| 2026 | NDSS | Connecting the Dots: An Investigative Study on Linking Private User Data Across Messaging Apps. | Junkyu Kang, Soyoung Lee, Yonghwi Kwon, Sooel Son |
| 2026 | WWW | Zelda: Feedback-driven Closed-box Fuzzing for Identifying Web Application Vulnerabilities. | Soyoung Lee, Sunnyeo Park, Yonghwi Kwon, Sooel Son |
| 2026 | WWW | LLMs Killed Q&A Stars? Analyzing the Impact of LLM-Generated Answers on an Online Q&A Platform. | Dongwon Shin, Sooel Son |
| 2026 | SP | Site Isolation is Dead: How Site Isolation is Broken in Agentic Browsers and Extensions. | Suyoung Lee, Seongho Keum, Changoo Lee, Dongwon Shin, Sanghyun Hong, Byoungyoung Lee, Sooel Son |
| 2025 | ACSAC | MOEVIL: Poisoning Experts to Compromise the Safety of Mixture-of-Experts LLMs. | Jaehan Kim, Seung Ho Na, Minkyoo Song, Seungwon Shin, Sooel Son |
| 2025 | AsiaCCS | TrustyMon: Practical Detection of DOM-based Cross-Site Scripting Attacks Using Trusted Types. | Sunnyeo Park, Jihwan Kim, Seongho Keum, Hyunjoon Lee, Sooel Son |
| 2025 | AsiaCCS | Evaluating Robustness of Reference-based Phishing Detectors. | Eunjin Roh, Sungwoo Jeon, Sooel Son, Sanghyun Hong |
| 2025 | ICLR | AdvPaint: Protecting Images from Inpainting Manipulation via Adversarial Attention Disruption. | Joonsung Jeon, Woo Jae Kim, Suhyeon Ha, Sooel Son, Sung-Eui Yoon |
| 2024 | ACSAC | You Only Perturb Once: Bypassing (Robust) Ad-Blockers Using Universal Adversarial Perturbations. | Dongwon Shin, Suyoung Lee, Sanghyun Hong, Sooel Son |
| 2023 | CCS | AdCPG: Classifying JavaScript Code Property Graphs with Explanations for Ad and Tracker Blocking. | Changmin Lee, Sooel Son |
| 2023 | ICML | Margin-based Neural Network Watermarking. | Byungjoo Kim, Suyoung Lee, Seanie Lee, Sooel Son, Sung Ju Hwang |
| 2023 | NDSS | DiffCSP: Finding Browser Bugs in Content Security Policy Enforcement through Differential Testing. | Seongil Wi, Trung Tin Nguyen, Jihwan Kim, Ben Stock, Sooel Son |
| 2023 | WWW | RICC: Robust Collective Classification of Sybil Accounts. | Dongwon Shin, Suyoung Lee, Sooel Son |
| 2022 | Mobisys | HearMeOut: detecting voice phishing activities in Android. | Joongyum Kim, Jihwan Kim, Seongil Wi, Yongdae Kim, Sooel Son |
| 2022 | WWW | Link: Black-Box Detection of Cross-Site Scripting Vulnerabilities Using Reinforcement Learning. | Soyoung Lee, Seongil Wi, Sooel Son |
| 2022 | WWW | HiddenCPG: Large-Scale Vulnerable Clone Detection Using Subgraph Isomorphism of Code Property Graphs. | Seongil Wi, Sijae Woo, Joyce Jiyoung Whang, Sooel Son |
| 2021 | AsiaCCS | Security Analysis on Practices of Certificate Authorities in the HTTPS Phishing Ecosystem. | Doowon Kim, Haehyun Cho, Yonghwi Kwon, Adam Doup, Sooel Son, Gail-Joon Ahn, Tudor Dumitras |
| 2021 | NDSS | The Abuser Inside Apps: Finding the Culprit Committing Mobile Ad Fraud. | Joongyum Kim, Junghwan Park, Sooel Son |
| 2020 | ICNP | Lumos: Improving Smart Home IoT Visibility and Interoperability Through Analyzing Mobile Apps. | Jeongmin Kim, Steven Y. Ko, Sooel Son, Dongsu Han |
| 2020 | NDSS | FUSE: Finding File Upload Bugs via Penetration Testing. | Taekjin Lee, Seongil Wi, Suyoung Lee, Sooel Son |
| 2019 | CCS | An Empirical Study of Prioritizing JavaScript Engine Crashes via Machine Learning. | Sunnyeo Park, Dohyeok Kim, Sooel Son |
| 2019 | NDSS | Cybercriminal Minds: An investigative study of cryptocurrency abuses in the Dark Web. | Seunghyeon Lee, Changhoon Yoon, Heedo Kang, Yeonkeun Kim, Yongdae Kim, Dongsu Han, Sooel Son, Seungwon Shin |
| 2019 | WWW | Doppelgngers on the Dark Web: A Large-scale Assessment on Phishing Hidden Web Services. | Changhoon Yoon, Kwanwoo Kim, Yongdae Kim, Seungwon Shin, Sooel Son |
| 2019 | WISA | FSF: Code Coverage-Driven Fuzzing for Software-Defined Networking. | Hyuntae Kim, Seongil Wi, Hyunjoo Lee, Sooel Son |
| 2018 | CCS | Pride and Prejudice in Progressive Web Apps: Abusing Native App-like Features in Web Applications. | Jiyeon Lee, Hayeon Kim, Junghwan Park, Insik Shin, Sooel Son |
| 2016 | NDSS | What Mobile Ads Know About Mobile Users. | Sooel Son, Daehyeok Kim, Vitaly Shmatikov |
| 2013 | CCS | Diglossia: detecting code injection attacks with precision and efficiency. | Sooel Son, Kathryn S. McKinley, Vitaly Shmatikov |
| 2013 | NDSS | Fix Me Up: Repairing Access-Control Bugs in Web Applications. | Sooel Son, Kathryn S. McKinley, Vitaly Shmatikov |
| 2013 | NDSS | The Postman Always Rings Twice: Attacking and Defending postMessage in HTML5 Websites. | Sooel Son, Vitaly Shmatikov |
| 2011 | OOPSLA | RoleCast: finding missing security checks when you do not know what checks are. | Sooel Son, Kathryn S. McKinley, Vitaly Shmatikov |
| 2011 | PLDI | SAFERPHP: finding semantic vulnerabilities in PHP applications. | Sooel Son, Vitaly Shmatikov |
| 2010 | SecureComm | The Hitchhiker's Guide to DNS Cache Poisoning. | Sooel Son, Vitaly Shmatikov |
| 2008 | SSS | Pharewell to Phishing. | Taehwan Choi, Sooel Son, Mohamed G. Gouda, Jorge Arturo Cobb |