李想

清华大学博士研究生（网络空间安全）

个人简介

李想，清华大学网络科学与网络空间研究院五年级博士研究生，导师为李琦副教授和段海新教授。他是网络与信息安全实验室（NISL）的成员之一，也是奇安信公司的安全研究实习生。他曾经作为访问学者在加州大学尔湾分校李洲助理教授研究组进行学术交流。此外，他也是一款开源网络扫描器XMap的开发者与维护者（306+ GitHub stars）。研究领域涉及网络安全、协议安全、IPv6安全、DNS安全、互联网测量、网络协议fuzzing、网络漏洞挖掘与攻击以及黑灰产检测。目前已发表17篇学术论文。作为第一作者，他目前在网络安全四大顶级会议均有论文发表，涵盖Oakland S&P（2）、USENIX Security（1）、CCS（1）、NDSS（1），以及其它安全会议如DSN。作为通讯作者和合作作者，他也在网络顶级会议发表多篇论文，如USENIX Security、CCS、NDSS、SIGMETRICS、IMC。此外，他在工业界顶级安全会议也进行过演讲，如Black Hat（Asia、USA、Europe）。他经常参加相关会议讨论分享最近的研究进展，如IDS、OARC、VehicleSec。在漏洞挖掘领域，他目前已发现多个IPv6和DNS方向的新型重大漏洞并获得190+安全漏洞编号（CVE/CNVD），其中所发现的IPv6漏洞影响了数十家路由器厂商。他也发现了DNS协议设计和实现层面的漏洞，影响了所有DNS的软件和实现。目前他已经获得了多家知名互联网厂商的致谢和奖励（超过$11.6k），包括谷歌、微软、Cloudflare、Akamai等公司，奥地利政府CERT每日安全公告，瑞典政府CERT每周安全公告，伯恩茅斯大学CERT安全公告，60+科技媒体报道，并在积极推进网络协议标准的改进（相关工作已被纳入RFC文档）。他也获得了多个奖励荣誉，如IPv6创新大赛一等奖、GeekCon国际安全极客大赛亚军、王大中奖学金、博士研究生国家奖学金、清华优秀奖学金等。

论文

📑 论文发表

总数: 17
发表于安全顶会（12）: S&P (‘24a, ‘24b)、NDSS (‘23、‘24a、‘24b、‘24c)、USENIX Security (‘23a、‘23b、‘24a、‘24b)、CCS (‘23a、‘23b)
发表于其它会议（5）: DSN (‘21)、VehicleSec (‘23)、SIGMETRICS (‘23)、IMC (‘23)、NDSS Poster (‘24)
作为第一作者（6）: S&P (‘24a, ‘24b)、NDSS (‘23)、USENIX Security (‘23)、CCS (‘23)、DSN (‘21)
作为通讯作者（1）: USENIX Security (‘24)
作为第二作者（3）: SIGMETRICS (‘23)、CCS (‘23)、NDSS (‘24)

Qifan Zhang, Xuesong Bai, Xiang Li, Haixin Duan, Qi Li, Zhou Li (2024). ResolverFuzz: Automated Discovery of DNS Resolver Vulnerabilities with Query-Response Fuzzing. In Proceedings of the 33rd USENIX Security Symposium. Philadelphia, Pennsylvania, August 14–16, 2024. (Acceptance rate: ??%, Acceptance rate in summer: ??%, Acceptance rate in fall: ??%, Acceptance rate in winter: ??%).
* ✉ Both are corresponding authors.
* Presented in SHUZIHUANYU Talk.
* Presented in OARC 42.

PDF 引用代码项目

Yunyi Zhang, Baojun Liu, Haixin Duan, Min Zhang, Xiang Li, Fan Shi, Chengxi Xu, Eihal Alowaisheq (2024). Rethinking the Security Threats of xxx DNS xxx. In Proceedings of the 33rd USENIX Security Symposium. Philadelphia, Pennsylvania, August 14–16, 2024. (Acceptance rate: ??%, Acceptance rate in summer: ??%, Acceptance rate in fall: ??%, Acceptance rate in winter: ??%).

引用代码项目

Xiang Li, Dashuai Wu, Haixin Duan, Qi Li (2024). DNSBomb. In Oakland S&P ‘24. San Francisco, California, May 20–23, 2024. (Acceptance rate: ??%, Acceptance rate in first cycle: ??%, Acceptance rate in second cycle: ??%, Acceptance rate in third cycle: ??%).

引用代码项目

Xiang Li, Wei Xu, Baojun Liu, Mingming Zhang, Zhou Li, Jia Zhang, Deliang Chang, Xiaofeng Zheng, Chuhan Wang, Jianjun Chen, Haixin Duan, Qi Li (2024). TuDoor Attack: Systematically Exploring and Exploiting Logic Vulnerabilities in DNS Response Pre-processing with Malformed Packets. In Oakland S&P ‘24. San Francisco, California, May 20–23, 2024. (Acceptance rate: ??%, Acceptance rate in first cycle: ??%, Acceptance rate in second cycle: ??%, Acceptance rate in third cycle: ??%).
* Presented in OARC 42.
* Referenced by RFC 9520: Negative Caching of DNS Resolution Failures.

PDF 引用代码项目

Chuhan Wang, YASUHIRO KURANAGA, Yihang Wang, Mingming Zhang, Linkai Zheng, Xiang Li, Jianjun Chen, Haixin Duan, Yanzhong Lin, Qingfeng Pan (2024). BreakSPF: How Shared Infrastructures Magnify SPF Vulnerabilities Across the Internet. In NDSS ‘24. San Diego, California, 26 February – 1 March, 2024. (Acceptance rate: 104/694=15.0%, Acceptance rate in summer: 41/211=19.4%, Acceptance rate in fall: 63/483=13.0%).

引用项目

Qifan Zhang, Xuesong Bai, Xiang Li, Haixin Duan, Qi Li, Zhou Li (2024). Poster: ResolverFuzz: Automated Discovery of DNS Resolver Vulnerabilities with Query-Response Fuzzing. In NDSS ‘24. San Diego, California, 26 February – 1 March, 2024. (Acceptance rate: 33/42=78.6%).
* ✉ Both are corresponding authors.
* Presented in SHUZIHUANYU Talk.
* Presented in OARC 42.

PDF 引用代码项目

Linkai Zheng, Xiang Li, Chuhan Wang, Run Guo, Haixin Duan, Jianjun Chen, Chao Zhang, Kaiwen Shen (2024). ReqsMiner: Automated Discovery of CDN Forwarding Request Inconsistencies with Differential Fuzzing. In NDSS ‘24. San Diego, California, 26 February – 1 March, 2024. (Acceptance rate: 104/694=15.0%, Acceptance rate in summer: 41/211=19.4%, Acceptance rate in fall: 63/483=13.0%).

引用

Mingxuan Liu, Yiming Zhang, Xiang Li, Chaoyi Lu, Baojun Liu, Haixin Duan, Xiaofeng Zheng (2024). Understanding the Implementation and Security Implications of Protective DNS Services. In NDSS ‘24. San Diego, California, 26 February – 1 March, 2024. (Acceptance rate: 104/694=15.0%, Acceptance rate in summer: 41/211=19.4%, Acceptance rate in fall: 63/483=13.0%).

引用项目

Wei Xu, Xiang Li, Chaoyi Lu, Baojun Liu, Jia Zhang, Jianjun Chen, Tao Wan, Haixin Duan (2023). TsuKing: Coordinating DNS Resolvers and Queries into Potent DoS Amplifiers. In CCS ‘23. Copenhagen, Denmark, November 26–30, 2023. (Acceptance rate: ??%, Acceptance rate in first round: ??%, Acceptance rate in second round: ??%).
* ⓘ Both authors contributed equally to the paper.
* Presented in OARC 41.
* Presented in Black Hat Europe 2023.

PDF 引用代码项目

Zhenrui Zhang, Geng Hong, Xiang Li, Zhuoqun Fu, Jia Zhang, Mingxuan Liu, Chuhan Wang, Jianjun Chen, Baojun Liu, Haixin Duan, Chao Zhang, Min Yang (2023). Under the Dark: A Systematical Study of Stealthy Mining Pools (Ab)use in the Wild. In CCS ‘23. Copenhagen, Denmark, November 26–30, 2023. (Acceptance rate: ??%, Acceptance rate in first round: ??%, Acceptance rate in second round: ??%).
* ⓘ Both authors contributed equally to the paper.

PDF 引用代码项目

Fenglu Zhang, Yunyi Zhang, Baojun Liu, Eihal Alowaisheq, Lingyun Ying, Xiang Li, Zaifeng Zhang, Ying Liu, Haixin Duan, Min Zhang (2023). Wolf in Sheep's Clothing: Evaluating the Security Risks of the Undelegated Record on DNS Hosting Services. In IMC ‘23. Montréal, Canada on October 24 - 26, 2023. (Acceptance rate: 52/208=25.0%).

引用项目

Run Guo, Jianjun Chen, Yihang Wang, Keran Mu, Baojun Liu, Xiang Li, Chao Zhang, Haixin Duan, Jianping Wu (2023). Temporal CDN-Convex Lens: A CDN-Assisted Practical Pulsing DDoS Attack. In USENIX Security ‘23. Anaheim, California, August 9–11, 2023. (Acceptance rate: 422/1,444=29.2%, Acceptance rate in summer: 91/388=23.5%, Acceptance rate in fall: 155/531=29.2%, Acceptance rate in winter: 176/525=33.5%).

PDF 引用项目

Xiang Li, Chaoyi Lu, Baojun Liu, Qifan Zhang, Zhou Li, Haixin Duan, Qi Li (2023). The Maginot Line: Attacking the Boundary of DNS Caching Protection. In USENIX Security ‘23. Anaheim, California, August 9–11, 2023. (Acceptance rate: 422/1,444=29.2%, Acceptance rate in summer: 91/388=23.5%, Acceptance rate in fall: 155/531=29.2%, Acceptance rate in winter: 176/525=33.5%).
* Presented in Black Hat USA 2023.
* 60+ news coverage by media such as BleepingComputer and APNIC.
* An Austria government CERT daily report.
* A Sweden government CERT weekly news.
* A Bournemouth University (BU) CERT news.
* Presented in SHUZIHUANYU Talk.
* Presented in KANXUE 2023 SDC.
* Presented in Black Hat Webinar.

PDF 引用代码项目演示文稿源文档

Mingming Zhang, Xiang Li, Baojun Liu, Jianyu Lu, Jianjun Chen, Yiming Zhang, Xiaofeng Zheng, Haixin Duan, Shuang Hao (2023). DareShark: Detecting and Measuring Security Risks of Hosting-Based Dangling Domains. In SIGMETRICS ‘23. Orlando, Florida, June 19-23, 2023. (Acceptance rate: 55/342=16.1%, Acceptance rate in summer: 17/93=18.3%, Acceptance rate in fall: 26/119=21.9%, Acceptance rate in winter: 12/130=9.2%).
* Presented in OARC 40.
* Presented in APAC DNS Forum 2023 by Mr Alban KWAN.

PDF 引用演示文稿

Shangru Song, Hetian Shi, Ruoyu Lun, Yunchao Guan, Xiang Li, Jihu Zheng, Jianwei Zhuge (2023). Demo: Ransom Vehicle through Charging Pile. In VehicleSec 2023. San Diego, California, Feburary 27, 2023. (Acceptance rate: 32/83=36.0% (overall), 20/49=40.8% (regular), 2/6=33.3% (short), 6/16=37.5% (wpi), and 4/12=33.3% (demos/posters)).

PDF 引用海报演示文稿

Xiang Li, Baojun Liu, Xuesong Bai, Mingming Zhang, Qifan Zhang, Zhou Li, Haixin Duan, Qi Li (2023). Ghost Domain Reloaded: Vulnerable Links in Domain Name Delegation and Revocation. In NDSS ‘23. San Diego, California, 27 February – 3 March, 2023. (Acceptance rate: 94/581=16.2%, Acceptance rate in summer: 36/183=19.7%, Acceptance rate in fall: 58/398=14.6%).
* Presented in OARC 39.
* Presented in ICANN DNS Symposium 2022.
* Presented in Black Hat Asia 2023.
* Referenced by RFC Draft: Delegation Revalidation by DNS Resolvers.

PDF 引用代码项目演示文稿源文档 DOI

Xiang Li, Baojun Liu, Xiaofeng Zheng, Haixin Duan, Qi Li, Youjun Huang (2021). Fast IPv6 Network Periphery Discovery and Security Implications. In DSN ‘21. Taipei, Taiwan, June 21-24, 2021 (Virtually). (Acceptance rate: 48/279=17.2%).
* Presented in 2021 West Lake Cybersecurity Conference: Cyberspace Security Tools Presentation.
* Presented in Pentester Academy TV.
* Referenced by 10+ top-tier security conference papers.
* Supporting one patent CN202110502369.2.

PDF 引用代码项目演示文稿视频

项目

代码与程序

网络扫描器：XMap

XMap 是一款兼含 IPv6 与 IPv4 网络空间探测功能的快速扫描器。

动态

🎡 部分动态

学术界会议: DSN (‘21)、CCS (‘22)、VehicleSec (‘23)、NDSS (‘23)、USENIX Security (‘23)、AEGIS (‘23)
工业界会议: ICANN DNS Symposium (IDS ‘21、‘22)、DNS-OARC (39、40、41、42a、42b)、Black Hat (Asia ‘23、USA ‘23, Europe ‘23)、GeekCon (‘23)

李想

12月 6, 2023 12:00 AM — 11:59 PM EXCEL LONDON

黑帽大会2023（欧洲）

在黑帽大会2023（欧洲）上, 段海新教授分享了我们的研究工作：“TsuKing: Coordinating DNS Resolvers and Queries into Potent DoS Amplifiers”。

李想

10月 24, 2023 9:00 AM — 9:00 PM B2, WEST BUND ART CENTRE

新极棒 2023

在新极棒 2023比赛中，我演示我们在DNS安全方面的最新研究成果：利用某种未知缺陷实现对任意网站的拒绝服务攻击（大四学弟吴大帅共同参赛，组建TNB团队），最后取得了GEEKCON 2023安全极客大赛“漏洞与利用DAF挑战赛”的亚军。

李想

10月 23, 2023 12:00 AM — 11:59 PM 上海龙之梦大酒店

看雪开发者峰会 2023

在看雪开发者峰会 2023，段海新教授分享了我们的工作：MaginotDNS 攻击——跨越域名解析器的缓存防御“护城河”。

李想

10月 11, 2023 7:00 AM — 10月 12, 2023 11:00 PM Microsoft Campus

受邀参加第21届BlueHat 2023

在8月18日，受邀参加第21届BlueHat 2023。

李想

9月 13, 2023 6:00 PM — 7:00 PM Online workshop

数字寰宇大家讲堂 2023

在数字寰宇大家讲堂 2023（在线），我分享了MaginotDNS攻击。

Fenglu Zhang

9月 6, 2023 — 9月 7, 2023 Hybrid in-person and online workshop (Meliá Danang Beach Resort)

OARC 41 & ICANN DNS Symposium 2023

在 OARC 41 & ICANN DNS Symposium 2023会议上（线上线上相结合），丰露代替我演示了TsuKing攻击。十分感谢！

李想

8月 26, 2023 8:00 AM — 9:00 AM Online workshop

2nd AEGIS Workshop

在第二届 AEGIS Workshop中（线上），我分享了最新的研究工作不死域名。

李想

8月 10, 2023 7:00 AM — 11:00 PM Mandalay Bay Convention Center, Las Vegas / Virtually

受邀参加 MSRC's Researcher Celebration at Black Hat USA 2023

在2023年7月11日，受邀参加 MSRC’s Researcher Celebration at Black Hat USA 2023。

李想

8月 10, 2023 12:00 AM — 11:59 PM Anaheim Marriott

2023年第32届USENIX安全探讨会｜USENIX Security 2023

在2023年第32届USENIX安全探讨会上，我分享了最新研究工作：“The Maginot Line: Attacking the Boundary of DNS Caching Protection”，也见到和交到了很多朋友。

李想

8月 9, 2023 12:00 AM — 11:59 PM MANDALAY BAY CONVENTION CENTER

黑帽大会2023（美国）

在黑帽大会2023（美国）上, 李洲助理教授分享了我们的研究工作：“The Maginot Line: Attacking the Boundary of DNS Caching Protection”。

李想

5月 11, 2023 12:00 AM — 5月 12, 2023 11:59 PM MARINA BAY SANDS

黑帽大会2023（亚洲）

在黑帽大会2023（亚洲）上, 我分享了研究工作：“Phoenix Domain Attack: Vulnerable Links in Domain Name Delegation and Revocation”。

李想

2月 27, 2023 12:00 AM — 3月 3, 2023 11:59 PM Catamaran Resort Hotel & Spa

2023年第30届网络与分布式系统安全会议 | NDSS 2023

在2023年第30届网络与分布式系统安全会议上，我分享了我们关于DNS最新的研究工作（Ghost Domain Reloaded: Vulnerable Links in Domain Name Delegation and Revocation）以及诸葛老师组的展板（Demo: Ransom Vehicle through Charging Pile）。开会期间，见到了去年在我们组访问的秦悦（和悦姐畅聊！），也认识了很多新朋友和老师。最后，代替杨家海老师团队领取了最佳论文奖（1/2），很厉害的工作，感受了领奖的氛围。