Yichao Xu
Yichao Xu

Yichao Xu

Computer Science PhD candidate
Johns Hopkins University
Advisor: Yinzhi Cao

Research

Program analysis

  • Earlier: Improved analysis of unsafe data flows in dynamic PHP and JavaScript, uncovering 54 previously unknown vulnerabilities in 19 PHP applications (CoBrA) and 242 in npm packages (FAST).
  • Now: Beyond unsafe data flows, logic vulnerabilities depend on an application's business rules. I now combine program analysis with agent assistance to check predefined rules; this work has found 47 previously unknown logic vulnerabilities in PHP e-commerce applications.
  • Next: How can we discover logic vulnerabilities when the relevant business rules are not given? I want to identify candidate rules and test whether violating them has security consequences.

CoBrA · ICSE 2026FAST · IEEE S&P 2023AnonVul · Preprint 2026

Agentic security

  • Related work: Showed that prior dialogue changes assistance on identical cybersecurity requests.
  • Exploring: Does this context sensitivity carry into agents' actions? I want to study how task and authorization constraints hold across tool use, and where logic vulnerabilities arise.

3R-Bench · Preprint 2026

Publications

ICSE 2026

CoBrA: Context-, Branch-sensitive Static Analysis for Detecting Taint-style Vulnerabilities in PHP Web Applications

PaperCodePDF

First author

PHP applications can choose which functions to call at runtime, making vulnerabilities difficult to detect statically. I designed and built CoBrA to resolve these calls using their calling context and track unsafe input flows. It found 54 previously unknown vulnerabilities in 19 web applications.

Yichao Xu, Mingqing Kang, Neil Thimmaiah, Rigel Gjomemo, V. N. Venkatakrishnan, Yinzhi Cao

How CoBrA works Resolve dynamic calls, then check the data flow
Which paths can this request take?

PHP

Dependencies within controller

$action . "_controller" → ?

Phase details: input, method and output
Input
Method
Output
Full reduced PHP example

Adapted from the paper’s Emoncms example; parsing, database setup and the other engine’s body are omitted. Predefined analysis states; no PHP or CoBrA execution.

IEEE S&P 2023

Scaling JavaScript Abstract Interpretation to Detect and Exploit Node.js Taint-style Vulnerability

PaperCodePDF

Second author

FAST addresses the cost of analyzing dynamic JavaScript by constructing candidate call paths, then focusing analysis on statements relevant to a potential vulnerability. I implemented JavaScript abstract interpretation and led the evaluation, which found 242 previously unknown vulnerabilities in npm packages.

Mingqing Kang, Yichao Xu, Song Li, Rigel Gjomemo, Jianwei Hou, V. N. Venkatakrishnan, Yinzhi Cao

Show moreShow less3 more papers
Preprint 2026

Discovery or Memorization? A Faithful Benchmark for Real-World Business-Logic Vulnerability Discovery

PaperPDF

arXiv preprint

AnonVul evaluates whether vulnerability-discovery agents find business-logic flaws or rely on recognizable software identity. The benchmark uses anonymized vulnerability tasks, sandboxed execution and expert-defined checks to test discovery performance.

Rui Yang, Yichao Xu, Zhuohao Zhang, Jiahao Ji, Chaowei Xiao, Yinzhi Cao, Ziyang Li

Preprint 2026

Same Request, Different Boundary: Evaluating Cybersecurity Assistance across Conversational Contexts

PaperPDF

arXiv preprint

3R-Bench tests how preceding conversation changes an LLM’s response to the same cybersecurity request. It distinguishes refusal, bounded assistance, compliance and provider blocking, separating response behavior from the request itself.

Rui Yang, Yang Hong, Yichao Xu, Zhengyu Liu, Yinzhi Cao, Ziyang Li

2018

A Denial of Services Attack for IOT System

Science and Wealth · Jun 2018

ISSN 1671-2226

Software

Harvest Claude

Monitoring Claude Code sessions through animated farm characters in a terminal dashboard

CodeRust

Shows when agents are working, idle or waiting for input.

Example · Terminal

Requires Rust 1.85+ and a terminal with 24-bit color.

git clone https://github.com/samhsu-dev/harvest-claude.git
cd harvest-claude
cargo install --path .
harvest-claude

Active Claude Code sessions appear automatically as farm characters.

Harvest Claude’s terminal farm interface with pixel-art characters and crop fields

Joern

Extending PHP security analysis with five vulnerability queries, regression tests and version-check fixes

CodeScalaPR #5327 · merged

Contributed upstream queries for SQL injection, command injection, code injection, unsafe file operations and XSS, with positive and negative tests. Also fixed PHP version checks for distribution-specific version strings. PR #5327 was merged on February 28, 2025.

Example · PHP test case

A minimal SQL-injection case from the merged PR’s tests:

<?php
$input = $_GET["username"];
$query = "SELECT * FROM users WHERE name = '$input'";
$result = mysql_query($query);

The contributed query checks whether request input reaches a database call. The test pairs this case with a constant-input case that should produce no match.

Show moreShow less2 more entries

cpg2py

Querying Joern code property graphs in Python to explore program structure and data-flow relationships

CodePython

Supports loading exported graphs, querying nodes and edges, and traversing their relationships.

Example · Python

Install with pip install cpg2py. Use tab-delimited nodes.csv and rels.csv exports.

from pathlib import Path
from cpg2py import cpg_graph

graph = cpg_graph(Path("nodes.csv"), Path("rels.csv"))
for node in graph.nodes(lambda n: n.type == "Function"):
    print(node.name)

Prints the function names in the supplied graph.

ripsv0.5-cli

Adapting the legacy RIPS PHP analyzer for command-line scanning and structured JSON reports

CodePHP

Adapted RIPS v0.5 to run without its web interface, adding command-line options and JSON reporting for automated analysis workflows. Uses the original, discontinued RIPS v0.5 analysis engine.

Example · Terminal

Requires PHP. Replace /path/to/php/project with a local PHP source directory.

git clone https://github.com/samhsu-dev/ripsv0.5-cli.git
cd ripsv0.5-cli
php rips.php /path/to/php/project --vector=xss --format=json

Scans the source for potential XSS and prints the findings in JSON format.

Education

Jan 2023 – Present

Johns Hopkins University

PhD, Computer Science · Expected Dec 2027

Advisor: Yinzhi Cao

Sep 2021 – Dec 2022

Johns Hopkins University

MS, Security Informatics

Show moreShow less2 more entries

Sep 2019 – Oct 2020

University College London

MSc, Software Systems Engineering · Distinction

2015–2019

University of Liverpool & Xi’an Jiaotong-Liverpool University

BSc (Honours), Information and Computing Science

2+2 joint programme · First Class Honours

Experience

Feb 2026 – Present

Jay-I-break team

Core Engineer · 2026 Amazon Nova AI Challenge

Maintained 8 agentic pipelines for software vulnerability discovery. Developed 1 black-box analysis pipeline and 2 dynamic analysis pipelines.

Dec 2020 – Mar 2021

China Academy of Industrial Internet

Research Assistant · Internship · Beijing, China

Designed a Hyperledger Fabric framework for product traceability, with access controls for business-sensitive records.

Show moreShow less3 more entries

Sep 2021 – Present

Johns Hopkins University · SecLab

Research Assistant

Research on software vulnerability discovery through static analysis and fuzzing.

Sep 2022 – 2023

Johns Hopkins University · S4 Lab

Research Assistant · Internship

Built C++ simulations in OMNeT++ to study denial-of-service attacks and defenses in vehicular networks.

Jun–Sep 2020

University College London

Research Assistant

Built a Python tool to link tests to source methods using their co-evolution in Git repositories.

Teaching

2025

Language-Based Security

Teaching Assistant (TA) · Johns Hopkins University

Instructor: Yinzhi Cao

2023

Practical Cryptographic Systems

Teaching Assistant (TA) · Johns Hopkins University

Instructor: Matthew Green

Show moreShow less1 more course

2022

Future Networks

Course Assistant (CA) · Johns Hopkins University

Instructor: Krishan Sabnani

Honors

Jul 2018

BOSCH CHINA IoT TECH HACKATHON

Outstanding Achievement