I'm a Ph.D student from CS Department, USC since 2014 Fall. I work in Analysis of Network Traffic (ANT) group with my advisor Prof. John Heidemann at Information Sciences Institute (ISI).

I received my B.S. in Telecommunications Engineering from Beijing University of Posts and Telecommunications in 2014.

My research interests are Internet traffic analysis, Internet-of-Thing and network security. I previously focused on detecting and explaining ICMP filtering in the Internet, detecting IoT devices by passive network measurements for security purposes and evaluating and interpretaing Machine-learning-based anomaly detection of DDoS to cloud. I am currently working on developing source-end defense to IoT-based DDoS attack.

Education

• University of Southern California, Los Angeles, California
  Ph.D. student in Computer Science since 2014, advised by Prof. John Heidemann
  
• Beijing University of Posts and Telecommunications, Beijing, China
  B.S. Telecommunications Engineering, 2010 - 2014

Publications

• Hang Guo, John Heidemann. Detecting IoT Devices in the Internet. To appear in IEEE/ACM Transactions on Networking (ToN). August 2020.

• Hang Guo, John Heidemann. IoTSTEED: Bot-side Defense to IoT-based DDoS Attacks (Extended). USC/ISI Technical Report ISI-TR-738. June 2020. [pdf]

• Hang Guo, Xun Fan, Anh Cao, Geoff Outhred, John Heidemann. Peek Inside the Closed World: Evaluating Autoencoder-Based Detection of DDoS to Cloud. arXiv preprint arXiv:1912.05590. Dec 2019. [pdf]

• Hang Guo, John Heidemann. IP-Based IoT Device Detection. Workshop on Internet of Things Security and Privacy (IoT S&P). Budapest, Hungary. Aug 2018. [pdf] [slides]

• Hang Guo, John Heidemann. Detecting IoT Devices in the Internet (Extended). USC/ISI Technical Report ISI-TR-726B. July 2018. [pdf]

• Hang Guo, John Heidemann. Detecting ICMP Rate Limiting in the Internet. Passive and Active Measurement Conference (PAM). Berlin, Germany. March 2018. [pdf] [slides]

• Hang Guo, John Heidemann. Detecting ICMP Rate Limiting in the Internet (Extended). USC/ISI Technical Report ISI-TR-717. April 2017. [pdf]

Software

• IoTSTEED — bot-side defense to IoT-based DDoS attacks from edge router

• rejwreply — a Linux kernel patch that adds echo-reply to feedback type of iptable REJECT rule

Datasets (Please contact me for data)

• IoT_Bootup_Traces-20161207 — Boot-up traffic pcaps for 6 IoT devices. Data citation: "H. Guo and J. Heidemann, Detecting IoT Devices in the Internet (Extended). USC/ISI Technical Report ISI-TR-726B"

• IoT_Bootup_Traces-20181107 — Boot-up traffic pcaps for 11 IoT devices. Data citation: "H. Guo and J. Heidemann, Detecting IoT Devices in the Internet (Extended). USC/ISI Technical Report ISI-TR-726B"

• IoT_Operation_Traces-20200127 — 10-day operational traffic from 14 IoT devices (including device boot-up). Data citation: "H. Guo and J. Heidemann, IoTSTEED: Bot-side Defense to IoT-based DDoS Attacks (Extended). USC/ISI Technical Report ISI-TR-738"