Projects

Projects are grouped by research area. Open each project card to read deeper findings and citation details.

DNS

Internet-scale DNS measurements, deployment trends, and protocol behavior.

1 project

Project 1 of 1

Exploring the Ecosystem of DNS HTTPS Resource Records: An End-to-End Perspective

Topic and venue

IMC 2024 DNS HTTPS Measurement

Authors

Hongying Dong, Yizhe Zhang, Hyeonmin Lee, Shumon Huque, Yixin Sun

BibTex ↓

Summary

In this research, we investigated the adoption and management of DNS HTTPS records on both the server side (i.e., domains) and client side (i.e., web browsers). Specifically, we found that over 20% of Tranco’s top 1 million domains had DNS HTTPS records between May 2023 and March 2024, and major browsers utilize these records when establishing connections. Despite this growing adoption, our findings highlight challenges such as the proper maintenance of DNS HTTPS records and browser connection failures caused by misconfigurations.

Artifacts

We provide DNS HTTPS record datasets collected through daily scans of the Tranco Top 1 Million domains, along with code to reproduce the figures presented in our paper and scripts used for data collection.

💻

Code

Code to reproduce figures and scripts used to collect DNS data for Tranco domains.

Reproducing Figures

Use parsed data in data/parsed/ or plotting data in data/plotting/. Open the Jupyter notebooks in notebooks/ to generate the figures.

Data Collection

Scripts for issuing DNS queries and testing TLS connection establishment behavior, including mismatched IP cases.

GitHub (Analysis & Plots) GitHub (Data Collection)
📊

Dataset

Parsed DNS HTTPS measurements collected daily from our measurement server and released monthly.

Included Records

  • HTTPS (and RRSIG if available)
  • A, AAAA
  • NS, SOA

Daily CSV Files

  • apex_https.csv, www_https.csv
  • apex_flags.csv, www_flags.csv
ADQRRDRA CDAATC

Additional details are available. Expand sections below.

If you find this work helpful, please cite the paper

TLS/PKI

Certificate ecosystems, trust chains, and privacy implications in real deployments.

3 projects

Project 1 of 3

Inside Certificate Chains Beyond Public Issuers: Structure and Usage Analysis from a Campus Network

Topic and venue

IMC 2025 Certificate Chain Analysis

Authors

Hongying Dong, Yizhe Zhang, Hyeonmin Lee, Yixin Sun

BibTex ↓

Summary

We conduct research on TLS certificate chains issued by non-public issuers (absent from major browser root stores and the CCADB). Using one year of campus network traffic—259.3M TLS connections and 731,175 chains—we analyze how these chains are structured and deployed. We find unnecessary certificates frequently appear, causing inconsistent validation outcomes across clients, and observe a shift toward automated certificate management such as Let’s Encrypt.

Artifacts

📦

Dataset

Due to the sensitive nature of campus traffic, datasets are not publicly shared.

💻

Code

Code available on GitHub.

View on GitHub →

Additional details are available. Expand sections below.

If you find this work helpful, please cite the paper

Project 2 of 3

Mutual TLS in Practice: A Deep Dive into Certificate Configurations and Privacy Issues

Topic and venue

IMC 2024 Mutual TLS

Authors

Hongying Dong, Yizhe Zhang, Hyeonmin Lee, Kevin Du, Guancheng Tu, Yixin Sun

BibTex ↓

Summary

We analyze 1.2B mutual TLS connections over 23 months (2.2M server certs, 3.4M client certs). Findings cover security concerns, non-standard certificate sharing, and privacy-sensitive information embedded in certificates.

Artifacts

Code for privacy analysis in Section 6 of the paper.

Classifying information in CN and SAN

📦

Prerequisites

  • CCADB: Used to check issuer names (CSV export).
  • spaCy NER: Model en_core_web_trf-3.7.3.
  • Company datasets: BigPicture 2023 Q4 and People Data Labs 2019 lists.
💻

Code

Repository with analysis scripts.

GitHub Repository →

Some parameters/functions adjusted to protect sensitive campus data.

▶️

How to Run

  • Download prerequisites and analysis_code.py.
  • Set paths: 
    SPACY_NER_PATH = "/path/to/en_core_web_trf-3.7.3/"
CCADB_PATH = "/path/to/AllCertificateRecordsReport.csv"
COMPANY_DATA1_PATH = "/path/to/companies-2023-q4-sm.csv"
COMPANY_DATA2_PATH = "/path/to/companies_sorted.csv"
COMPANY_SIM_SEED_PATH = "/path/to/company_sim_seed.csv"
NER_SEED_PATH = "/path/to/ner_seed.csv"
  • Load datasets (raw data not provided): 
    def load_certificate_data():
    path = "/path/to/certificate_dataset"
    # df = load data with pandas
    return df
  • Run script to produce counts of each information type.
🔒

Dataset Availability

Raw certificate data and other artifacts are not public due to sensitive campus information.

Additional details are available. Expand sections below.

If you find this work helpful, please cite the paper

Project 3 of 3

Behind the Scenes: Uncovering TLS and Server Certificate Practice of IoT Device Vendors in the Wild

Topic and venue

IMC 2023 IoT TLS Analysis

Authors

Hongying Dong, Hao Shu, Vijay Prakash, Yizhe Zhang, Muhammad Talha Paracha, David Choffnes, Santiago Torres-Arias, Danny Yuxing Huang, Yixin Sun

BibTex ↓

Summary

In this research, we conducted a quantitative analysis of TLS/PKI deployment in the IoT context, identifying associated security concerns. By measuring the sharing of TLS instances across IoT vendors and devices, we revealed a widespread use of highly customized TLS libraries that do not correspond to any known TLS implementations, posing potential security risks due to co-located TLS stacks from different services. Additionally, we performed the first known study on server-side certificate management for servers accessed by IoT devices. Our findings underscore critical issues in the TLS/PKI practices of IoT vendors and serve as a call to action, aiming to raise awareness of these security challenges within the broader IoT ecosystem.

Additional details are available. Expand sections below.

If you find this work helpful, please cite the paper

Others

Additional directions such as routing, attack detection, and anonymous communications.

3 sections

Section 1 of 3

Internet Routing

Focus

BGP SCION

Summary

We work on both the de facto interdomain routing protocol BGP as well as next-generation network architecture SCION. Our work spans BGP attacks, BGP measurement, and SCION-based deployment, including the SBAS and SCIERA systems.

Papers

Each paper card keeps related deployment or artifact information directly alongside the citation.

Under Submission

BGP community measurement project

Section 2 of 3

Anonymous Communications

Focus

Tor Traffic Analysis

Summary

We work on Tor, the anonymous communication system. We investigate Tor's resilience against passive adversaries in the network who can observe traffic metadata and perform traffic analysis to deanonymize users. We consider adversaries in the Internet backbone, such as AS-level observers who can see TCP/IP headers, and in wireless networks, such as parties inside the cellular backbone who can observe layer-2 cellular data.

Papers

Under Submission

Traffic correlation with layer-2 adversaries

Section 3 of 3

Anomaly Detection

Focus

Network Security Detection Systems

Summary

We build anomaly detection frameworks using network and system logs across environments such as campus networks and enterprise networks.

Papers