Name

Yu Hao · Security researcher, HarmonyOS System Security Team, Huawei

Description

I work on operating-system security and program analysis for C/C++ systems, combining fuzzing, static analysis, symbolic execution and LLM-based reasoning to find and fix memory-safety bugs in real kernels: Linux, Android and HarmonyOS.

Facts

publications
22 (18 conference), 2017–2026
venues
S&P · CCS · USENIX Security · NDSS · ICSE · FSE · OOPSLA
paper awards
3 · Distinguished Paper Award (CCS 25), Google Research Paper Rewards (ICSE 22), Best Paper Award (QRS 21)
education
Ph.D., UC Riverside, 2024

Research

Kernel fuzzing
Specification generation for Linux kernel drivers, so fuzzers reach code that hand-written syscall descriptions never cover. SyzDescribe (S&P 23), SyzSpec (CCS 25) →
LLMs for security
E&V prompts an LLM to execute pseudo-code and verify its own result, locating the function to patch with over 80% accuracy on 170 Linux kernel crashes. E&V, LLift (OOPSLA 24) →
Static analysis
Precise and scalable detection of use-before-initialization bugs in the Linux kernel, with an LLM in the loop to cut false positives. UBITect (FSE 20), NDSS 22 →
Symbolic execution
Under-constrained symbolic execution behind the kernel projects above, and accurate bisection of fuzzer-exposed vulnerabilities. SymBisect (USENIX Security 24) →

I am open to collaboration with researchers and industry partners in operating system security, and I am hiring interns and full-time researchers.

Selected publications

  1. CCS 25

    SyzSpec: Specification Generation for Linux Kernel Fuzzing via Under-Constrained Symbolic Execution

    Yu Hao, Juefei Pu, Xingyu Li, Zhiyun Qian, Ardalan Amiri Sani

    Distinguished Paper Award

    pdf Tool

  2. USENIX Security 24

    SymBisect: Accurate Bisection for Fuzzer-Exposed Vulnerabilities

    Zheng Zhang, Yu Hao, Weiteng Chen, Xiaochen Zou, Xingyu Li, Haonan Li, Yizhuo Zhai, Zhiyun Qian, Billy Lau

    pdf Tool Linux Security Summit 25

  3. OOPSLA 24
  5. S&P 23

    SyzDescribe: Principled, Automated, Static Generation of Syscall Descriptions for Kernel Drivers

    Yu Hao, Guoren Li, Xiaochen Zou, Weiteng Chen, Shitong Zhu, Zhiyun Qian, Ardalan Amiri Sani

    pdf ToolResult

  6. ICSE 22

    Demystifying the Dependency Challenge in Kernel Fuzzing

    Yu Hao, Hang Zhang, Guoren Li, Xingyun Du, Zhiyun Qian, Ardalan Amiri Sani

    Google Research Paper Rewards

    pdf Tool

all 22 publications →

News

  • 2025 Received the Distinguished Paper Award at CCS 2025 for “SyzSpec: Specification Generation for Linux Kernel Fuzzing via Under-Constrained Symbolic Execution”.
  • 2025 “SyzSpec” was accepted by CCS 2025.
  • 2024 Received the Laxmi Bhuyan Fellowship Award from University of California, Riverside.