Demonstration venue · read-only. Every page can be browsed; the buttons that would change it are switched off. Create an account to run TaxoReview on your own data. A simulation from public publication records: the people listed were not invited and did not agree to review.
? Tutorial for this page

Kai Tu

dblp:87/1149 · DBLP profile ↗
← Back
11ranked-venue papers
3as first author
8since 2021 · last 2026
—ORCID · conflict

Domains — the database's venue-derived domains; a paper can count in several

Security and privacy · 6 · 1 first-author · 6 since 2021Artificial intelligence and machine learning · 2 · 2 since 2021Theory of computation · 2 · 1 first-authorSystems, architecture and hardware · 1 · 1 since 2021Graphics, computer vision, multimedia, augmented reality and games · 1 · 1 first-author

Expertise — from the expertise taxonomy: the topics of the expert's papers under the CCF categories. A weight counts papers with recency: 1 for a paper about the topic, 0.3 when the topic is its context, halved every five years.

Network and information security
7 papers
Systems and software security · 54% Network security · 36% Cryptographic protocols and secure computation · 11%
Computer networks
6 papers
Cellular and mobile networks · 66% Network management and operations · 26% Wireless networking · 4%
Software engineering, system software, and programming languages
1 paper
Debugging and program repair · 100%

Topics — the 14 heaviest of 18, each with the papers that count most for it

TopicWeightPapersLastEvidence papers
Cellular and mobile networks
5g
1.822026
Guardians of the Air: In-Device Detection of 5G Control-Plane Threats · SP 2026
Logic Gone Astray: A Security Analysis Framework for the Control Plane Protocols of 5G Basebands · USENIX Security Symposium 2024
Systems and software security
vulnerability discovery
1.722025
CoreCrisis: Threat-Guided and Context-Aware Iterative Learning and Fuzzing of 5G Core Networks · USENIX Security Symposium 2025
Stateful Analysis and Fuzzing of Commercial Baseband Firmware · SP 2025
Network security › intrusion detection and prevention
intrusion detection
1.012026
Guardians of the Air: In-Device Detection of 5G Control-Plane Threats · SP 2026
Debugging and program repair
automated program repair
1.012026
LogicEval: A Systematic Framework for Evaluating Automated Repair Techniques for Logical Vulnerabilities in Real-World Software · ACL (1) 2026
Cellular and mobile networks
5g core network
0.912025
CoreCrisis: Threat-Guided and Context-Aware Iterative Learning and Fuzzing of 5G Core Networks · USENIX Security Symposium 2025
Network management and operations
fuzzing
0.912025
CoreCrisis: Threat-Guided and Context-Aware Iterative Learning and Fuzzing of 5G Core Networks · USENIX Security Symposium 2025
Systems and software security › vulnerability discovery
fuzzing
0.912025
Stateful Analysis and Fuzzing of Commercial Baseband Firmware · SP 2025
Systems and software security › vulnerability discovery › fuzzing
protocol fuzzing
0.912025
CoreCrisis: Threat-Guided and Context-Aware Iterative Learning and Fuzzing of 5G Core Networks · USENIX Security Symposium 2025
Network security › protocol security
protocol vulnerability discovery
0.812024
State Machine Mutation-based Testing Framework for Wireless Communication Protocols · CCS 2024
Cryptographic protocols and secure computation
security protocol analysis
0.812024
Logic Gone Astray: A Security Analysis Framework for the Control Plane Protocols of 5G Basebands · USENIX Security Symposium 2024
Cellular and mobile networks › cellular network security
radio access network security
0.312026
Guardians of the Air: In-Device Detection of 5G Control-Plane Threats · SP 2026
Systems and software security
vulnerability patching
0.312026
LogicEval: A Systematic Framework for Evaluating Automated Repair Techniques for Logical Vulnerabilities in Real-World Software · ACL (1) 2026
Cellular and mobile networks
5G NR
0.312025
Stateful Analysis and Fuzzing of Commercial Baseband Firmware · SP 2025
Software-defined and programmable networks
control plane
0.212024
Logic Gone Astray: A Security Analysis Framework for the Control Plane Protocols of 5G Basebands · USENIX Security Symposium 2024

Methods — techniques the papers use, named apart from their topics

large language model · 2.0threat-guided fuzzing · 1.7symbolic analysis · 1.7iterative learning · 1.7fuzzing · 1.7state machine mutation · 1.5property-guided testing · 1.5natural language processing · 1.5formal analysis · 1.5
YearPublicationVenuePosition
2026 LogicEval: A Systematic Framework for Evaluating Automated Repair Techniques for Logical Vulnerabilities in Real-World Software
abstract
Syed Md Mukit Rashid, Abdullah Al Ishtiaq, Kai Tu, Yilu Dong, Tianwei Wu, Ali Ranjbar, Tianchang Yang, Najrin Sultana, Shagufta Mehnaz, Syed Rafiul Hussain. Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers). 2026.
Syed Md. Mukit Rashid, Abdullah Al Ishtiaq, Kai Tu, Yilu Dong, Tianwei Wu, Ali Ranjbar, Tianchang Yang, Najrin Sultana, Shagufta Mehnaz, Syed Rafiul Hussain
ACL (1)3
2026 Guardians of the Air: In-Device Detection of 5G Control-Plane Threats
Tianwei Wu, Abdullah Al Ishtiaq, Tianchang Yang, Yilu Dong, Kai Tu, Ridwanul Hasan Tanvir, Md. Toufikuzzaman, Shagufta Mehnaz, Syed Rafiul Hussain
SP5
2025 MCTrack: A Unified 3D Multi-Object Tracking Framework for Autonomous Driving
abstract
This paper introduces MCTrack, a new 3D multi-object tracking method that achieves performance across KITTI, nuScenes, and Waymo datasets. Addressing the gap in existing tracking paradigms, which often perform well on specific datasets but lack generalizability, MCTrack offers a unified solution. Additionally, we have standardized the format of perceptual results across various datasets, termed BaseVersion, facilitating researchers in the field of MOT) to concentrate on the core algorithmic development without the undue burden of data preprocessing. Finally, recognizing the limitations of current evaluation metrics, we introduce a novel set of metrics designed to evaluate the output of motion information, including velocity and acceleration, which are essential for subsequent tasks. The source codes of the proposed method are available at this link: https://github.com/megvii-research/MCTrack
Xiyang Wang 0002, Shouzheng Qi, Jieyou Zhao, Hangning Zhou, Siyu Zhang 0002, Guoan Wang, Kai Tu, Songlin Guo, Jianbo Zhao 0001, Hailong Qin, Mu Yang
IROS7
2025 Stateful Analysis and Fuzzing of Commercial Baseband Firmware
abstract
Baseband firmware plays a critical role in cellular communication, yet its proprietary, closed-source nature and complex, stateful processing logic make systematic security testing challenging. Existing methods often fail to account for the interdependencies between baseband tasks and the statefulness of input processing logic, limiting their scope and effectiveness. We present Loris, a stateful fuzz testing frame-work designed to explore and analyze baseband firmware implementations effectively. We employ iterative symbolic analysis to progressively identify state variables and the predicates over them that define different protocol states, while alleviating the state explosion problem. It enables Loris to perform targeted exploration and fuzzing of program regions with high potential for vulnerabilities. We evaluated Loris across 5 commercial devices from two major vendors, covering both 4G Long-Term Evolution (LTE) and 5G New Radio (NR), demonstrating its broad applicability. Our testing revealed 7 new vulnerabilities exploitable by over-the-air attackers, potentially leading to baseband crashes, remote code execution, and denial of service.
Ali Ranjbar, Tianchang Yang, Kai Tu, Saaman Khalilollahi, Syed Rafiul Hussain
SP3
2025 CoreCrisis: Threat-Guided and Context-Aware Iterative Learning and Fuzzing of 5G Core Networks
Yilu Dong, Tianchang Yang, Abdullah Al Ishtiaq, Syed Md. Mukit Rashid, Ali Ranjbar, Kai Tu, Tianwei Wu, Md. Sultan Mahmud, Syed Rafiul Hussain
USENIX Security Symposium6
2024 State Machine Mutation-based Testing Framework for Wireless Communication Protocols
abstract
This paper proposes Proteus, a protocol state machine, property-guided, and budget-aware automated testing approach for discovering logical vulnerabilities in wireless protocol implementations. Proteus maintains its budget awareness by generating test cases (i.e., each being a sequence of protocol messages) that are not only meaningful (i.e., the test case mostly follows the desirable protocol flow except for some controlled deviations) but also have a high probability of violating the desirable properties. To demonstrate its effectiveness, we evaluated Proteus in two different protocol implementations, namely 4G LTE and BLE, across 23 consumer devices (11 for 4G LTE and 12 for BLE). Proteus discovered 25 unique issues, including 112 instances. Affected vendors have positively acknowledged 14 vulnerabilities through 5 CVEs.
Syed Md. Mukit Rashid, Tianwei Wu, Kai Tu, Abdullah Al Ishtiaq, Ridwanul Hasan Tanvir, Yilu Dong, Omar Chowdhury, Syed Rafiul Hussain
CCS3
2024 Hermes: Unlocking Security Analysis of Cellular Network Protocols by Synthesizing Finite State Machines from Natural Language Specifications
Abdullah Al Ishtiaq, Sarkar Snigdha Sarathi Das, Syed Md. Mukit Rashid, Ali Ranjbar, Kai Tu, Tianwei Wu, Zhezheng Song, Mujtahid Akon, Rui Zhang 0037, Syed Rafiul Hussain
USENIX Security Symposium5
2024 Logic Gone Astray: A Security Analysis Framework for the Control Plane Protocols of 5G Basebands
Kai Tu, Abdullah Al Ishtiaq, Syed Md. Mukit Rashid, Yilu Dong, Tianwei Wu, Syed Rafiul Hussain
USENIX Security Symposium1
2020 A hybrid Bregman alternating direction method of multipliers for the linearly constrained difference-of-convex problems
Kai Tu, Junkai Feng
J. Glob. Optim.1
2018 Optimality analysis on partial l1 -minimization recovery
Zhibao Li, Kai Tu
J. Glob. Optim.4
2007 Tracking the Path Shape Qualities of Human Motion
abstract
We propose a probabilistic generative model for extracting intended path shape qualities of an object moving under human control in real time. At each instant, we decide whether the object is moving in a straight, curved, or random path, or whether it has stopped moving. Our model incorporates sensor noise as well as human imperfections in the intended motion. As well as tracking the object's position, velocity, and motion direction, we compute the posterior probability of each shape quality hypothesis given all sensed-data in the horizon [t - N + 1,t]; the hypothesis maximizing this posterior is taken as the decision. The posterior is computed using the unscented Kalman filter (UKF), as our model is inherently nonlinear. The path-shape quality tracking is successfully embedded in a hybrid physical-digital interface where the position of an illuminated ball, sensed by a low-cost video camera array, triggers multimodal feedback in a mediated learning environment. We show successful results on a variety of real-world motion paths where the participant is given only verbal descriptions of how to move. Our generative model is further validated by user studies involving a simple color-based interaction, where participants discover shape quality controls as they interact.
Kai Tu, Harvey D. Thornburg, Matthew Fulmer, Andreas Spanias
ICASSP (2)1