Haixin Duan

Dr. Haixin Duan is a professor at the Institute for Network Sciences and Cyberspace, Tsinghua University. He was once a visiting scholar at UC Berkeley and a senior scientist in International Computer Science Institute(ICSI). Prof. Duan has been working on network security for more than 20 years. His recent research interests include protocol security, intrusion detection, underground economy detection and Internet Governance. Some of his research results were deployed by some big IT companies like Baidu and Huawei. Many of his research papers have been accepted by top security conferences like Security & Privacy, USENIX Security, CCS and NDSS.

Research Areas: Network security Research Interests: DNS Security, Web Security, Intrusion Detection, Anonymous communication

Teaching * Network security fundamental, for undergraduates in Tsinghua University, 2003-present * Network and system Security, for graduate in Tsinghua University, 2005-present Appointments * Professor, Network Research Center (now Institute for Network Science and Cyberspace) of Tsinghua University, Beijing, China, 2009–. * Visiting Scholar, International Computer Science Institute(ICSI) at UC Berkeley, CA, 2011–2013. * Associate Professor, Tsinghua University, 2003–2009. * Assistant Professor, Tsinghua University, 2001–2003. * Part time Research Assistant in CERNET NOC, Beijing. 1996–2000. Education * Tsinghua University, Beijing, China Computer Science, Ph.D., 2000 * Harbin Institute of Technology, Heilongjiang, China. Computer Science, M.S., 1996 * Harbin Institute of Technology, Heilongjiang, China. Computer Science, B.S., 1994 ** Selected Projects** * PI, The spread model and response of malicious mobile code in the Internet, sponsored by National Science Foundation of China(NSFC), 2003-2006 * PI, Collaborative response service for large scale network security incidents, sponsored by Hi-Tech program(863) of Ministry of Science and Technology 2005-2007 * PI, Trustworthy Internet architecture, sponsored by basic research program (973) of Ministry of Science and Technology 2005-2009 * PI, Automatic analysis system of malware, sponsored by 242 program from Ministry of Industry and Information Technology(MIIT), 2007-2008

Publication * X. Zheng, C. Lu, J. Peng, Q. Yang, D. Zhou, B. Liu, K. Man, S. Hao, H. Duan, Z. Qian. Poison Over Troubled Forwarders: A Cache Poisoning Attack Targeting DNS Forwarding Devices, Accepted by USENIX Security 2020

• Yiming Zhang, Baojun Liu, Chaoyi Lu, Zhou Li, Haixin, Shuang Hao, Mingxuan Liu, Ying Liu, Dong Wang, Qian Li. Lies in the Air: Characterizing Fake-base-station Spam Ecosystem in China, Accepted by CCS 2020

• Weizhong Li, Kaiwen Shen, Run Guo, Baojun Liu, Jia Zhang, Haixin Duan, Shuang Hao, Xiarun Chen, Yao Wang. CDN Backfired: Amplification Attacks Based on HTTP Range Requests, DSN 2020 (best paper nominee). PDF download

• Run Guo, Weizhong Li, Baojun Liu, Shuang Hao, Jia Zhang, Haixin Duan, Kaiwen Shen, Jianjun Chen, Ying Liu. CDN Judo: Breaking the CDN DoS Protection with Itself, NDSS 2020. PDF download

• Kun Du, Hao Yang, Zhou Li, Haixin Duan, Shuang Hao and etc. TL; DR Hazard: A Comprehensive Study of Levelsquatting Scams, International Conference on Security and Privacy in Communication Systems, 2019

• Chaoyi Lu, Baojun Liu, Zhou Li, Shuang Hao, Haixin Duan, Mingming Zhang, Chunying Leng, Ying Liu, Zaifeng Zhang, Jianping Wu, An End-to-End, Large-Scale Measurement of DNS-over-Encryption: How Far Have We Come? ACM Internet Measurement Conference, 2019 PDF download

• Baojun Liu, Zhou Li, Peiyuan Zong, Chaoyi Lu, Haixin Duan, Ying Liu, Sumayah Alrwais, Xiaofeng Wang, Shuang Hao, Yaoqi Jia, Yiming Zhang, Kai Chen, Zaifeng Zhang. 4th IEEE European Symposium on Security and Privacy (EuroS&P’19). 4th IEEE European Symposium on Security and Privacy, 2019

• Jia Zhang, Haixin Duan, Jian Jiang, Jinjin Liang, Jianping Wu. Finding the best answer: measuring the optimization of public and authoritative DNS. 2019

• Run Guo, Jianjun Chen, Baojun Liu, Jia Zhang, Chao Zhang, Haixin Duan, Tao Wan, Jian Jiang, Shuang Hao, Yaoqi Jia. Abusing CDNs for Fun and Profit: Security Issues in CDNs’ Origin Validation. IEEE 37th Symposium on Reliable Distributed Systems (SRDS), 2018

• Kun Yang, Yuan Deng, Chao Zhang, Jianwei Zhuge, Haixin Duan, ICUFuzzer: Fuzzing ICU Library for Exploitable Bugs in Multiple Software, International Conference on Information Security, 2018

• Baojun Liu, Chaoyi Lu, Zhou Li, Ying Liu, Hai-Xin Duan, Shuang Hao, Zaifeng Zhang. A Reexamination of Internationalized Domain Names: The Good, the Bad and the Ugly. Dependable Systems and Networks, 2018

• Jian Jiang, Jia Zhang, Haixin Duan, Kang Li, Wu Liu. Analysis and Measurement of Zone Dependency in the Domain Name System, IEEE International Conference on Communications (ICC), 2018

• Fuqing Chen, Haixin Duan, Xiaofeng Zheng, Jian Jiang, Jianjun Chen, Path Leaks of HTTPS Side-Channel by Cookie Injection. International Workshop on Constructive Side-Channel Analysis and Secure Design , 2018

• Jianjun Chen, Jian Jiang, Haixin Duan, Tao Wan, Shuo Chen, Vern Paxson, Min Yang. We Still Don’t Have Secure Cross-Domain Requests: an Empirical Study of CORS, 27th USENIX Security Symposium, 2018

• Baojun Liu, Chaoyi Lu, Haixin Duan, Ying Liu, Zhou Li, Shuang Hao, Min Yang, Who is answering my queries: Understanding and characterizing interception of the {DNS} resolution path. 27th USENIX Security Symposium, 2018

• Mingming Zhang, Baojun Liu, Chaoyi Lu, Jia Zhang, Shuang Hao, Haixin Duan, Measuring Privacy Threats in China-Wide Mobile Networks. 8th USENIX Workshop on Free and Open Communications on the Internet (FOCI), 2018

• Hao Yang, Xiulin Ma, Kun Du, Zhou Li, Haixin Duan*, Xiaodong Su, Guang Liu, Zhifeng Geng, and Jianping Wu. How to Learn Klingon Without a Dictionary: Detection and Measurement of Black Keywords Used by the Underground Economy , IEEE Symposium on Security & Privacy, 2017

• Jianjun Chen, Jian Jiang, Haixin Duan, Nick Weaver, Tao Wan, Vern Paxson. Host of Troubles: Multiple Host Ambiguities in HTTP Implementations, CCS 2016

• Kun Du, Hao Yang, Zhou Li, Haixin Duan(*), Kehuan Zhang. The Ever-changing Labyrinth: A Large-scale Analysis of Wildcard DNS Powered Blackhat SEO, USENIX Security 2016

• Xiaojing Liao,Kan Yuan, Xiaofeng Wang(), Zhongyu Pei,Hao Yang, Jianjun Chen, Haixin Duan(), Kun Du, Eihal Alowaisheq, Sumayah Alrwais, Luyi Xing, Raheem Beyah, Seeking Nonsense, Looking for Trouble: Efficient Promotional­ Infection Detection through Semantic Inconsistency Search, IEEE Symposium on Security & Privacy, San Jose, California. May 23-26, 2016

• Jianjun Chen, Jian Jiang, Xiaofeng Zheng, Haixin Duan(*), Jinjin Liang, Tao Wan, Kang Li, Vern Paxson, Forwarding-Loop Attacks in Content Delivery Networks, NDSS 2016

• Song Li, Haixin Duan(*), Zhiliang Wang, and Xing Li, Route Leaks Identification by Detecting Routing Loops, SecureComm 2015(11th EAI International Conference on Security and Privacy in Communication Networks)

• Xiaofeng Zheng, Jian Jiang, Jinjin Liang, Haixin Duan, Shuo Chen, Tao Wan, Nicholas Weaver, Cookies lack integrity: real world implications, USENIX Security, 2015.

• Hongyu Gao, Vinod Yegneswaran, Jian Jiang, Yan Chen, Member, IEEE, Phillip Porras, Shalini Ghosh, Haixin Duan, Reexamining DNS from a Global Recursive Resolver Perspective, to appear in IEEE/ACM TRANSACTIONS ON NETWORKING

• Jinjin Liang, Jian Jiang, Haixin Duan, Kang Li, Tao Wan, Jianping Wu. “When HTTPS Meets CDN: A Case of Authentication in Delegated Service” Accepted by IEEE Symposium on Security & Privacy, 2014.

• Kun Yang, Lujue Zhou, Yongke Wang, Jianwei Zhuge and Haixin Duan. “IntentFuzzer: Detecting Capability Leaks of Android Applications”, Accepted by ASIACCS 2014

• H. Gao, V. Yegneswaran, Y. Chen, P. Porras, S. Ghosh, J. Jiang, and H. Duan, “An empirical reexamination of global DNS behavior,” SIGCOMM, 2013. PDF

• Man Hou, Haixin Duan,Jian Jiang, Jinjin Liang,Yan Ma, 中美银行网站HTTPS部署的测量与对比分析(Measurement and comparison of HTTPS deployment of Banking Websites in China and America), VARA 2013

• Jinjin Liang, Jian Jiang, Haixin Duan, Kang Li and Jianping Wu, Measuring Query Latency of Top Level DNS Servers, 14th Passive and Active Measurement conference, Mar. 2013, Hongkong

• J. Zhuge*, L. Gu, H. Duan, Investigating China’s Online Underground Economy. Conference on the Political Economy of Information Security in China, San Diego, US, Apr, 2012.

• Haixin Duan, Nicholas Weaver, Zongxu Zhao, Meng Hu, Jinjin Liang, Jian Jiang, Kang Li and Vern Paxson, Hold-On: Protecting Against On-Path DNS Poisoning, Securing and Trusting Internet Names, SATIN 2012.

• J. Jian, L. Jinjin, L. Kang, L. Jun, D. Haixin, W. Jianping, Ghost Domain Names: Revoked Yet Still Resolvable, 19th Annual Network & Distributed System Security Symposium (NDSS), 5-8 February 2012.

• Z. Jia, D. Haixin, L. Wu, W. Jianping WindTalker: A P2P-Based Low-Latency Anonymous Communication Network, IEICE Transactions on Communications, VOL. E92-B, NO.10, pp. 3183–3194, 2009.

• L. Wu, D. Haixin, L. Tao, L. Xing, W. Jianping. H6Proxy: ICMPv6 Weakness Analysis and Implementation of IPv6 Attacking Test Proxy, Cybercrime and Trustworthy Computing (CTC), Brisbane, Australia, 2009.

• L. Wu, D. Haixin, R. Ping, W. Jianping, Intrusion Detection Using SVM, Proc. IEEE 7th International Confer- ence on Wireless Communications (WiCOM), Wuhan, China, 2011.

• W. Lanjia, D. Haixin, L. Xing, Port scan behavior diagnosis by clustering, Proc. Information and communica- tion security, vol. 3783, pp. 243–255, 2005.

• Z. Jia, G. Yuntao, J. Xiaoxin, D. Haixin, W. Jianping, AMCAS: An Automatic Malicious Code Analysis System, Proc. 9th International Conference on Web-Age Information Management (WAIM) IEEE Computer Society Washington, DC, USA, 2008. Z.Jia,D.Haixin,W.Lanjia,AFastMethodofSignatureGenerationforPolymorphicWorms,Proc.International Conference on Computer and Electrical Engineering (ICCEE), Phuket, Thailand, 2009.

• L. Xing, D. Haixin, L. Xing, Identification of P2P traffic based on the content redistribution characteristic, Proc. International Symposium on Communications and Information Technologies (ISCIT), 2007.

• Y. Feng, D. Haixin, L. Xing. Modeling and analyzing of the interaction between worms and antiworms during network worm propagation, Science in China, Series F (Information Sciences), vol. 48, pp. 91–106, 2005.

• L. Xuefeng, D. Haixin, L., Wu, W. Jianping. Understanding the Construction Mechanism of Botnets, Proc. IEEE Symposia and Workshops on Ubiquitous, Autonomic and Trusted Computing (UIC/ATC), 2009.