Biography
Dr. Qifan Zhang (张起帆) is now a Senior Staff Researcher of Palo Alto Networks. His research focuses on safeguarding critical internet infrastructure and addressing emerging threats in networked systems. His work centers on Network Security, with deep expertise in the Domain Name System (DNS)—the backbone of internet communication. By combining protocol analysis, fuzzing techniques, and formal methods, he designs automated tools to uncover high-risk vulnerabilities in DNS implementations and standards.
One of his flagship projects, ResolverFuzz, is a novel testing framework that exposed critical flaws in widely deployed DNS resolvers, including protocol-level security gaps (e.g., cache poisoning) and implementation errors (e.g., memory corruption). These discoveries have directly strengthened cybersecurity practices for the industry, open-source communities, and public infrastructure providers, earning recognition from organizations like CERT/CC and CVE.
Beyond DNS, he also explores the intersection of AI and Security, investigating risks in real-world machine learning deployments. My research, published in ACSAC 2022, demonstrated the first practical model extraction attacks against autonomous vehicle (AV) systems, using gradient-descent-based methods to reverse-engineer proprietary AI models. This work underscores the urgent need for robust defenses in safety-critical AI applications.
Prior to Palo Alto Networks, he earned his Ph.D. in Computer Engineering from University of California, Irvine advised by Prof. Zhou Li in 2025, and B.Eng. in Computer Science and Technology from ShanghaiTech University in 2020, complemented by a summer session at the University of California, Berkeley in 2017.
Pronunciation of his name: Chee-Fan Jang.
His Curriculum Vitae (last updated on March 14, 2025)
One of his flagship projects, ResolverFuzz, is a novel testing framework that exposed critical flaws in widely deployed DNS resolvers, including protocol-level security gaps (e.g., cache poisoning) and implementation errors (e.g., memory corruption). These discoveries have directly strengthened cybersecurity practices for the industry, open-source communities, and public infrastructure providers, earning recognition from organizations like CERT/CC and CVE.
Beyond DNS, he also explores the intersection of AI and Security, investigating risks in real-world machine learning deployments. My research, published in ACSAC 2022, demonstrated the first practical model extraction attacks against autonomous vehicle (AV) systems, using gradient-descent-based methods to reverse-engineer proprietary AI models. This work underscores the urgent need for robust defenses in safety-critical AI applications.
Prior to Palo Alto Networks, he earned his Ph.D. in Computer Engineering from University of California, Irvine advised by Prof. Zhou Li in 2025, and B.Eng. in Computer Science and Technology from ShanghaiTech University in 2020, complemented by a summer session at the University of California, Berkeley in 2017.
Pronunciation of his name: Chee-Fan Jang.
His Curriculum Vitae (last updated on March 14, 2025)
Recent news
- [03/2025]: Invited to serve on the PC of ACSAC 2025.
- [03/2025]: Defended my Ph.D.!
- [01/2025]: Joined Palo Alto Networks. See you around in Bay Area!
- [08/2024]: ResolverFuzz has been presented in USENIX Security 2024. Slides are available here.
- [05/2024]: FedSecurity got accepted by KDD'24. Big congrats, Shanshan!
Interests
- Domain Name System (DNS). Qifan is interested in security, privacy and reliability of DNS. In particular, he is interested in automated vulnerability detection with fuzzing techniques [Security'24]. Based on his automated tool, ResolverFuzz, several vital vulnerabilities have been discovered, including protocol security [NDSS'23], implementation assessment [Security'23], etc.
- Machine Learning Security and Privacy. Qifan is also interested in security and privacy topics related to machine learning. His past research demonstrated model extraction on Autonomous Vehicle using Gradient-Descent based methods [ACSAC'22].
Education
-
Ph.D. in Computer Engineering
2020 - 2025
University of California, Irvine
-
B.Eng. in Computer Science and Technology, Minor in Innovation and Entrepreneurship
2016 - 2020
ShanghaiTech University
-
Summer Session
2017
University of California, Berkeley
Publications
(2024).
FedSecurity: A Benchmark for Attacks and Defenses in Federated Learning and Federated LLMs.
In KDD'24 (Acceptance rate: ??.?%).
(2024).
ResolverFuzz: Automated Discovery of DNS Resolver Vulnerabilities with Query-Response Fuzzing.
In USENIX Security ‘24 (Acceptance rate: 17.6%).
(2023).
Kick Bad Guys Out! Zero-Knowledge-Proof-Based Anomaly Detection in Federated Learning.
Under submission.
(2023).
The Maginot Line: Attacking the Boundary of DNS Caching Protection.
In USENIX Security ‘23 (Acceptance rate: 29.2%).
(2023).
Ghost Domain Reloaded: Vulnerable Links in Domain Name Delegation and Revocation.
In NDSS ‘23 (Acceptance rate: 17.4%).
(2022).
Play the Imitation Game: Model Extraction Attack against Autonomous Driving Localization.
In ACSAC ‘22 (Acceptance rate: 24.1%).
(2022).
A Comprehensive Study of DNS Operational Issues by Mining DNS Forums.
In IEEE Access.
Miscs
Awards and Honors
In UC Irvine
- Student travel grant for USENIX Security (2024, 2021)
- Associated Graduate Students Conference Stipend (Winter 2024, Fall 2022)
- 2024 UCI Concerto Competition Winner
- 2023 ANRW Travel Grant
- 2022 ACSAC Student Conferenceship
- Student travel grant for NDSS (2021)
- Student travel grant for IEEE Symposium on Security and Privacy (2021)
In ShanghaiTech
- 2020 ShanghaiTech Outstanding Graduate
- SIST Outstanding Teaching Assistant (2020, 2019, 2018)
- Merit Student (2018-2019, 2017-2018, 2016-2017)
- Outstanding Personnel in 2017 Summer Camp
Services
Program Committee
Artifact Evaluation Committee
External Reviewer
- Conferences:
- NDSS: 2025, 2023, 2022, 2021
- SecureComm: 2023
- AsiaCCS: 2022, 2021
- Journals:
- IEEE Transactions on Transactions on Information Forensics & Security (T-IFS)
- IEEE Transactions on Wireless Communications (TWC)
- IEEE Internet of Things (IEEE IoT)
- Elsevier Computer Networks
- Elsevier High-Confidence Computing
- Springer Peer-to-Peer Networking and Applications (PPNA)
- PeerJ Computer Science
Teaching
In UC Irvine
- (Head TA) EECS 148 (S24): Computer Networks (#students: 217)
- (Head TA in F23) EECS 40 (F23, F22): Objected Oriented Systen and Programming (#students: 90/95)
In ShanghaiTech
- SI 100C (F17): Introduction to Computer Science and Technology (#students: 127)
- CS 100 (F18): Programming (#students: 243)
- CS 277 (F19): Introduction to Data Science and FinTech (#students: 23)
- (core TA) SI 100B (S18, S19, S20): Introduction to Information Science and Technology (#students: 203/174/410)
Classical Music
Qifan Zhang is also a crazy fan of classical music. Since the age of 7, Qifan starts to learn the clarinet under the supervision of Prof. Xie Jingquan, Prof. Tian Yaohui and Prof. Wang Zhenxian from Nanjing University of Arts. After he came to the United States, he is honored to follow the instruction of Prof. Boris Allakhverdyan, principal clarinetist of Los Angeles Philharmonic as well as faculty member of Herb Alpert School of Music, University of California, Los Angeles.
Many thanks to Prof. Dr. Geoffrey Pope and Prof. Emeriti Dr. Stephen Tucker, he has been appointed as the principal clarinetist of UCI Symphony Orchestra, Department of Music since 2020.
In Feb 2024, Qifan won 2024 UCI Concerto Competition.
List of selected performance recordings:
-
Clarinet Concerto No.1, Op.26, Mvt. I by Louis Spohr
- Winning piece for 2024 UCI Concerto Competition
- Video recording
- With pianist Prof. Dr. Alin Melik-Adamyan. Available on YouTube and Bilibili.
- With the UCI Symphony Orchestra in the UCI Winter 2024 concert on Mar 7, 2024 at Irvine Barclay Theatre. Available on YouTube and Bilibili.
-
Der Hirt auf dem Felsen (Shepherd on the Rock), D.965 by Franz Schubert.
- Collaborated with Ivanna Vargas (soprano) and Junko Nojima (piano)
- Video recording available on YouTube and Bilibili.
Copyright of the headshot photo is reserved by UC Regents for UCI Connect. You could find a short interview of me here.
Every serious classical clarinetist will own both a B-flat and an A clarinet.