Publications

2026

Secret State Leakage Attacks and Their Impacts on EMV Contactless Payment Apps.

Jesse Chen, Rubin Yuchan Yang, Ahmad Musa, Syed Rafiul Hussain, Omar Chowdhury, Sazzadur Rahaman.
The IEEE Security and Privacy (Oakland'26). Oakland, California, USA. May, 2026.

PDF

Attacking the First-Principle: A Black-Box Query-Free Targeted Mimicry Attack on Binary Function Classifiers.

Gabriel Sauger, Jean-Yves Marion, Sazzadur Rahaman, Vincent Tourneur, Muaz Ali, Victor Matrat.
The European Symposium on Security and Privacy (Euro S&P'26). Lisbon, Portugal. July, 2026.

PDF

The Tragedy of Convenience: Cascading User-Data Leakage from SMS-delivered URLs.

Muhammad Danish, Enrique Sobrados, Priya Kaushik, Bhupendra Acharya, Muhammad Saad, Abdullah Mueen, Sazzadur Rahaman, Afsah Anwar.
The 33rd ACM Conference on Computer and Communications Security (CCS 26). The Hague, The Netherlands. November, 2026.

PDF

Investigating Shadow IT Use and Adoption in Educational Institutions and their Privacy Implications.

Easton Kelso, Ananta Soneji, Syed Zami-Ul-Haque Navid, Yan Soshitaishvili, Sazzadur Rahaman, Rakibul Hasan.
Conference on Sociotechnical Cybersecurity and Privacy (SCP 26). Belval, Luxembourg. September, 2026.

PDF

GraphQLify: Automated and Type Safety-Preserving GraphQL API Adoption.

Saleh Amareen, Arif Rahman, Sazzadur Rahaman, Amiangshu Bosu.
The ACM International Conference on the Foundations of Software Engineering (FSE). Montreal, Canada. July, 2026.

PDF

Private Evaluation Protocol: Contamination-Resistant Black-Box Evaluation via Public-Slice Surrogates.

Md. Mahadi Hassan, Md Yusuf Sarwar Uddin, Sazzadur Rahaman, Santu Karmaker.
The 5th Asia-Pacific Chapter of the Association for Computational Linguistics & the 15th International Joint Conference on Natural Language Processing (AACL-IJCNLP). Hengqin, China. November, 2026.

PDF

2025

On the Characteristics and Impacts of Protestware Libraries.

Tanner Finken*, Jesse Chen*, Sazzadur Rahaman.
The ACM International Conference on the Foundations of Software Engineering (FSE). Trondheim, Norway. June, 2025. (*: co-first authors)

PDF

Does Stylomery Really Survive Compilation? Binary Code Stylometry Revisited.

Muaz Ali, Tugay Bilgis, N. Beyza Bozdag, Saumya Debray, Sazzadur Rahaman.
25th Privacy Enhancing Technologies Symposium (PETS 2025). Washington, DC, USA and Online. July, 2025.

PDF

2024

Impeding LLM-assisted Cheating in Introductory Programming Assignments via Adversarial Perturbation.

Saiful Islam Salim*, Rubin Yuchan Yang*, Alexander Cooper*, Suryashree Ray, Saumya Debray, Sazzadur Rahaman.
The 2024 Conference on Empirical Methods in Natural Language Processing (EMNLP). Miami, Florida. November, 2024. (*: co-first authors)

PDF

On the Contents and Utility of IoT Cybersecurity Guidelines.

Jesse Chen, Dharun Anandayuvaraj, James Davis, Sazzadur Rahaman.
ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering (ESEC/FSE). Porto de Galinhas, Brazil. July, 2024.

PDF

Trust, Because You Can't Verify: Privacy and Security Hurdles in Education Technology Acquisition Practices.

Easton Kelso, Ananta Soneji, Sazzadur Rahaman, Yan Soshitaishvili, Rakibul Hasan.
ACM Conference on Computer and Communications Security (CCS'24). Salt Lake City, Utah, USA. October 2024.

PDF

2023

Bilingual Problems: Studying the Security Risks Incurred by Native Extensions in Scripting Languages.

Cristian-Alexandru Staicu, Sazzadur Rahaman, Ágnes Kiss, Michael Backes.
32nd USENIX Security Symposium. Anaheim, CA, USA. August, 2023.

PDF

The Queen’s Guard: A Secure Enforcement of Fine-grained Access Control In Distributed Data Analytics Platforms.

Fahad Shaon*, Sazzadur Rahaman*, Murat Kantarcioglu (* co-first authors)
The Annual Computer Security Applications Conference (ACSAC). Austin, Texas, USA. December, 2023.

PDF

A Tale of Reduction, Security and Correctness: Evaluating Program Debloating Paradigms and Their Compositions.

Muaz Ali, Muhammad Muzammil, Faraz Karim, Ayesha Naeem, Rukhshan Haroon, Muhammad Haris, Huzaifa Nadeem, Waseem Sabir, Fahad Shaon, Fareed Zaffar, Vinod Yegneswaran, Ashish Gehani and Sazzadur Rahaman
28th European Symposium on Research in Computer Security (ESORICS). Hague, Netherlands. September, 2023.

PDF

Evaluating Container Debloaters.

Muhammad Hassan*, Talha Tahir*, Muhammad Farrukh, Abdullah Naveed, Anas Naeem, Fareed Zaffar, Fahad Shaon, Ashish Gehani and Sazzadur Rahaman (* co-first authors)
IEEE Secure Development Conference. Atlanta, GA. October, 2023.

PDF

Blade: Towards Scalable Source Code Debloating.

Muaz Ali, Rumaisa Habib, Ashish Gehani, Sazzadur Rahaman and Zartash Uzmi.
IEEE Secure Development Conference. Atlanta, GA. October, 2023.

PDF

SpanL: A Language for Screening Improper Use of Security APIs in High-level Languages.

Sazzadur Rahaman, Miles Frantz, Barton Miller and Danfeng Yao.
Secure Cryptographic Implementation Workshop collocated with 21st International Conference on Applied Cryptography and Network Security (ACNS), 2023.

PDF

2022

Being the Developers' Friend: Our Experience Developing a High-Precision Tool for Secure Coding.

Danfeng (Daphne) Yao, Sazzadur Rahaman, Ya Xiao, Sharmin Afrose, Miles Frantz, Ke Tian, Na Meng, Cristina Cifuentes, Yang Zhao, Nicholas Allen, Nathan Keynes, Barton Miller, Elisa Heymann, Fahad Shaon, Murat Kantarcioglu.
IEEE Security and Privacy Journal.

PDF

Evaluation of Static Vulnerability Detection Tools with Java Cryptographic API Benchmarks.

Sharmin Afrose, Ya Xiao, Sazzadur Rahaman, Barton Miller, Danfeng (Daphne) Yao.
IEEE Transactions on Software Engineering (TSE). 2022.

IEEE

“If security is required”: Engineering and Security Practices for Machine Learning-based IoT Devices.

Nikhil Gopalakrishna, Dharun Anandayuvaraj, Annan Detti, Forrest Lee Bland, Sazzadur Rahaman, James Davis.
SERP4IoT workshop collocated with ACM/IEEE International Conference on Software Engineering (ICSE). 2022.

PDF

2021

Optimization to the Rescue: Evading Binary Code Stylometry with Adversarial Use of Code Optimizations.

Ben Jacobsen, Sazzadur Rahaman, Saumya Debray.
The CheckMATE workshop collocated with the ACM Conference on Computer and Communications Security (CCS'21). Virtual Conference. November 2021.

PDF

From Theory to Code: Identifying Logical Flaws in Cryptographic Implementations.

Sazzadur Rahaman, Haipeng Cai, Omar Chowdhury and Danfeng (Daphne) Yao.
IEEE Transactions on Dependable and Secure Computing (TDSC). 2021.

PDF

2020

Coding Practices and Recommendations of Spring Security for Enterprise Applications.

Mazharul Islam, Sazzadur Rahaman, Na Meng, Behnaz Hassanshahi, Padmanabhan Krishnan, Danfeng (Daphne) Yao.
IEEE Secure Development Conference. Atlanta, GA, September 2020.

PDF

2019

Security Certification in Payment Card Industry: Testbeds, Measurements, and Recommendations.

Sazzadur Rahaman, Gang Wang, Danfeng (Daphne) Yao.
ACM Conference on Computer and Communications Security (CCS'19). London, United Kingdom. November 2019.

PDF Source code: PciCheckerLite, BuggyCart

CryptoGuard: High Precision Detection of Cryptographic Vulnerabilities in Massive-sized Java Projects.

Sazzadur Rahaman, Ya Xiao, Sharmin Afrose, Fahad Shaon, Ke Tian, Miles Frantz, Murat Kantarcioglu, Danfeng (Daphne) Yao.
ACM Conference on Computer and Communications Security (CCS'19). London, United Kingdom. November 2019.

PDF Source Code Adopted by Oracle ACM News

CryptoAPI-Bench: A Comprehensive Benchmark on Java Cryptographic API Misuses.

Sharmin Afrose, Sazzadur Rahaman, Danfeng (Daphne) Yao.
2019 IEEE Secure Development Conference. McLean, VA. September 2019.

PDF Source Code

2017

Provably Secure Anonymous-yet-Accountable Crowdsensing with Scalable Sublinear Revocation.

Sazzadur Rahaman, Long Cheng, Danfeng (Daphne) Yao, He Li, and Jung-Min (Jerry) Park.
The 17th Privacy Enhancing Technologies Symposium (PETS). Minneapolis, MN, USA. July, 2017.

PDF

Toward Automatic Program Analysis of Cryptography Implementations for Security.

Sazzadur Rahaman, Danfeng (Daphne) Yao.
2017 IEEE Secure Development Conference. Cambridge, MA, USA. September, 2017.

PDF

Before '17

Antibandwidth Problem for Itchy Caterpillars

Sazzadur Rahaman, Tousif Ahmed Eshan, Sad Al Abdullah.
2014 International Conference on Informatics, Electronics & Vision (ICIEV). Dhaka, Bangladesh. May, 2014.

PDF

A Novel Approach for Constructing Emulator for Microsoft Kinect XBOX 360 Sensor in the .NET Platform

Mohammad Raihanul Islam, Sazzadur Rahaman, Rakibul Hasan, Ridwan Rashid Noel, Asif Salekin, and Hasan Shahid Ferdous.
4th International Conference on Intelligent Systems Modelling & Simulation (ISMS). Bangkok, Thailand. January, 2013.

PDF

Section

Patents

US Patents

Fahad Shaon, Sazzadur Rahaman. Systems and methods for proactive and reactive data security. U.S. Application No: 16/698,328 (filed).