦于智能化漏洞挖掘、软件供应链安全和AI基础设施安全，入选科技领域青年人才托举工程。
团队在Linux kernel、Chrome、Adobe、Tensorflow、Pytorch、高通驱动等目标软件中发现零日漏洞400余个，获得CVE编号100+。发表高质量会议和期刊论文40余篇，包含USENIX Security、S&P、CCS、NDSS、ICSE、ISSTA等CCF-A 20余篇。任TOSEM、TSE、Computer & Security、Internetware等期刊和会议审稿人，信息安全学报和CyberSecurity期刊编辑等。主持国家自然基金青年项目，担任国家重点研发计划课题执行负责人，参与国家自然基金重点等国家级项目。团队2人入选MSRC TOP 100、戴尔名人堂、因特尔名人堂、谷歌名人堂等漏洞全球排行榜。
更多内容详见个人主页：https://yangy-xiao.github.io/
招生信息
欢迎对智能化软件安全、软件供应链安全、漏洞挖掘等方向感兴趣的同学联系。
招生专业
招生方向
教育背景
工作经历
2022-03 -- 2024.11, 中国科学院信息工程研究所, 预聘副研究员
2024.12 -- 至今， 中国科学院信息工程研究所，副研究员
论文发表
围绕漏洞挖掘（Windows应用软件与驱动、深度学习框架、IoT设备等）、二进制组成分析、漏洞检测与修复等发表了26篇CCF-A类论文。
1. [OOPSLA] From Similarity Ranking to Definitive Verdict: LLM-Enhanced Source-to-Binary Function Localization.
Jingyi Shi, Chengyue Liu, Zhengzi Xu, Yang Xiao(*), Xingchu Chen, Yeting Li, Wei Huo, Yang Liu.
OOPSLA. (CCF-A) ，2026，通讯作者，第4作者
2. [TOSEM] Empirical Study of Code Large Language Models for Binary Security Patch Detection.
Qingyuan Li, Binchang Li, Cuiyun Gao, Shuzheng Gao, Zongjie Li, Yang Xiao, Chuanyi Li, Bin Luo.
ACM Transactions on Software Engineering and Methodology. (CCF-A)，2026 ，第6作者
3. [FSE] Understanding the Limitations of C/C++ Binary Third-Party Library Detection Tool: An Empirical Study at Scale.
Chengyue Liu, Zhengzi Xu, Kaixuan Li, Jiahui Wu, Sihao Qiu, Siyuan Li, Siyang Xiong, Yang Xiao, Yang Liu.
The ACM International Conference on the Foundations of Software Engineering. (CCF-A)，2026，第8作者
4. [ASE-J] SPVR: syntax-to-prompt vulnerability repair based on large language models.
Ruoke Wang, Zongjie Li, Cuiyun Gao, Chaozheng Wang, Yang Xiao, Xuan Wang.
Automated Software Engineering. (CCF-B)，2026，第5作者
5. [NDSS] Through the Authentication Maze: Detecting Authentication Bypass Vulnerabilities in Firmware Binaries.
Nanyu Zhong, Yuekang Li, Yanyan Zou, Jiaxu Zhao, Jinwei Dong, Yang Xiao, Bingwei Peng, Yeting Li, Wei Wang, Wei Huo.
Network and Distributed System Security (NDSS) Symposium. (CCF-A)，2026，第6作者
6. [EuroSys] LifeFuzz: Lifecycle-Guided Fuzzing for Windows Driver Cross-Handler Vulnerabilities.
Chendong Yu, Yuekang Li, Yang Xiao(*), Jie Lu, Yeting Li, Defang Bo, Wei Huo(*).
EuroSys 2026. (CCF-A)，2026，通讯作者，第3作者
7. [TOSEM] PLocator: Fine-Grained Patch Presence Test in Binaries via Patch Code Localization.
Chaopeng Dong, Jingdong Guo, Shouguo Yang, Yang Xiao(*), Yi Li, Hong Li, Zhi Li, Limin Sun(*).
ACM Transactions on Software Engineering and Methodology. (CCF-A)，2025，通讯作者，第4作者
8. [ASE] Advancing Binary Code Similarity Detection via Context-Content Fusion and LLM Verification.
Chaopeng Dong, Jingdong Guo, Shouguo Yang, Yi Li, Dongliang Fang(*), Yang Xiao(*), Yongle Chen, Limin Sun.
In Proceedings of the 40th IEEE/ACM Automated Software Engineering Conference (ASE 2025). (CCF-A)，2025，通讯作者，第6作者
9. [ASE] A Large Scale Study of AI-based Binary Function Similarity Detection Techniques for Security Researchers and Practitioners.
Jingyi Shi, Yufeng Chen, Yang Xiao(*), Yuekang Li, Zhengzi Xu, Sihao Qiu, Chi Zhang, Keyu Qi, Yeting Li, Xingchu Chen, Yanyan Zou, Yang Liu, Wei Huo(*).
In Proceedings of the 40th IEEE/ACM Automated Software Engineering Conference (ASE 2025). (CCF-A)，2025，通讯作者，第3作者
10. [ASE] Vulnerability-Affected Versions Identification: How Far Are We?
Xingchu Chen, Chengwei Liu, Jialun Cao, Yang Xiao(*), Xinyue Cai, Yeting Li, Jingyi Shi, Tianqi Sun, Haiming Chen, Wei Huo(*).
In Proceedings of the 40th IEEE/ACM Automated Software Engineering Conference (ASE 2025). (CCF-A)，2025，通讯作者，第4作者
11. [USENIX SEC] From Constraints to Cracks: Constraint Semantic Inconsistencies as Vulnerability Beacons for Embedded Systems.
Jiaxu Zhao, Yuekang Li, Yanyan Zou, Yang Xiao, Naijia Jiang, Yeting Li, Nanyu Zhong, Bingwei Peng, Kunpeng Jian, Wei Huo.
In Proceedings of the 34th USENIX Security Symposium. (CCF-A)，2025，第4作者
12. [USENIX SEC] VULCANBOOST: Boosting ReDoS Fixes through Symbolic Representation and Feature Normalization.
Yeting Li, Yecheng Sun, Zhiwu Xu, Haiming Chen, Xinyi Wang, Hengyu Yang, Huina Chao, Cen Zhang, Yang Xiao, Yanyan Zou, Feng Li, Wei Huo.
In Proceedings of the 34th USENIX Security Symposium. (CCF-A)，2025，第9作者
13. [USENIX SEC] ZIPPER: Static Taint Analysis for PHP Applications with Precision and Efficiency.
Xinyi Wang, Yeting Li, Jie Lu, Shizhe Cui, Chenghang Shi, Qin Mai, Yunpei Zhang, Yang Xiao, Feng Li, Wei Huo.
In Proceedings of the 34th USENIX Security Symposium. (CCF-A)，2025，第8作者
14. [ACL] Boosting Vulnerability Detection of LLMs via Curriculum Preference Optimization with Synthetic Reasoning Data.
Xin-Cheng Wen, Yijun Yang, Cuiyun Gao, Yang Xiao, Deheng Ye.
Association for Computational Linguistics. (CCF-A)，2025，第4作者
15. [USENIX SEC] Leveraging Semantic Relations in Code and Data to Enhance Taint Analysis of Embedded Systems.
Jiaxu Zhao, Yuekang Li, Yanyan Zou, Zhaohui Liang, Yang Xiao, Yeting Li, Bingwei Peng, Nanyu Zhong, Xinyi Wang, Wei Wang, Wei Huo.
In Proceedings of the 33rd USENIX Security Symposium. (CCF-A)，2024，第5作者
16. [ISSTA] SCALE: Constructing Structured Natural Language Comment Trees for Software Vulnerability Detection.
Xincheng Wen, Cuiyun Gao, Shuzheng Gao, Yang Xiao, Michael R Lyu.
ACM SIGSOFT International Symposium on Software Testing and Analysis (ISSTA). (CCF-A)，2024，第4作者
17. [NDSS] File Hijacking Vulnerability: The Elephant in the Room.
Chendong Yu, Yang Xiao(*), Jie Lu, Yuekang Li, Yeting Li, Lian Li, Yifan Dong, Jian Wang, Jingyi Shi, Defang Bo, Wei Huo.
Network and Distributed System Security (NDSS) Symposium. (CCF-A)，2024，通讯作者，第2作者
18. [ICSE] LibvDiff: Library Version Difference Guided OSS Version Identification in Binaries.
Chaopeng Dong, Siyuan Li, Shouguo Yang, Yang Xiao, Yongpan Wang, Hong Li, Zhi Li, Limin Sun.
46th International Conference on Software Engineering. (CCF-A)，20204，第4作者
19. [CCS] Enhancing OSS Patch Backporting with Semantics.
Su Yang, Yang Xiao, Zhengzi Xu, Chengyi Sun, Chen Ji, Yuqing Zhang.
The ACM Conference on Computer and Communications Security. (CCF-A)，2023，第2作者
20. [ESEC/FSE] Learning Program Semantics for Vulnerability Detection via Vulnerability-specific Inter-procedural Slicing.
Bozhi Wu, Shangqing Liu, Yang Xiao, Zhiming Li, Jun Sun, Shang-Wei Lin.
ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering. (CCF-A)，2023，第3作者
21. [TOSEM] Asteria-Pro: Enhancing Deep-Learning Based Binary Code Similarity Detection by Incorporating Domain Knowledge.
Shouguo Yang, Chaopeng Dong, Yang Xiao(*), Yiran Cheng, Zhiqiang Shi, Zhi Li, Limin Sun.
ACM Transactions on Software Engineering and Methodology. (CCF-A)，2023，通讯作者，第3作者*
22. [TOSEM] Towards Practical Binary Code Similarity Detection: Vulnerability Verification via Patch Semantic Analysis.
Shouguo Yang, Zhengzi Xu(*), Yang Xiao(*), Zhe Lang, Wei Tang, Yang Liu, Zhiqiang Shi, Hong Li, Limin Sun.
ACM Transactions on Software Engineering and Methodology. (CCF-A)，2023，通讯作者，第3作者
23. [USENIX SEC] Detecting API Post-Handling Bugs Using Code and Description in Patches.
Miaoqian Lin, Kai Chen, Yang Xiao.
In Proceedings of the 32nd USENIX Security Symposium. (CCF-A)，2023，第3作者
24. [ISSTA] ACETest: Automated Constraint Extraction for Testing Deep Learning Operators.
Jingyi Shi, Yang Xiao(*), Yuekang Li, Yeting Li, Dongsong Yu, Chendong Yu, Hui Su, Yufeng Chen, Wei Huo.
ACM SIGSOFT International Symposium on Software Testing and Analysis. (CCF-A)，2023，通讯作者，第2作者
25. [S&P] Effective ReDoS Detection by Principled Vulnerability Modeling and Exploit Generation.
Xinyi Wang, Cen Zhang, Yeting Li, Zhiwu Xu, Shuailin Huang, Yi Liu, Yican Yao, Yang Xiao, Yanyan Zou, Yang Liu, Wei Huo.
2023 IEEE Symposium on Security and Privacy. (CCF-A)，2023，第8作者
26. [Cybersecurity] Unleashing the power of pseudo-code for binary code similarity analysis.
Weiwei Zhang, Zhengzi Xu, Yang Xiao, Yinxing Xue.
Journal of Cyber Security. (CCF-B)，2022，第3作者
27. [ICSME] VERJava: Vulnerable Version Identification for Java OSS with a Two-Stage Analysis.
Qing Sun, Lili Xu, Yang Xiao, Feng Li, He Su, Yiming Liu, Hongyun Huang, Wei Huo.
2022 IEEE International Conference on Software Maintenance and Evolution. (CCF-B)，2022，第3作者
28. [USENIX SEC] RegexScalpel: Regular Expression Denial of Service (ReDoS) Defense by Localize-and-Fix.
Yeting Li, Yecheng Sun, Zhiwu Xu, Jialun Cao, Yuekang Li, Rongchen Li, Haiming Chen, Shing-Chi Cheung, Yang Liu, Yang Xiao.
In Proceedings of the 31st USENIX Security Symposium. (CCF-A)，2022，第9作者
29. [Cybersecurity] B2SMatcher: Fine-Grained Version Identification of Open-Source Software in Binary Files.
Gu Ban, Lili Xu, Yang Xiao, Xinhua Li, Zimu Yuan, Wei Huo.
Journal of Cyber Security. (CCF-B)，2021，第3作者
30. [SANER] VIVA: Binary Level Vulnerability Identification via Partial Signature.
Yang Xiao, Zhengzi Xu, Weiwei Zhang, Chendong Yu, Longquan Liu, Wei Zou, Zimu Yuan, Yang Liu, Aihua Piao, Wei Huo.
IEEE International Conference on Software Analysis, Evolution and Reengineering. (CCF-B)，2021，第1作者
31. [USENIX SEC] MVP: Detecting Vulnerabilities using Patch-Enhanced Vulnerability Signatures.
Yang Xiao, Bihuan Chen, Chendong Yu, Zhengzi Xu, Zimu Yuan, Feng Li, Binghong Liu, Yang Liu, Wei Huo, Wei Zou, Wenchang Shi.
In Proceedings of the 29th USENIX Security Symposium. (CCF-A)，2020，第1作者
学生指导情况
已指导学生
陈成希 硕士研究生 083900-网络空间安全 (华为) 协助指导
孙天琦 硕士研究生 083900-网络空间安全 (华为)
艾语晨 硕士研究生 083900-网络空间安全 (中国银行) 协助指导
孙晴 博士研究生 083900-网络空间安全 (华为) 协助指导
现指导学生
齐柯宇 硕士研究生 083900-网络空间安全
蔡欣悦 硕士研究生 083900-网络空间安全
李盛 硕士研究生 083900-网络空间安全
王海敏 硕士研究生 081203-计算机应用技术
俞晨东 博士研究生 083900-网络空间安全 协助指导
石景宜 博士研究生 083900-网络空间安全 协助指导
陈煜锋 博士研究生 083900-网络空间安全 协助指导
陈星杵 博士研究生 083900-网络空间安全 协助指导
邱思豪 博士研究生 083900-网络空间安全 协助指导
张驰 博士研究生 083900-网络空间安全 协助指导
朱晋 博士研究生 083900-网络空间安全 协助指导
万平衡 博士研究生 083900-网络空间安全 协助指导