publications

2027

1. SIGMETRICS’27

   LEO Topology Design Under Real-World Deployment Constraints

   Muaz Ali and Beichuan Zhang

   ACM SIGMETRICS (POMACS), 2027

   (to appear)

   • System Design
   • Satellite Networks

   Paper coming soon

2026

1. arXiv’26

   Starlink Constellation: Deployment, Configuration, and Dynamics

   Muaz Ali^*, Utkarsh Upadhyay^*, Sean McCormick, Joseph Hill, and Beichuan Zhang

   2026

   *Joint first authors

   • Satellite Networks
   • Internet Measurement

   DOI PDF
2. Euro S&P’26

   Attacking the First-Principle: A Black-Box, Query-Free Targeted Mimicry Attack on Binary Function Classifiers

   Gabriel Sauger, Jean-Yves Marion, Sazzadur Rahaman, Vincent Tourneur, Victor Matrat, and Muaz Ali

   In 2026 IEEE European Symposium on Security and Privacy (EuroS&P), 2026

   • AI Safety

   PDF
3. NINeS’26

   Don’t Get Caught, Keep Your Onions in a Vault

   Humza Ikram^*, Rumaisa Habib^*, Muaz Ali^*, and Zartash Afzal Uzmi

   In Proceedings of NINeS, 2026

   *Joint first authors

   • System Design

   PDF

2025

1. PETS’25

   Does Coding Style Really Survive Compilation? Stylometry of Executable Code Revisited

   Muaz Ali, Tugay Bilgis, Nimet Beyza Bozdag, Saumya Debray, and Sazzadur Rahaman

   Proceedings on Privacy Enhancing Technologies, 2025

   • AI Safety

   DOI PDF

2023

1. ESORICS’23

   SoK: A Tale of Reduction, Security, and Correctness - Evaluating Program Debloating Paradigms and Their Compositions

   Muaz Ali, Muhammad Muzammil, Faraz Karim, Ayesha Naeem, Rukhshan Haroon, Muhammad Haris, Huzaifah Nadeem, Waseem Sabir, Fahad Shaon, Fareed Zaffar, Vinod Yegneswaran, Ashish Gehani, and Sazzadur Rahaman

   In Computer Security – ESORICS 2023: 28th European Symposium on Research in Computer Security, The Hague, The Netherlands, September 25–29, 2023, Proceedings, Part IV, The Hague, The Netherlands, 2023

   • Software Security

   Abstract DOI PDF

   Automated software debloating of program source or binary code has tremendous potential to improve both application performance and security. Unfortunately, measuring and comparing the effectiveness of various debloating methods is challenging due to the absence of a universal benchmarking platform that can accommodate diverse approaches. In this paper, we first present DEBLOATBENCHA (Debloating benchmark for applications), an extensible and sustainable benchmarking platform that enables comparison of different research techniques. Then, we perform a holistic comparison of the techniques to assess the current progress.In the current version, we integrated four software debloating research tools: Chisel, Occam, Razor, and Piece-wise. Each tool is representative of a different class of debloaters: program source, compiler intermediate representation, executable binary, and external library. Our evaluation revealed interesting insights (i.e., hidden and explicit tradeoffs) about existing techniques, which might inspire future research. For example, all the binaries produced by Occam and Piece-Wise were correct, while Chisel significantly outperformed others in binary size and Gadget class reductions. In a first-of-its-kind composition, we also combined multiple debloaters to debloat a single binary. Our performance evaluation showed that, in both ASLR-proof and Turing-complete gadget expressively cases, several compositions (e.g., Chisel-Occam, Chisel-Occam-Razor) significantly outperformed the best-performing single tool (i.e., Chisel).

2. IEEE SecDev’23

   BLADE: Towards Scalable Source Code Debloating

   Muaz Ali, Rumaisa Habib, Ashish Gehani, Sazzadur Rahaman, and Zartash Uzmi

   In 2023 IEEE Secure Development Conference (SecDev) , Oct 2023

   • System Design

   Abstract DOI PDF

   Existing source code debloaters fall short due to low scalability and high runtime overhead when applied in dynamic cloud settings, where instances are spun up on the fly. To address this challenge, we propose BLADE that leverages the common coding idioms and language restrictions to build simple yet effective heuristics for faster source-code debloating. For example, usually, coding constructs are defined before used. Thus, the probability of breaking code after the removal of a node reduces with the depth of its position in the syntax tree. Also, while debloating certain functionalities, statements from a basic block have a higher possibility of getting removed together. To utilize these insights, BLADE employs a hierarchical source code reduction, where reduction candidates are chosen with reverse pre-order traversal, so that it removes uses before the definitions. Low runtime overhead makes BLADE practical to apply code debloating to large workloads. Our evaluation shows that BLADE runs faster than existing source code debloating tools. Compared to Chisel, BLADE is, on average, 2.3\times faster and provides comparable reductions in the code size and attack surfaces. In comparison to Debop, another source code debloater, BLADE, on average, is 2.75\times faster.