Qinying Wang

Postdoctoral Researcher

EPFL

About Me

I am a postdoctoral researcher at HexHive, EPFL, advised by Prof. Mathias Payer. I earned my Ph.D. with honour at Zhejiang University in 2024, advised by Prof. Shouling Ji. During my Ph.D., I was fortunate to collaborate with Prof. Yuan Tian (UCLA), and benefited from her regular guidance. Prior to that, I earned my bachelor’s degree with honour at Hunan University in 2018.

I am broadly interested in software and system security, with a particular focus on IoT security. My recent research centers around developing innovative technologies to understand and mitigate risks in modern and emerging systems. This includes IoT messaging protocols, embedded systems, bootloader, OS kernels, and trusted execution environments.

Recent News

[02/12/2025] Our paper was accepted by TOSEM!
[02/12/2025] Our paper was accepted by NDSS 2026!
[09/09/2025] Our paper was accepted by IEEE S&P 2026!
[14/08/2025] Our paper was accepted by NDSS 2026!
[11/07/2025] Qinying was invited to serve on the PC for USENIX Security' 26!
[09/07/2025] Qinying was invited to serve on the PC for IEEE EuroS&P' 26!
[03/04/2025] Qinying was invited to serve on Oakland 2025 Poster PC!

Interests

Software and system security
IoT security
Social issues and security

Education

Ph.D. in Cyberspace Security, 2024
Zhejiang University
Visiting Ph.D. Student, 2022 - 2023
EPFL
B.E. in Information Security, 2018
Hunan University

Publications

Gaoning Pan, Yiming Tao, Qinying Wang, Chunming Wu, Mingde Hu, Yizhi Ren, Shouling Ji (2026). Breaking Isolation: A New Perspective on Hypervisor Exploitation via Cross-Domain Attacks. NDSS 2026. CCF-A

Jiacheng Xu, He Sun, Shihao Jiang, Qinying Wang, Mingming Zhang, Xiang Li, Kaiwen Shen, Peng Cheng, Jiming Chen, Chao Zhang, Shouling Ji (2025). A Survey of Operating System Kernel Fuzzing. TOSEM 2025. CCF-A

Jianqiang Wang, Yi Xiang, Meng Wang, Qinying Wang, Ali Abbasi, Thorsten Holz (2025). SmuFuzz: Enable Deep System Management Mode Fuzzing in Fully Featured UEFI Runtime Environment. IEEE S&P 2026. CCF-A

Yuan Chen, Qinying Wang, Yong Yang, Yuanchao Chen, Yuwei Li, Shouling Ji (2025). Unveiling Security Vulnerabilities in Git Large File Storage Protocol. IEEE S&P 2025. CCF-A Distinguished Paper Award

Zezhong Ren, Han Zheng, Zhiyao Feng, Qinying Wang, Marcel Busch, Yuqing Zhang, Chao Zhang, Mathias Payer (2025). Sysyphuzz: the Pressure of More Coverage. NDSS 2026. CCF-A

Jianqiang Wang, Meng Wang, Qinying Wang, Nils Langius, Li Shi, Ali Abbasi, Thorsten Holz (2025). A Comprehensive Memory Safety Analysis of Bootloaders. NDSS 2025. CCF-A

PDF Code Slides

Jianqiang Wang, Qinying Wang, Tobias Scharnowski, Li Shi, Simon Woerner, Thorsten Holz (2025). AidFuzzer: Adaptive Interrupt-Driven Firmware Fuzzing via Run-Time State Recognition. 34th USENIX Security Symposium (USENIX Security). CCF-A

Qinying Wang, Jiacheng Xu, Yuwei Li, Zulie Pan, Yuqing Zhang, Chao Zhang, Shouling Ji (2024). A Review of Smart Fuzzing: Problem Exploration and Method Classification. Chinese Journal of Computers. CCF-A in Chinese

Han Bao, Xuhong Zhang, Qinying Wang, Kangming Liang, Zonghui Wang, Shouling Ji, Wenzhi Chen (2024). Pluggable Watermarking of Deepfake Models for Deepfake Detection. the 33rd International Joint Conference on Artificial Intelligence (IJCAI). CCF-A

Florian Hofhammer, Marcel Busch, Qinying Wang, Manuel Egele, Mathias Payer (2024). SURGEON: Performant, Flexible, and Accurate Re-Hosting via Transplantation. Workshop on Binary Analysis Research (BAR'24), Distinguished Paper Award

Jiacheng Xu, Xuhong Zhang, Shouling Ji, Yuan Tian, Binbin Zhao, Qinying Wang, Peng Cheng, Jiming Chen (2023). MOCK: Optimizing Kernel Fuzzing Mutation with Context-aware Dependency. NDSS 2024. CCF-A

Qinying Wang, Boyu Chang, Shouling Ji, Yuan Tian, Xuhong Zhang, Binbin Zhao, Gaoning Pan, Chenyang Lyu, Mathias Payer, Wenhai Wang, Raheem Beyah (2023). SyzTrust: State-aware Fuzzing on Trusted OS Designed for IoT Devices. IEEE S&P 2024. CCF-A

Chenyang Lyu, Jiacheng Xu, Shouling Ji, Xuhong Zhang, Qinying Wang, Binbin Zhao, Gaoning Pan, Wei Cao, Peng Chen, Raheem Beyah (2023). MINER: A Hybrid Data-Driven Approach for REST API Fuzzing. 32nd USENIX Security Symposium (USENIX Security). CCF-A

Binbin Zhao, Shouling Ji, Xuhong Zhang, Yuan Tian, Qinying Wang, Yuwen Pu, Chenyang Lyu, Raheem Beyah (2023). UVSCAN: Detecting Third-Party Component Usage Violations in IoT Firmware. 32nd USENIX Security Symposium (USENIX Security). CCF-A

Binbin Zhao, Shouling Ji, Jiacheng Xu, Yuan Tian, Qiuyang Wei, Qinying Wang, Chenyang Lyu, Xuhong Zhang, Changting Lin, Jingzheng Wu, Raheem Beyah (2022). One Bad Apple Spoils the Barrel: Understanding the Security Risks Introduced by Third-Party Components in IoT Firmware. IEEE Transactions on Dependable and Secure Computing. CCF-A

PDF Dataset Slides

Shouling Ji, Qinying Wang, Anying Chen, Binbin Zhao, Tong Ye, Xuhong Zhang, Jingzheng Wu, Yun Li, Jianwei Yin, Yanjun Wu (2022). State-of-the-Art Survey of Open-source Software Supply Chain Security. Journal of Software. CCF-A in Chinese

Binbin Zhao, Shouling Ji, Jiacheng Xu, Yuan Tian, Qiuyang Wei, Qinying Wang, Chenyang Lyu, Xuhong Zhang, Changting Lin, Jingzheng Wu, Raheem Beyah (2022). A Large-Scale Empirical Analysis of the Vulnerabilities Introduced by Third-party Components in IoT Firmware. ISSTA 2022. CCF-A

PDF Code Dataset Slides

Qinying Wang, Shouling Ji, Yuan Tian, Xuhong Zhang, Binbin Zhao, Yuhong Kan, Zhaowei Lin, Changting Lin, Shuiguang Deng, Alex X. Liu, Raheem Beyah (2021). MPInspector: A Systematic and Automatic Approach for Evaluating the Security of IoT Messaging Protocols. 30th USENIX Security Symposium (USENIX Security 2021). CCF-A

Experience

Visiting Ph.D. Student

HexHive, EPFL

Dec 2022 – Dec 2023 Lausanne, Switzerland