Xing Gao
University of Delaware, DE·Computer Science·Early-career
Software today is built, tested and shipped through automated pipelines and shared online ecosystems of reusable code. Attackers increasingly target these links instead of the finished program, through software supply chain attacks.
- Fields
Computer Science
Engineering
- Topics
cybersecurity
computer security
software supply chain security
- Grants
- 2 known grants, through Sep 2029
What they work on
- Build a security testing system that combines dynamic execution and static analysis to examine every critical component of continuous software development pipelines and how each interacts with the people and organizations involved.
- Investigate security threats from popular pipeline add-ons, such as third-party plugins and different sandboxing techniques that isolate code, and add dedicated analysis modules to the testing framework.
- Design a threat detector that organizations and developers can run on their code repositories to find 'security smells' (warning signs of weak security), evaluated through large-scale measurement of open-source repositories.
- Identify and disclose weaknesses in software package ecosystems that let attackers hijack existing packages or distribute malicious code by exploiting confusingly similar names.
- Explore naming-confusion threats in user-specific worlds on Metaverse platforms, and use machine learning to detect and reduce fraud in decentralized blockchain (Web3) applications.
More about the research
Such attacks can cause financial loss, theft of intellectual property and disruption for organizations and users. Both projects study how these threats work across real systems, measure how widespread they are through large-scale studies of real-world data, and build practical defenses. One project secures the automated pipelines used to develop software. The other tackles attacks that exploit confusingly similar names online.
Why it matters
Tech companies, banks and everyday internet users depend on software and online services that supply chain and look-alike-name attacks can compromise. Tools from this work could help organizations find weak spots in how they build software and help developers avoid hijacked or malicious packages. They could also help protect users of Metaverse and blockchain applications from fraud. Together these tools could strengthen the security and reliability of internet services.
Known grants
From NIH and NSF research grants. Labs often have other funding we can't see.
Closest labs
Yueqi Chen
University of Colorado Boulder, CO·Computer Science
Refactor the Community Earth System Model (CESM) codebase by decoupling its computational and control logic and rewriting the control layer in Python, so that modern security practices can be integrated.
Junfeng Yang
Columbia University, NY·Computer Science
Detect model spoofing, where attackers upload malicious AI models under deceptive names, by developing anomaly detection based on naming conventions and model architectural signatures.
Alexandros Kapravelos
North Carolina State University, NC·Computer Science·Early-career
Define the security properties that continuous integration workflows should satisfy and design a Workflow Intermediate Representation, a common format that workflows from any CI platform can be translated into for uniform analysis.
The school
University of Delaware: 22 labs on PI Pages, $466M a year on research, 298 research doctorates a year.
Reach out
A start for your email. Fill in the brackets.