Research

I've had three meaningful research experiences so far, and I deeply appreciate all the professors who have guided me along the way. I have also recently started a self-driven line of work on 5G O-RAN security — see the project at the bottom of this page.

Undergraduate Research for Dr. Sheng Wei (2016–2017)

During my undergraduate studies, I worked for Dr. Sheng Wei on digital signatures and potential vulnerabilities in Ring doorbells. Although we didn't publish a paper, I gained valuable insights into hardware and multimedia security.

Later, I participated in the DAC 2018 System Design Contest, where I trained a machine learning model for image recognition — my first exposure to ML research. Dr. Wei is the most hard-working professor I have ever encountered in my life, in the process of pursuing his tenure, he also put most of the burden on himself rather than his students, and he is super nice and down to earth. He is also a family man, which is a great role model for me.

Archived student page

Master's Research for Dr. Shuai Nie (2023–2024)

For Dr. Shuai Nie, I modeled a wireless two-ray propagation system to optimize Wi-Fi access point placement in complex environments using a depth camera in Matlab. This hands-on research deepened my understanding of RF propagation. Dr. Nie is the smartest, and most rigorous professor I have ever worked for, she taught me a lot of deep knowledge and helped me a lot on becoming a better researcher.

Archived group page

Research for Dr. Shubhendu Bhardwaj (2024–Present)

Working for Dr. Bhardwaj, I co-authored a paper (to appear at IEEE-APS 2025) on a wireless temperature sensing system using impedance shifts caused by a bimetallic strip. I led the design and measurement aspects. Dr. Bhardwaj is a man of strong character. He's like a close friend you can truly connect with — kind, honest, and always ready to stand up for you. He constantly thinks about how he can help his students succeed. At the same time, his expertise in RF engineering has made him a highly respected professor. He even has a YouTube channel where he posted a video of himself playing the piano over 10 years ago — something that makes him feel remarkably relatable. He's also passionate about woodworking, running, and hiking — a person who genuinely loves life.

Looking Ahead

I'm interested in pursuing a Ph.D. where wireless communication, human health, and machine learning intersect. We're clearly heading into a future shaped by automation and intelligent systems — so I figured, why not be part of building that future? I want to create wearable tech or smart systems that genuinely help people live better, healthier lives.

I don't think research should be just about chasing publications. It should be about building things that make a difference. Of course, I know not everyone has access to the same resources, and success can depend on many factors beyond talent. That's why I really admire professors who stay passionate about their work, even when things get tough. When someone keeps going despite the setbacks, it shows me that research is a kind of battleground — and I want to be one of the people who step up and keep pushing forward.

Rebuilding a Model-Based O-RAN Fuzzing Pipeline from the Specs (2026)

On my own initiative, I studied ARCANE (ACM MobiCom '25), a model-based fuzzing framework for 5G O-RAN that uses LLMs to extract protocol models from 3GPP specifications — and rebuilt the full pipeline myself, from the source specifications upward: F1AP (TS 38.473) → three independent LLM extractions → FSM refinement against real RAN traces → mutation-based test-case generation with a fully logged elimination funnel → ASN.1 APER encoding → SCTP replay against a live OAI gNB-CU.

The rebuilt pipeline confirmed a real memory-safety vulnerability: an unsolicited F1-Setup-Response — a message the 3GPP specification only ever permits in the opposite direction — crashes the OAI gNB-CU with a segmentation fault (exit 139, SIGSEGV), reproducing the published bug end-to-end through my own toolchain. Paper claims vs. released artifacts are compared explicitly, and every intermediate artifact (prompts, LLM outputs, refinement logs, elimination funnel, wire bytes) is preserved.

📡 Interactive demo: from 3GPP spec to SIGSEGV