39 citations · 42 across the 9 of their papers we have counts for
12 papers
VeriRouter: Towards Verifiable LLM Routing
Mengyu Yao, Ziqi Zhang, Shaofei Li +4
Large language model (LLM) routers are increasingly deployed to optimize quality, latency, and cost through dynamic model selection and request rewriting. However, a compromised ro…
SysEvolve: An AI-native, safe, autonomous adversarial attack-defense co-evolutionary system
Yuhan Meng, Shaofei Li, Jionghao Huang +8
The rapid advancement of large language models (LLMs) has created a growing asymmetry in cybersecurity, where attack accelerates toward autonomous execution while defense remains p…
RangeFactory: Scalable Construction of Multi-Hop Cyber Ranges
Hanlin Jiang, Puyi Wang, Jiandong Jin +10
Real-world cyberattacks often require sustained progress across multiple hosts and network segments, making multi-hop cyber ranges essential infrastructure for studying and improvi…
STAIR: Effective Incident Response Using an End-to-End Agentic Planning Framework
Hanlin Jiang, Jionghao Huang, Shaofei Li +6
Incident response planning is critical for restoring compromised software systems. Existing AIOps methods automate fault diagnosis and remediation and adapt response using feedback…
Connect the Dots: Knowledge Graph-Guided Crawler Attack on Retrieval-Augmented Generation Systems
Mengyu Yao, Ziqi Zhang, Ning Luo +5
Stealing attacks pose a persistent threat to the intellectual property of deployed machine-learning systems. Retrieval-augmented generation (RAG) intensifies this risk by extending…
PromoGuardian: Detecting Promotion Abuse Fraud with Multi-Relation Fused Graph Neural Networks
Shaofei Li, Xiao Han, Ziqi Zhang +6
As e-commerce platforms develop, fraudulent activities are increasingly emerging, posing significant threats to the security and stability of these platforms. Promotion abuse is on…
When MCP Servers Attack: Taxonomy, Feasibility, and Mitigation
Weibo Zhao, Jiahao Liu, Bonan Ruan +2
Model Context Protocol (MCP) servers enable AI applications to connect to external systems in a plug-and-play manner, but their rapid proliferation also introduces severe security…
KnowHow: Automatically Applying High-Level CTI Knowledge for Interpretable and Accurate Provenance Analysis
Yuhan Meng, Shaofei Li, Jiaping Gui +2
High-level natural language knowledge in CTI reports, such as the ATT&CK framework, is beneficial to counter APT attacks. However, how to automatically apply the high-level knowled…
No Data? No Problem: Synthesizing Security Graphs for Better Intrusion Detection
Yi Huang, Shaofei Li, Yao Guo +3
Provenance graph analysis plays a vital role in intrusion detection, particularly against Advanced Persistent Threats (APTs), by exposing complex attack patterns. While recent syst…
Query Provenance Analysis: Efficient and Robust Defense against Query-based Black-box Attacks
Shaofei Li, Ziqi Zhang, Haomin Jia +3
Query-based black-box attacks have emerged as a significant threat to machine learning systems, where adversaries can manipulate the input queries to generate adversarial examples…
NODLINK: An Online System for Fine-Grained APT Attack Detection and Investigation
Shaofei Li, Feng Dong, Xusheng Xiao +6
Advanced Persistent Threats (APT) attacks have plagued modern enterprises, causing significant financial losses. To counter these attacks, researchers propose techniques that captu…
Are we there yet? An Industrial Viewpoint on Provenance-based Endpoint Detection and Response Tools
Feng Dong, Shaofei Li, Peng Jiang +8
Provenance-Based Endpoint Detection and Response (P-EDR) systems are deemed crucial for future APT defenses. Despite the fact that numerous new techniques to improve P-EDR systems…