Penghui Li

I am a researcher at Zhongguancun Laboratory. I am broadly interested in security and privacy.

I earned my Ph.D. from The Chinese University of Hong Kong in 2023, and my B.Eng. from University of Chinese Academy of Sciences in 2019.

Services | Google Scholar | CV | Email

Publications

Summary: First-author ✕7, S&P/Security/CCS ✕6, FSE/ASE ✕2, WWW ✕2, VLDB ✕1

2024

• FuzzCache: Optimizing Web Application Fuzzing Through Software-Based Data Cache
  Penghui Li, Mingxue Zhang
  In Proceedings of the 31st ACM Conference on Computer and Communications Security (CCS), October 2024
  

• SDFuzz: Target States Driven Directed Fuzzing [PDF]
  Penghui Li, Wei Meng, Chao Zhang
  In Proceedings of the 33rd USENIX Security Symposium (Security), August 2024
  

• Testing Graph Database Systems via Graph-Aware Metamorphic Relations [PDF]
  Zeyang Zhuang, Penghui Li, Pingchuan Ma, Wei Meng, Shuai Wang
  In Proceedings of the 50th International Conference on Very Large Data Bases (VLDB), August 2024
  

• Holistic Concolic Execution for Dynamic Web Applications via Symbolic Interpreter Analysis [PDF]
  Penghui Li, Wei Meng, Mingxue Zhang, Chenlin Wang, Changhua Luo
  In Proceedings of the 45h IEEE Symposium on Security and Privacy (S&P), May 2024
  

2023

• DDRace: Finding Concurrency UAF Vulnerabilities in Linux Drivers with Directed Fuzzing [PDF]
  Ming Yuan, Bodong Zhao, Penghui Li, Jiashuo Liang, Xinhui Han, Xiapu Luo, Chao Zhang
  In Proceedings of the 32nd USENIX Security Symposium (Security), August 2023
  

• SelectFuzz: Efficient Directed Fuzzing with Selective Path Exploration [PDF]
  Changhua Luo, Wei Meng, Penghui Li
  In Proceedings of the 44th IEEE Symposium on Security and Privacy (S&P), May 2023
  

2022

• SEDiff: Scope-Aware Differential Fuzzing to Test Internal Function Models in Symbolic Execution [PDF]
  Penghui Li, Wei Meng, Kangjie Lu
  In Proceedings of the 30th ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering (FSE), Research Track, November 2022
  

• TChecker: Precise Static Inter-Procedural Analysis for Detecting Taint-Style Vulnerabilities in PHP Applications [PDF]
  Changhua Luo, Penghui Li, Wei Meng
  In Proceedings of the 29th ACM Conference on Computer and Communications Security (CCS), November 2022
  ★ Best Paper Honorable Mention

2021

• Understanding and Detecting Performance Bugs in Markdown Compilers [PDF]
  Penghui Li, Yinxi Liu, Wei Meng
  In Proceedings of the 36th IEEE/ACM International Conference on Automated Software Engineering (ASE), Research Track, November 2021
  ★ Best Software Artifact Nomination

• LChecker: Detecting Loose Comparison Bugs in PHP [PDF]
  Penghui Li, Wei Meng
  In Proceedings of the Web Conference 2021 (WWW), Security Track, April 2021
  

• On the Feasibility of Automated Built-in Function Modeling for PHP Symbolic Execution [PDF]
  Penghui Li, Wei Meng, Kangjie Lu, Changhua Luo
  In Proceedings of the Web Conference 2021 (WWW), Security Track, April 2021
  

Services

Program Committee

• European Conference on Computer Systems (EuroSys), Shadow PC, 2024

• Workshop on Measurements, Attacks, and Defenses for the Web (MADWeb), 2024

• USENIX Security (Security), Artifact Evaluation Committee, 2024

• ACM Conference on Computer and Communications Security (CCS), Artifact Evaluation Committee, 2023

Journal Reviewer

• ACM Transactions on Software Engineering and Methodology (TOSEM)

• IEEE Transactions on Dependable and Secure Computing (TDSC)

External Reviewer

• ACM SIGSOFT International Symposium on Software Testing and Analysis (ISSTA), 2024

• IEEE Symposium on Security and Privacy (S&P), 2023, 2024

• The Annual Computer Security Applications Conference (ACSAC), 2023

• The ACM Conference on Computer and Communications Security (CCS), 2021, 2022

• The Web Conference (WWW), 2020, 2022

• The ACM ASIA Conference on Computer and Communications Security (ASIACCS), 2021, 2022