Hwiwon Lee

I’m a PhD student in Computer Science at UIUC, advised by Lingming Zhang.

Before beginning my PhD, I served as a cybersecurity specialist (Captain) in the Republic of Korea Air Force (ROKAF) for seven years, tackling fundamental cybersecurity problems from a practical perspective. My years of experience participating in hacking competitions with exceptional teams like CyKor, DEFKOR, and DEFKOR00T have solidified my cybersecurity expertise, and I’m honored to have won first place at DEFCON CTF in both 2015 and 2018.

My research interests lie in the areas of software security and engineering and machine learning. I focus on leveraging program analysis and machine learning techniques to improve the security and reliability of software systems. Examining unforeseen challenges that arise when applying the current machine learning models to the cybersecurity space is another area of interest for me.

news

Jul 17, 2025	Listed on MSRC’s 2025 Most Valuable Security Researcher Leaderboard!
Jun 13, 2025	SEC-bench has been released!
May 19, 2025	Started Applied Scientist Intern position at for this summer!
Aug 26, 2024	Started my PhD journey at UIUC
May 21, 2024	BENZENE awarded the Distinguished Paper Award (<1% of 1463 submissions) at IEEE S&P 2024

selected publications

IEEE S&P

BENZENE: A Practical Root Cause Analysis System with an Under-Constrained State Mutation Distinguished Paper

Younggi Park, Hwiwon Lee, Jinho Jung, and 2 more authors

In 2024 IEEE Symposium on Security and Privacy, 2024

Abs HTML

Fuzzing has demonstrated great success in bug discovery, and plays a crucial role in software testing today. Despite the increasing popularity of fuzzing, automated root cause analysis (RCA) has drawn less attention. One of the recent advances in RCA is crash-based statistical debugging, which leverages the behavioral differences in program execution between crash-triggered and non-crashing inputs. Hence, obtaining non-crashing behaviors close to the original crash is crucial but challenging with previous approaches (e.g., fuzzing). In this paper, we present BENZENE, a practical end-to-end RCA system that facilitates a fully automated crash diagnosis. To this end, we introduce a novel technique, called underconstrained state mutation, that generates both crashing and non-crashing behaviors for effective and efficient RCA. We design and implement the BENZENE prototype, and evaluate it with 60 vulnerabilities in the wild. Our empirical results demonstrate that BENZENE not only surpasses in performance (i.e., root cause ranking), but also achieves superior results in both speed (4.6 times faster) and memory footprint (31.4 times less) on average than prior approaches.