Research Scientist at Meta Platforms Inc. and Ph.D. in Computer Engineering at Arizona State University.

Currently affiliated with Meta Platforms Inc.

My research fields focus on the analysis of anti-phishing ecosystem, including phishing behaviors, sophisticated evasion techniques in phishing, and phishing measurements. I am expanding my research interest to a broad range of topics such as underground forum and systems security.

Email: penghuius@gmail.com | CV (updated at Jan, 2025)

Publications

  1. From Victims to Defenders: An Exploration of the Phishing Attack Reporting Ecosystem. (PDF)
    Zhibo Sun, Faris Bugra Kokulu, Penghui Zhang, Adam Oest, Gianluca Stringhini, Tiffany Bao, Ruoyu Wang, Yan Shoshitaishvili, Adam Doupé, and Gail-Joon Ahn.
    In the Proceedings of the 27th International Symposium on Research in Attacks, Intrusions and Defenses (RAID), Sep 2024, Padua, Italy.
  2. I'm SPARTACUS, No, I'm SPARTACUS: Proactively Protecting Users from Phishing by Intentionally Triggering Cloaking Behavior. (PDF)
    Penghui Zhang, Zhibo Sun, Sukwha Kyung, Hans Walter Behrens, Zion Leonahenahe Basque, Haehyun Cho, Adam Oest, Ruoyu Wang, Tiffany Bao, Yan Shoshitaishvili, Gail-Joon Ahn, and Adam Doupé.
    In the Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security (CCS), Nov 2022, Los Angeles, CA, USA.
  3. Having Your Cake and Eating It: An Analysis of Concession-Abuse-as-a-Service. (PDF)
    Zhibo Sun, Adam Oest, Penghui Zhang, Carlos Rubio-Medrano, Tiffany Bao, Ruoyu Wang, Ziming Zhao, Yan Shoshitaishvili, Adam Doupé, and Gail-Joon Ahn.
    In the Proceedings of the 30th USENIX Security Symposium, Aug 2021, Vancouver, B.C., CANADA.
  4. CrawlPhish: Large-scale Analysis of Client-side Cloaking Techniques in Phishing. (PDF)
    Penghui Zhang, Adam Oest, Haehyun Cho, Zhibo Sun, RC Johnson, Brad Wardman, Shaown Sarker, Alexandros Kapravelos, Tiffany Bao, Ruoyu Wang, Yan Shoshitaishvili, Adam Doupé, and Gail-Joon Ahn.
    In the Proceedings of the 42nd IEEE Symposium on Security & Privacy, May 2021,San Francisco, CA.
  5. Scam Pandemic: How Attackers Exploit Public Fear through Phishing. (PDF)
    Marzieh Bitaab, Haehyun Cho, Adam Oest, Penghui Zhang, Zhibo Sun, Rana Pourmohamad, Doowon Kim, Tiffany Bao, Ruoyu Wang, Yan Shoshitaishvili, Adam Doupé, and Gail-Joon Ahn.
    In the Proceedings of the 2020 APWG Symposium on Electronic Crime Research (eCrime).
  6. PhishTime: Continuous Longitudinal Measurement of the Effectiveness of Anti-phishing Blacklists. (PDF)
    Adam Oest, Yeganeh Safaei, Penghui Zhang, Brad Wardman, Kevin Tyers, Yan Shoshitaishvili, Adam Doupé, and Gail-Joon Ahn.
    In the Proceedings of the 29th USENIX Security Symposium, Aug 2020, Boston, MA.
  7. Sunrise to Sunset: Analyzing the End-to-end Life Cycle and Effectiveness of Phishing Attacks at Scale. (PDF)
    Adam Oest, Penghui Zhang, Brad Wardman, Eric Nunes, Jakub Burgis, Ali Zand, Kurt Thomas, Adam Doupé, Gail-Joon Ahn.
    In the Proceedings of the 29th USENIX Security Symposium, Aug 2020, Boston, MA.
  8. iCORE: Continuous and Proactive Extrospection on Multi-core IoT Devices. (PDF)
    Penghui Zhang, Haehyun Cho, Ziming Zhao, Adam Doupé, and Gail-Joon Ahn.
    In the Proceedings of the 34th ACM/SIGAPP Symposium On Applied Computing (SAC), Limassol, Cyprus, Apr 2019.
  9. Prime+Count: Novel Cross-world Covert Channels on ARM TrustZone. (PDF)
    Haehyun Cho, Penghui Zhang, Donguk Kim, Jinbum Park, Choong-Hoon Lee, Ziming Zhao, Adam Doupé, and Gail-Joon Ahn.
    In the Proceedings of the 34th Annual Computer Security Applications Conference (ACSAC), San Juan, Puerto Rico, USA, Dec 2018.
  10. Temperature Balancing among Servers with Workload Distribution. (PDF)
    Penghui Zhang, Committee: Xiaorui Wang, Ümit Çatalyürek.
    Master Thesis Dissertation in the Ohio State University.

Experience Summary

  • Research Scientist at Meta Platforms Inc.
    - Dec 2021 ~ Present
  • Graduate Research Assistant at Security Engineering for Future Computing (SEFCOM)
    - Jan 2017 ~ May 2022
  • InfoSec Tech Ph.D. Intern at PayPal Inc.
    - May 2019 ~ Aug 2019
    - May 2020 ~ Aug 2020
  • Graduate Teaching Assistant at Arizona State University
    on CSE 110(Java), CSE 230(Computer Architecture), and CSE 469(Computer&Network Forensics)
    - Aug 2016 ~ May 2017

Awards

  • Best Student Paper Award
    CrawlPhish: Large-scale Analysis of Client-side Cloaking Techniques in Phishing.
  • Second Place Facebook's Internet Defense Prize
    Distinguished Paper Award
    Sunrise to Sunset: Analyzing the End-to-end Life Cycle and Effectiveness of Phishing Attacks at Scale.
  • Distinguished Poster Award
    SeCore: Continuous Extrospection with High Visibility on Multi-core ARM Platforms.

Education

  • PhD, Computer Engineering, Arizona State University, Tempe, AZ, Aug 2016 ~ May 2022
  • MS, Electrical and Computer Engineering, the Ohio State University, Columbus, OH, Aug 2014 ~ May 2016
    • - Thesis : Temperature Balancing among Servers with Workload Distribution.