Fengyu Liu

Fengyu Liu

ETH Zürich

Publications

2027

  • NDSS'27 From Flow to Flaw: Automatic Detection of Taint-Style Vulnerabilities in Low-Code Agent Development Frameworks
    Jiaqi Luo, Zhuoxiang Shen, Kefan Wu, Fengyu Liu, Youkun Shi, Mo Zhu, Kangcheng Deng, Xudong Pan, Geng Hong, Yuan Zhang, Jiarun Dai
    In Proceedings of the Network and Distributed System Security (NDSS), February 2027. (CCF-A)

  • IEEE S&P'27 Babel of Voices: Demystifying Security Threats Arising from Cross-Specification URL Parsing Inconsistencies in Web Applications
    Qiyi Zhang, Anmao Gou, Youkun Shi, Fengyu Liu, Yuan Zhang.
    In Proceedings of 48th IEEE Symposium on Security and Privacy (S&P), May 2027.

  • IEEE S&P'27 FBOLA: Detecting Broken Object-Level Authorization Vulnerabilities via Frontend-Backend Integrated Static Analysis
    Ziao Li, Youkun Shi, Jiarun Dai, Yuanhao Li, Fengyu Liu, Yi Xu, Lei Zhang, Yuan Zhang.
    In Proceedings of 48th IEEE Symposium on Security and Privacy (S&P), May 2027.

2026

  • ACM CCS'26 BACAgent: LLM-Powered Detection of Broken-Access-Control Vulnerabilities in Web Applications [PDF]
    Fengyu Liu, Yuan Zhang, Zheng Lou, Tian Chen, Youkun Shi, Jiarun Dai, Enhao Li, Guangyu Zhou, Zhongfu Su, Zequn Fang.
    In Proceedings of the 33rd ACM Conference on Computer and Communications Security (CCS), November 2026. (CCF-A)

  • ACM CCS'26 Reproducing Web Application Vulnerabilities with Patch-Guided Routing Inference and Sink Exploration
    Youkun Shi, Yuan Zhang, Feng Xue, Jiarun Dai, Lei Zhang, Fengyu Liu, Bocheng Xiang, Xiapu Luo.
    In Proceedings of the 33rd ACM Conference on Computer and Communications Security (CCS), November 2026. (CCF-A)

  • ACM CCS'26 VUnitFuzz: Decoupling PHP Sink Verification from Monolithic Execution for Taint-Style Vulnerability Detection
    Youkun Shi, Yuan Zhang, Tianhao Bai, Jiarun Dai, Fengyu Liu, Xiapu Luo.
    In Proceedings of the 33rd ACM Conference on Computer and Communications Security (CCS), November 2026. (CCF-A)

  • ACM CCS'26 PHPBench: Automated Generation of Verifiable and Hierarchical Benchmarks for PHP Web Fuzzing
    Youkun Shi, Yuan Zhang, Lei Zhang, Jiarun Dai, Tianhao Bai, Fengyu Liu, Bocheng Xiang, Xiapu Luo, Min Yang.
    In Proceedings of the 33rd ACM Conference on Computer and Communications Security (CCS), November 2026. (CCF-A)

  • USENIX Security'26 Autonomy Comes with Costs: Detecting Denial-of-Service Vulnerabilities Caused by Resource Abusing in LLM-based Agents
    Jiaqi Luo, Jiarun Dai, Fengyu Liu, Songyang Peng, Youkun Shi, Tong Bu, Geng Hong, Xudong Pan, Yuan Zhang.
    In Proceedings of the 35th USENIX Security Symposium (USENIX Security), Baltimore, MD, USA, August 12-14, 2026. (CCF-A)

  • NDSS'26 LinkGuard: A Lightweight State-Aware Runtime Guard Against Link Following Attacks in Windows File System
    Bocheng Xiang, Yuan Zhang, Hao Huang, Fengyu Liu, Youkun Shi.
    In Proceedings of the Network and Distributed System Security (NDSS), February 2026. (CCF-A)

  • TIFS'26 Measuring and Understanding Expectation Inconsistency in Java Libraries
    Zihan Lin, Yuan Zhang, Letian Yuan, Guangliang Yang, Youkun Shi, Fengyu Liu, Xin Tan, Min Yang.
    In IEEE Transactions on Information Forensics and Security, 2026. (CCF-A)

  • JOS'26 BACHunter: Black-Box Detection of Broken-Access-Control Vulnerabilities via LLM-Based Semantic Understanding
    Fengyu Liu, Yuan Zhang, Qiyi Zhang, Tian Chen, Youkun Shi, Min Yang
    In Journal of Software, China, 2026. (CCF-A)

2025

  • ACM CCS'25 BACScan: Automatic Black-Box Detection of Broken-Access-Control Vulnerabilities in Web Applications [PDF]
    Fengyu Liu, Yuan Zhang, Enhao Li, Wei Meng, Youkun Shi, Qianheng Wang, Chenlin Wang, Zihan Lin, Min Yang.
    In Proceedings of the 32nd ACM Conference on Computer and Communications Security (CCS), October 2025. (CCF-A)
    ★ Distinguished Paper Award (<1% submission)

  • ACM CCS'25 Be Aware of What You Let Pass: Demystifying URL-based Authentication Bypass Vulnerability in Java Web Applications [PDF]
    Qiyi Zhang*, Fengyu Liu*, Zihan Lin, Yuan Zhang (* co-first authors).
    In Proceedings of the 32nd ACM Conference on Computer and Communications Security (CCS), October 2025. (CCF-A)

  • USENIX Security'25 Make Agent Defeat Agent: Automatic Detection of Taint-Style Vulnerabilities in LLM-based Agents [PDF]
    Fengyu Liu, Yuan Zhang, Jiaqi Luo, Jiarun Dai, Tian Chen, Letian Yuan, Zhengmin Yu, Youkun Shi, Ke Li, Hao Chen, Min Yang.
    In Proceedings of the 34th USENIX Security Symposium (USENIX Security), August 2025. (CCF-A)
    Presented at BlackHat Europe 2025 [Talk Abstract]

  • USENIX Security'25 Pig in a Poke: Automatically Detecting and Exploiting Link Following Vulnerabilities in Windows File Operations
    Bocheng Xiang, Yuan Zhang, Fengyu Liu, Hao Huang, Zihan Lin, Min Yang.
    In Proceedings of the 34th USENIX Security Symposium (USENIX Security), August 2025. (CCF-A)
    ★ Honerable Mention Award (6.1%=25/407)

  • USENIX Security'25 XSSky: Detecting XSS Vulnerabilities through Local Path-Persistent Fuzzing
    Youkun Shi, Yuan Zhang, Tianhao Bai, Feng Xue, Jiarun Dai, Fengyu Liu, Lei Zhang, Xiapu Luo, Min Yang.
    In Proceedings of the 34th USENIX Security Symposium (USENIX Security), August 2025. (CCF-A)

  • USENIX Security'25 Effective Directed Fuzzing with Hierarchical Scheduling for Web Vulnerability Detection
    Zihan Lin, Yuan Zhang, Jiarun Dai, Xinyou Huang, Bocheng Xiang, Guangliang Yang, Letian Yuan, Lei Zhang, Fengyu Liu, Tian Chen, Min Yang.
    In Proceedings of the 34th USENIX Security Symposium (USENIX Security), August 2025. (CCF-A)

  • IEEE S&P'25 Detecting Taint-Style Vulnerabilities in Microservice-Structured Web Applications [PDF]
    Fengyu Liu, Yuan Zhang, Tian Chen, Youkun Shi, Guangliang Yang, Zihan Lin Min Yang, Junyao He, Qi Li.
    In Proceedings of the 46th IEEE Symposium on Security and Privacy (S&P), May 2025. (CCF-A)
    ★ Distinguished Paper Award (<1% submission), Presented at BlackHat USA 2025 [Talk Abstract]

  • IEEE S&P'25 MOCGuard: Automatically Detecting Missing-Owner-Check Vulnerabilities in Java Web Applications [PDF]
    Fengyu Liu, Youkun Shi, Yuan Zhang, Guangliang Yang, Enhao Li, Min Yang.
    In Proceedings of the 46th IEEE Symposium on Security and Privacy (S&P), May 2025. (CCF-A)

  • TIFS'25 Facilitating Access Control Vulnerability Detection in Modern Java Web Applications with Accurate Permission Check Identification
    Youkun Shi, Fengyu Liu, Guangliang Yang, Yuan Zhang, Yinzhi Cao, Enhao Li, Xin Tan, Xiapu Luo, Min Yang, Siyi Chen.
    In IEEE Transactions on Information Forensics and Security, 2025. (CCF-A)

  • TSE'25 PHPJoy: A Novel Extended Graph-based PHP Code Analysis Framework
    Youkun Shi, Yuan Zhang, Tianhan Luo, Guangliang Yang, Shengke Ye, Chengyu Yang, Fengyu Liu, Xiapu Luo, Min Yang.
    In IEEE Transactions on Software Engineering, 2025. (CCF-A)