My research focuses on AI-enabled cybersecurity and intelligent cyber space sensing. I investigate fundamental challenges in complex network environments, including security detection, network measurement, and infrastructure security, aiming to enhance cyber space awareness and defense capabilities through artificial intelligence, network analytics, and active measurement techniques.

1. Intelligent Network Security Detection

Key Question: How can we discover hidden attacks from seemingly normal network behaviors?

As cyber attacks become increasingly stealthy, attackers can hide their intentions behind encrypted communications, multi-stage attack campaigns, and legitimate network services. Traditional rule-based detection approaches face significant challenges in identifying emerging and sophisticated threats.

This direction studies how to discover abnormal behaviors and attack indicators from large-scale, multi-source, and encrypted network data. Our research focuses on:

• Encrypted traffic analysis and intelligent detection;

• APT behavior discovery and covert channel detection;

• IoT and wireless network security defense.

Our results have been published in USENIX Security, IEEE TDSC, NDSS, and other top-tier security conferences and journals. Some of these achievements have received the First Prize of Shaanxi Provincial Science and Technology Progress Award.

2. Network Measurement and Intelligent Sensing

Key Question: How can we continuously sense the ever-changing global Internet?

The Internet continues to expand with the rapid evolution of devices, protocols, and services. Accurately understanding the state of cyberspace at large scale remains a fundamental challenge.

This direction investigates intelligent measurement and analysis methods for large-scale network environments, with a focus on:

• Network performance and user experience sensing;

• Internet-scale probing and infrastructure mapping;

• Network device discovery and behavior analysis.

Our research combines passive measurement and active probing techniques to understand network behaviors, discover Internet assets, and identify abnormal activities. The results have been published in IEEE/ACM Transactions on Networking (TON), IEEE INFOCOM, and other leading conferences and journals. Some achievements have received the Huawei Spark Award for Solving Technical Challenges.

3. DNS and Network Infrastructure Security

Key Question: How can we discover and defend against emerging attacks targeting Internet core infrastructures?

Core Internet infrastructures, such as DNS and transport protocols, are fundamental to modern Internet operations. However, their openness, complexity, and large-scale deployment also introduce new security risks.

This direction investigates security issues in Internet core protocols, focusing on:

• DNS attack analysis and risk measurement;

• Detection and defense of reflection amplification attacks;

• Security enhancement of emerging network protocols.

Our results have been published in ACM CCS, IEEE TIFS, IEEE/ACM TON, and other top-tier security conferences and journals. Some achievements have received the First Prize of China Electronics Society Science and Technology Progress Award.