Yuchen Zhou's research

[Hiring Ad]: Palo Alto Networks web security team is looking for a full time research engineer. Your job duty will consist of mostly research and some engineering work. Please contact me for more details (and send me your resume)!

This is Yuchen Zhou, currently working at Palo Alto Networks as a principal security researcher senior web security researcher web security researcher. I earned my Doctoral degree at University of Virginia, under advisor Prof. David Evans, with dissertation titled: Improving Security and Privacy of Integrated Web Applications.

Most of my Ph.D work are focused on improving the security and privacy of web application/third-party service. My internship mentor at Microsoft Research is Dr. Shuo Chen. I have so far published five first-author papers, four of which in top-tier conferences such as IEEE S&P (Oakland) and USENIX. Since joining Palo Alto Networks, I have primarily been working with my fellow colleagues such as Dr. Oleksii Starov to publish practicality-focused papers. For more details, please click on individual projects on the left side, or browse down the page for a brief introduction on each project.

By using light-weight browser instrumentation to catch dynamic behavior of JavaScripts, we can detect obfuscated cryptojacking JavaScripts, scams, and much more web-based threats by matching the observed behavior against set of rules and/or signatures.

Our paper will appear at WTMC 2019 (Workshop of IEEE S&P 2019).

We show in this project that passive DNS data clustering can be used in conjunction with seeded known malicious domains to discover new trendy campaigns such as Equifax leak and Hurricane Harvey relief scams.

Our paper appeared at RESEC 2018 (Workshop of ASIACCS 2018).

This project aims to detect malicious website campaigns by association of their usage of third-party analytics IDs. Our key observation here is that the adversary would intentionally or unintentionally reuse analytics IDs throughout their phishing/scam/malware campaigns, so that we can identify them once we have a limited pool of seed malicious URLs.

Our paper appeared in the security track of WWW 2018.

The ScriptInspector project helps web developers understand and monitor the behavior of embedded third-party JavaScripts on their websites. The instrumented Firefox browser records access to sensitive resources and visualizes them to web developers. Policy can be generated and enforced on popular scripts to rein in their runtime behavior.

Our paper appeared at Oakland (IEEE Security & Privacy) 2015.

SSOScan is an automated scanner of web applications for Single Sign-On (SSO) vulnerabilities. This tool requires no user interaction and revealed more than 300 authentication/authorization implementation bugs in high profile websites. Our paper is published at the 23rd USENIX Security Symoposium (2014).

The goal of Explicating SDKs project is to systematically uncover implicit assumptions that are important to applications' security properties, this work is published at the 22nd USENIX Security Symposium (2013). I did this project while I interned at Microsoft Research, and I had the great honor to work with two excellent researchers Shuo Chen (my mentor) and Rui Wang (my co-first author).

The goal of DOMinator is to build a browser that can enforce fine-grained access control policies for third-party JavaScripts. This work is published at ESORICS 11'.

This short paper is presented at W2SP 10' (co-hosted with Oakland 10'), and I looked at the history and current status of how well HTTP-only cookies are deployed, and give some suggestions about how future security works can improve themselves to achieve a higher deploy rate.