Yan Jia 贾岩

• 2024.1 – Present
  Associate Professor, Nankai University
  “100 Young Academic Leaders of Nankai University” · College of Cryptology and Cyber Science
• 2020.12 – 2023.12
  Lecturer · Postdoctoral Fellowship, Nankai University
  College of Cyber Science
• 2016.7 – 2020.12
  Ph.D. in Information Security, Xidian University
  Advised by Prof. Yuqing Zhang · RA at the National Computer Network Intrusion Protection Center, UCAS
• 2018.11 – 2020.7
  Joint Ph.D. Student, Indiana University Bloomington
  Mentored by Prof. XiaoFeng Wang and Prof. Luyi Xing
• 2015 – 2016
  Master Student in Crypto, Xidian University
• 2011 – 2015
  B.E. in Information Countermeasure Technology, Xidian University

• ISSRE'26KubeCap: A Framework for Capability Minimization in Kubernetes via Static Analysis and LLM-Assisted Rule Inference
  Yuhao Liu, Yingnan Zhou, Weijie Liu^#, Yan Jia^#, Zheli Liu
  IEEE International Symposium on Software Reliability Engineering, 2026
• TWEBPrevalent but Fragmented: Understanding the Scattered URL Navigation Interventions in Modern Web Clients
  Qingyin Tan, Yan Jia^#, Yijing Liu, Xingyu Lu, Zheli Liu
  ACM Transactions on the Web, 2026
• EMSERethinking software misconfigurations in the real world: an empirical study and literature analysis
  Yuhao Liu, Yingnan Zhou, Hanfeng Zhang, Zhiwei Chang, Sihan Xu^#, Yan Jia^#, Wei Wang, Juncheng Hu, Zheli Liu
  Empirical Software Engineering, 2026
• FUZZING'26UAVConfigFuzzer: Detecting Incorrect Configurations in Unmanned Aerial Vehicles via Setpoint Estimation Guided Fuzzing (Registered Report)
  Yingnan Zhou, Yuhao Liu, Hanfeng Zhang, Yan Jia^#, Sihan Xu^#, Zhiyuan Jiang, Zheli Liu
  International Fuzzing Workshop, 2026

• SCISSecurity and Privacy Measurement on Chinese Consumer IoT Traffic based on Device Lifecycle
  Chenghua Jin, Yuxin Song, Yan Jia^#, Qingyin Tan, Rui Yang, Zheli Liu
  SCIENCE CHINA Information Sciences, 2025
  We constructed and open-sourced the first Chinese smart home device traffic dataset — GitHub
• CIoTSC'25"Seeing is not always believing": Exploring Bystanders' Privacy Concerns on Multifunction IoT Devices in China
  Yijing Liu, Ling Liu, Yan Jia^#, Qingyin Tan, Zheli Liu, Tong Yu
  IEEE International Conference on Computer, Internet of Things and Smart City, 2025 · 🏆 Best Paper Award

• S&P'24MQTTactic: Security Analysis and Verification for Logic Flaws in MQTT Implementations
  Bin Yuan, Zhanxiang Song, Yan Jia^#, Zhenyu Lu, Deqing Zou^#, Hai Jin, Luyi Xing^#
  IEEE Symposium on Security and Privacy, 2024
• NDSS'24Maginot Line: Assessing a New Cross-app Threat to PII-as-Factor Authentication in Chinese Mobile Apps
  Fannv He, Yan Jia, Jiayu Zhao, Yue Fang, Jice Wang, Peng Liu, Yuqing Zhang^#
  Network and Distributed System Security Symposium, 2024

• USENIX'23Union under Duress: Understanding Hazards of Duplicate Resource Mismediation in Android Software Supply Chain
  Xueqiang Wang, Yifan Zhang, XiaoFeng Wang, Yan Jia, Luyi Xing
  USENIX Security Symposium, 2023
• arXivTowards Comprehensively Understanding the Run-time Security of Programmable Logic Controllers: A 3-year Empirical Study
  Rongkuan Ma, Qiang Wei, Jingyi Wang, Shunkai Zhu, Shouling Ji, Peng Cheng, Yan Jia, Qingxian Wang
  arXiv:2212.14296
• TSEMulti-misconfiguration Diagnosis via Identifying Correlated Configuration Parameters
  Yingnan Zhou, Xue Hu, Sihan Xu^#, Yan Jia^#, Yuhao Liu, Junyong Wang, Guangquan Xu, Wei Wang, Shaoying Liu, Thar Baker
  IEEE Transactions on Software Engineering, 2023
• TDSCReal-Time Diagnosis of Configuration Errors for Software of AI Server Infrastructure
  Guangquan Xu, Xinru Ding, Sihan Xu^#, Yan Jia^#, Shaoying Liu, Shicheng Feng^#, Xi Zheng
  IEEE Transactions on Dependable and Secure Computing, 2023

• CCS'22P-Verifier: Understanding and Mitigating Security Risks in Cloud-based IoT Access Policies
  Ze Jin, Luyi Xing, Yiwei Fang, Yan Jia, Bin Yuan, Qixu Liu
  ACM Conference on Computer and Communications Security, 2022
• USENIX'22How Are Your Zombie Accounts? Understanding Users' Practices and Expectations on Mobile App Account Deletion
  Yijing Liu, Yan Jia^#, Qingyin Tan, Zheli Liu^#, Luyi Xing
  USENIX Security Symposium, 2022
• USENIX'22Birds of a Feather Flock Together: How Set Bias Helps to Deanonymize You via Revealed Intersection Sizes
  Xiaojie Guo, Ye Han, Zheli Liu^#, Ding Wang, Yan Jia^#, Jin Li
  USENIX Security Symposium, 2022

• CCS'21Who's In Control? On Security Risks of Disjointed IoT Device Management Channels
  Yan Jia, Bin Yuan, Luyi Xing, Dongfang Zhao, XiaoFeng Wang, Yifan Zhang, Yijing Liu, Kaimin Zheng, Peyton Crnjak, Yuqing Zhang, Deqing Zou, Hai Jin
  ACM Conference on Computer and Communications Security, 2021
  Disjointed device management channel vulnerabilities in Apple HomeKit (CVE-2020-9978, macOS / iOS); also CNVD-2020-68248 and CNVD-2020-73400.
• IoT-JReviewing IoT Security via Logic Bugs in IoT Platforms and Systems
  Wei Zhou, Chen Cao^*, Dongdong Huo^*, Kai Cheng^*, Lan Zhang^*, Le Guan^*, Tao Liu^*, Yan Jia^*, Yaowen Zheng^*, Yuqing Zhang^†, Limin Sun, Yazhe Wang, Peng Liu (* equal contribution)
  IEEE Internet of Things Journal, 2021

• S&P'20Burglars IoT Paradise: Understanding and Mitigating Security Risks of General Messaging Protocols on IoT Clouds
  Yan Jia, Luyi Xing, Yuhang Mao, Dongfang Zhao, XiaoFeng Wang, Shangru Zhao, Yuqing Zhang
  IEEE Symposium on Security and Privacy, 2020
  Vulnerabilities in IoT messaging protocols (MQTT) and device identity management affected major platforms including AWS, Microsoft, IBM, Alibaba, Baidu, iRobot, Tuya, Eclipse Mosquitto, enabling remote hijacking, DoS, and privacy leaks. Acknowledged by MSRC; CVEs CVE-2018-12546 / CVE-2018-12550 and multiple CNVD entries assigned. MQTT authorization design issues raised as a priority by the OASIS MQTT Technical Committee — MQTT-536.
• USENIX'20Shattered Chain of Trust: Understanding Security Risks in Cross-Cloud IoT Access Delegation
  Bin Yuan, Yan Jia, Luyi Xing, Dongfang Zhao, XiaoFeng Wang, Deqing Zou, Hai Jin, Yuqing Zhang
  USENIX Security Symposium, 2020
  Cross-cloud IoT delegation vulnerabilities acknowledged by Samsung SmartThings ($2,000 bounty) and Philips Hue.

• USENIX'19Discovering and Understanding the Security Hazards in the Interactions between IoT Devices, Mobile Apps, and Clouds on Smart Home Platforms
  Wei Zhou, Yan Jia, Yao Yao, Lipeng Zhu, Le Guan, Yuhang Mao, Peng Liu, Yuqing Zhang
  USENIX Security Symposium, 2019
• ESORICS'19Identifying Privilege Separation Vulnerabilities in IoT Firmware with Symbolic Execution
  Yao Yao, Wei Zhou, Yan Jia, Lipeng Zhu, Peng Liu, Yuqing Zhang
  European Symposium on Research in Computer Security, 2019

• Journal智能家居安全综述 (A Survey on Smart Home Security)
  王基策, 李意莲, 贾岩, 周威, 王宇成, 王鹤, 张玉清
  计算机研究与发展, 2018, 55(10): 2111
• IoT-JThe Effect of IoT New Features on Security and Privacy: New Threats, Existing Solutions, and Challenges yet to be Solved
  Wei Zhou, Yan Jia, Anni Peng, Yuqing Zhang, Peng Liu
  IEEE Internet of Things Journal, 2018, 6(2): 1606–1616
• Journal物联网操作系统安全研究综述 (A Survey on Security of IoT Operating Systems)
  彭安妮, 周威, 贾岩, 张玉清
  通信学报, 2018, 39(3): 22–34

• S&P'17Poster: Security Analysis of HSTS Implementation in Browsers
  Yan Jia, Yuqing Zhang
  IEEE Symposium on Security and Privacy, 2017
  Discovered an HSTS bypass via flooding of the HSTS policy file in Chromium (Severity: Medium) — Chromium Issue 699461
• JournalHTML5 新特性安全研究综述 (A Survey on Security of New HTML5 Features)
  张玉清, 贾岩, 雷柯楠, 吕少卿, 乐洪舟
  计算机研究与发展, 2016, 53(10): 2163–2172
• JournalHTML5 应用程序缓存中毒攻击研究 (Research on HTML5 AppCache Poisoning Attacks)
  贾岩, 王鹤, 吕少卿, 张玉清
  通信学报, 2016, 37(10): 149–157

I am fortunate to work with the following students and researchers.