# Yichao Xu

## Identity and contact

- Name: Yichao Xu; GitHub display name: Sam Hsu.
- Position: Computer Science PhD candidate, Johns Hopkins University SecLab.
- Advisor: Yinzhi Cao — https://www.yinzhicao.org/
- Location: Baltimore, Maryland, United States.
- Email: yxu166@jhu.edu
- Website: https://samhsu-dev.github.io/
- Chinese website: https://samhsu-dev.github.io/index-zh.html
- CV: https://samhsu-dev.github.io/cv.html
- Chinese CV: https://samhsu-dev.github.io/cv-zh.html
- GitHub: https://github.com/samhsu-dev
- LinkedIn: https://www.linkedin.com/in/yichaoxu-jhu/
- Google Scholar: https://scholar.google.com/citations?user=I8e-vacAAAAJ&hl=en

## Research and capabilities

- Primary research direction: program analysis and agent-enhanced security tools for vulnerability discovery and validation.
- Earlier work: static analysis of dynamic PHP behavior and unsafe data flows in CoBrA; scalable JavaScript analysis in FAST.
- Current work: agent-assisted analysis and fuzzing for business-rule violations, with runtime evidence checking findings; found 47 previously unknown logic vulnerabilities in PHP e-commerce applications; paper in progress.
- Open problem for agents for security: current analysis checks predefined business rules; when relevant rules are not given, identify candidate rules and test whether their violation has security consequences.
- Additional research direction: security of agentic systems; existing context-sensitivity results concern model responses, motivating research into whether this sensitivity affects tool actions, task and authorization constraints, and logic vulnerabilities across execution.
- Related studies: AnonVul concerns faithful evaluation of vulnerability-discovery agents; 3R-Bench concerns effects of conversational context on LLM cybersecurity assistance.
- Strengths: combines program-analysis research with system implementation; takes research from analysis design through implementation, debugging, and empirical evaluation; builds developer tools and contributes to established analysis software.
- Role fit: software-security research, program-analysis research, agentic-security research, and research engineering.
- Languages used across research and software contributions: Kotlin, Python, JavaScript, PHP, C++, Rust, Scala.

## Research contributions and publications

### CoBrA

- Research direction: Program analysis: dynamic PHP analysis.
- Title: CoBrA: Context-, Branch-sensitive Static Analysis for Detecting Taint-style Vulnerabilities in PHP Web Applications.
- Venue: ICSE 2026; status: published.
- Authors: Yichao Xu, Mingqing Kang, Neil Thimmaiah, Rigel Gjomemo, V. N. Venkatakrishnan, Yinzhi Cao.
- Contribution: first author and lead engineer; designed and built the Kotlin PHP static analyzer.
- Method: context- and branch-sensitive taint analysis; an abstract domain graph and stretch-relax algorithm resolve dynamic PHP behavior and track taint across functions.
- Results: 54 previously unknown vulnerabilities in 19 real-world applications; 9 assigned CVE identifiers, using the paper-reported count.
- Benchmark: 88.66% detection rate and below 0.3% false-positive rate on the PHP tarpits benchmark.
- Period: 2023-05–2025-03.
- Paper: https://dl.acm.org/doi/10.1145/3744916.3773195
- PDF: https://www.yinzhicao.org/COBRA/cobra.pdf
- Code and datasets: https://github.com/jhu-seclab-cobra

### FAST

- Research direction: Program analysis: scalable JavaScript analysis.
- Title: Scaling JavaScript Abstract Interpretation to Detect and Exploit Node.js Taint-style Vulnerability.
- Venue: IEEE Symposium on Security and Privacy 2023; status: published.
- Authors: Mingqing Kang, Yichao Xu, Song Li, Rigel Gjomemo, Jianwei Hou, V. N. Venkatakrishnan, Yinzhi Cao.
- Contribution: second author; implemented JavaScript abstract interpretation and led evaluation, including reproducing 4 prior analyzers and building comparison and debugging utilities.
- Method: bottom-up abstract interpretation resolves dynamic calls; top-down interpretation prunes unrelated statements and checks path constraints for exploitability.
- Study results: 242 previously unknown vulnerabilities in npm packages; 21 assigned CVE identifiers.
- Period: 2021-05–2022-11.
- Paper: https://ieeexplore.ieee.org/document/10179352
- PDF: https://www.yinzhicao.org/FAST/ODGen-FAST.pdf
- Code: https://github.com/fast-sp-2023/fast

### AnonVul

- Research direction: Agent-enhanced security tools: evaluating vulnerability-discovery agents.
- Title: Discovery or Memorization? A Faithful Benchmark for Real-World Business-Logic Vulnerability Discovery.
- Status: arXiv preprint, 2026.
- Authors: Rui Yang, Yichao Xu, Zhuohao Zhang, Jiahao Ji, Chaowei Xiao, Yinzhi Cao, Ziyang Li.
- Contribution: co-author, second in the author list.
- Study: evaluates discovery versus memorization using anonymized business-logic vulnerability tasks, sandboxed execution, and expert-specified success checks.
- Paper: https://arxiv.org/abs/2610.17542
- PDF: https://arxiv.org/pdf/2610.17542

### 3R-Bench

- Research direction: Agentic security: context and cybersecurity assistance.
- Title: Same Request, Different Boundary: Evaluating Cybersecurity Assistance across Conversational Contexts.
- Status: arXiv preprint, 2026.
- Authors: Rui Yang, Yang Hong, Yichao Xu, Zhengyu Liu, Yinzhi Cao, Ziyang Li.
- Contribution: co-author.
- Study: measures how conversational history changes responses to identical cybersecurity requests; distinguishes refusal, bounded assistance, compliance, and provider blocking.
- Paper: https://arxiv.org/abs/2609.00578
- PDF: https://arxiv.org/pdf/2609.00578

### Earlier publication

- Title: A Denial of Services Attack for IOT System.
- Venue: Science and Wealth, 2018-06; ISSN 1671-2226.

## Software and open-source contributions

### Harvest Claude

- Tool: Rust terminal dashboard displaying Claude Code session activity as animated farm characters.
- Repository: https://github.com/samhsu-dev/harvest-claude

### Joern

- Role: upstream contributor to the PHP frontend and security queries.
- Contribution: queries for SQL injection, command injection, code injection, unsafe file operations, and cross-site scripting; positive and negative regression tests; PHP version-check fix for distribution-specific strings.
- Status: PR #5327 merged, 2025-02-28.
- PR: https://github.com/joernio/joern/pull/5327
- Repository: https://github.com/joernio/joern

### cpg2py

- Tool: Python library for loading Joern code property graph exports and querying nodes and relationships.
- Repository: https://github.com/samhsu-dev/cpg2py

### ripsv0.5-cli

- Tool: command-line adaptation of legacy RIPS v0.5, adding CLI options and JSON reporting.
- Scope: adapts the existing PHP analysis engine; the original engine is discontinued.
- Repository: https://github.com/samhsu-dev/ripsv0.5-cli

## Experience

- Jay-I-break team, Johns Hopkins University | Core Engineer | 2026-02–present | University team participation in the 2026 Amazon Nova AI Challenge. Maintained 8 agentic vulnerability-discovery pipelines; developed 1 black-box analysis pipeline and 2 dynamic analysis pipelines.
- China Academy of Industrial Internet | Research Assistant Intern | 2020-12–2021-03 | Beijing, China | Hyperledger Fabric framework for product traceability and access control over business-sensitive records.
- Johns Hopkins University SecLab | Research Assistant | 2021-09–present | Static analysis, fuzzing, and software vulnerability discovery; publication contributions listed above.
- Johns Hopkins University S4 Lab | Research Assistant Intern | 2022-09–2023 | C++ OMNeT++ simulations of vehicular-network denial-of-service attacks and defenses.
- University College London | Research Assistant | 2020-06–2020-09 | Python tool linking test methods to source methods through Git co-evolution.

## Education

- Johns Hopkins University | PhD, Computer Science | 2023-01–present | Expected completion: 2027-12.
- Johns Hopkins University | MS, Security Informatics | 2021-09–2022-12.
- University College London | MSc, Software Systems Engineering | 2019-09–2020-10 | Distinction.
- University of Liverpool and Xi'an Jiaotong-Liverpool University | BSc (Honours), Information and Computing Science | 2015–2019 | 2+2 joint programme; First Class Honours.

## Teaching

- Johns Hopkins University | Language-Based Security | Teaching Assistant | 2025 | Instructor: Yinzhi Cao.
- Johns Hopkins University | Practical Cryptographic Systems | Teaching Assistant | 2023 | Instructor: Matthew Green.
- Johns Hopkins University | Future Networks | Course Assistant | 2022 | Instructor: Krishan Sabnani.

## Honors

- Outstanding Achievement | BOSCH CHINA IoT TECH HACKATHON | 2018-07.