# Experimental Security Lab (XSL)

> XSL is a security research group at Virginia Tech. We collect and analyze the data needed to improve the security of deployed systems.

All pages are static HTML. Structured data is also available as JSON and BibTeX.

## Machine-readable
- [Papers (JSON)](https://xsl.fyi/papers.json): every paper with authors, venue, topics, links, and abstract where available
- [Papers (BibTeX)](https://xsl.fyi/papers.bib)
- [Dataset catalog (JSON)](https://xsl.fyi/data/catalog.json): schemas, coverage, access terms, and query endpoints
- [News (RSS)](https://xsl.fyi/rss.xml)

## Research
- [IP address reuse in public clouds](https://xsl.fyi/research/cloud-address-reuse/): Cloud providers reassign IP addresses between tenants. Configuration that still points at a released address sends the old tenant's traffic to the next holder.
- [Cloud telescopes](https://xsl.fyi/research/cloud-telescopes/): DScope collects scanning traffic from short-lived cloud addresses instead of unused address space, and observes attacks aimed at cloud services.
- [Vulnerability lifecycles](https://xsl.fyi/research/vulnerability-lifecycle/): We date real-world exploitation of 63 vulnerabilities from two years of scanning traffic and use the dates to evaluate coordinated disclosure.
- [Measurement ethics](https://xsl.fyi/research/measurement-ethics/): Internet measurement processes data from people who could not consent to its collection. We study the norms that justify it and apply them to our own collection.

## Data
- [Data overview and access tiers](https://xsl.fyi/data/)
- [AWS spot price history](https://xsl.fyi/data/aws-spot-price-history/): EC2 spot prices for every availability zone, instance type, and operating system, published monthly.
- [DScope cloud telescope data](https://dscope.org/): Traffic from scanners contacting public cloud IP addresses, collected by DScope, a cloud-native interactive Internet telescope on AWS. Operated by Terrace Networks.

## Papers
- [Honey Configs: Measuring The Emerging Exploitation of Cloud IP Address Reuse](https://xsl.fyi/papers/imc26-honey-configs/): ACM IMC 2026, 2026
- [Split Alignment: Diffusing SPF Vulnerabilities With DMARC](https://xsl.fyi/papers/imc26-split-alignment/): ACM IMC 2026, 2026
- [Clouds Are Where the (Security) Action Is: Have Honeypots Been Left in the Dust?](https://xsl.fyi/papers/msec25-cloud-honeypots/): IEEE Security & Privacy, 2025
- [Secure IP Address Allocation at Cloud Scale](https://xsl.fyi/papers/ndss25-ip-allocation/): NDSS 2025, 2025
- [Understanding the Ethical Frameworks of Internet Measurement Studies](https://xsl.fyi/papers/ethics23-measurement-ethics/): EthiCS 2023, 2023
- [The CVE Wayback Machine: Measuring Coordinated Disclosure from Exploits against Two Years of Zero-Days](https://xsl.fyi/papers/imc23-cve-wayback-machine/): ACM IMC 2023, 2023
- [DScope: A Cloud-Native Internet Telescope](https://xsl.fyi/papers/usenix23-dscope/): USENIX Security 2023, 2023
- [Performant Binary Fuzzing without Source Code using Static Instrumentation](https://xsl.fyi/papers/cns22-binary-fuzzing/): IEEE CNS 2022, 2022
- [Measuring and Mitigating the Risk of IP Reuse on Public Clouds](https://xsl.fyi/papers/oakland22-cloud-squatting/): IEEE S&P 2022, 2022
- [Static Instrumentation for Performant Binary Fuzzing](https://xsl.fyi/papers/ms-thesis-static-instrumentation/): M.S. thesis, Penn State, 2020

## Lab
- [People](https://xsl.fyi/people/)
- [Join](https://xsl.fyi/join/): how to apply as a PhD student, VT student, or visitor
- [Scanning and ethics](https://xsl.fyi/scanning/): what our research systems send and collect
- [Contact](https://xsl.fyi/contact/)