Biography

Understanding reliability across global AIoT supply chains and their real-world impact.

I study how security breaks across the global AIoT supply chain, from white-label manufacturing to cross-border marketplaces that distribute insecure, increasingly AI-enabled devices at scale. My work focuses on safeguarding vulnerable user groups, including households and children, whose devices often inherit systemic weaknesses from opaque upstream vendors. I combine Internet-wide measurements, device and firmware reverse engineering, and machine learning to uncover structural risks, and to examine how AI is reshaping both the threats to and the defenses available for connected ecosystems.

Research Interests

  • AIoT
  • Machine Learning
  • Network Security
  • Supply Chain
  • Vulnerable Group Security
  • Enterprise Security

Education

  • Ph.D. IoT and Supply Chain Hasso Plattner Institue · In Pursuit
  • M.Sc. Networking San Jose State University · 2020
  • B.Sc. Computer and Electrical Engineering Purdue University · 2018

Vulnerability Disclosures

Vulnerabilities I discovered and disclosed through my research.

  • CVE-2026-9219 Medium · 6.5 CWE-340

    Registration ID is predictably derived from the device IMEI with no extra authentication at enrollment, letting an attacker enroll devices belonging to other users.

  • CVE-2026-9220 High · 7.5 CWE-321

    Requests between the device and backend are encrypted with static, hardcoded AES keys and initialization vectors, allowing an attacker to decrypt the traffic.

  • CVE-2026-9221 High · 7.5 CWE-327

    Request signatures use MD5, which can be reversed to recover the session ID and impersonate a legitimate user for authenticated API calls.

  • CVE-2026-9222 High · 8.1 CWE-836

    The backend accepts the password hash itself for authentication, so an attacker who obtains the hash can authenticate and gain full access.

Recent Publications

Hand-curated highlights; browse the full list on Google Scholar or via DOI links.

See all records

When Assessment Propagates Insecurity: How Inter-Organizational Supply Chain Security Assessment Decouples Awareness from Practice

ACM CCS 2026 Acceptance Rate 8.3% · Supply Chain Security, Security Assessment, Organizational Practice

This paper examines how inter-organizational supply chain security assessments can spread insecurity by separating organizations’ awareness of security risks from their security practices.

Huancheng Hu, Christian Doerr

Security in the Air: Understanding IoT Vendor Practices and the Economics of Over-the-Air Updates

USENIX 2026 · IoT Security, Over-the-Air Updates, Security Economics

This paper analyzes how IoT vendors design, operate, and sustain OTA firmware-update pipelines across fragmented device supply chains. It connects technical constraints such as upstream SDK and chipset dependencies, firmware reuse, signing infrastructure, and hardware limitations with the economic forces that determine update frequency, support duration, and long-term device security.

Huancheng Hu, Christian Doerr

A Kinetic-Energy Perspective of Flow Matching

ICML 2026 Spotlight Top 2.2% · Generative Models, Flow Matching, Machine Learning

We introduce Kinetic Path Energy (KPE), an action-like, per-sample diagnostic measuring accumulated kinetic effort along ODE trajectories in flow-based generative models. Higher KPE predicts stronger semantic fidelity but extreme energies drive memorization, motivating Kinetic Trajectory Shaping (KTS), a training-free inference strategy that improves generation quality.

Ziyun Li, Huancheng Hu, et al.

arXiv: 2602.07928

Beyond the Device: A Security Analysis of White-Label Children’s Smartwatches and Their Ecosystem

AsiaCCS 2026 · Vulnerable Group Security, IoT Security, Supply Chain

White-label children’s smartwatches are built in supply chains by thin margins and weak oversight, creating systemic security gaps for vulnerable children. This paper presents the first comprehensive analysis exposing new critical vulnerabilities across firmware, apps, cloud backends, and the supply chain itself.

Huancheng Hu, Christian Doerr

LotBoNC: Novel Botnet Traffic Classification under Long-tailed Distributions

AsiaCCS 2026 · Network Security, IoT Security, Machine Learning

In operational networks, botnet traffic is long-tailed, dominated by common classes, and constantly enriched by rare, unseen variants. To address this, we propose LotBoNC, a unified framework tailored for long-tailed, open-world encrypted traffic.

Huancheng Hu, Ziyun Li, Christian Doerr

BoNC: Discovering and Classifying Novel Encrypted Botnet Traffic

Open Journal of Communication Societies (OJCOMS) · Network Security, IoT Security, Machine Learning

This paper presents BoNC, a unified framework that accurately detects and classifies both known and previously unseen encrypted botnet traffic in open-world environments.

Huancheng Hu, Ziyun Li, Christian Doerr

DOI: 10.1109/OJCOMS.2025.3638985

Opening a Can of Worms: A Comprehensive View into the Android Debug Bridge Malware

TrustCom 2025 · IoT Security

We present the first comprehensive study of ADB-targeting worms, analyzing over seven years of real-world data encompassing 1.7 million infected IPs and more than 6 billion compromise attempts.

Huancheng Hu, Christian Doerr

DOI: 10.1109/Trustcom66490.2025.00023

Contact

Let’s collaborate on building a more reliable and trustworthy global AIoT supply chain.

For collaboration opportunities, drop me a message.

  • huancheng.hu@hpi.de

    • Search Publications

    Start typing to filter publications. Press Escape or click × to close.