CV

Education, experience, projects, publications, and skills.

Contact Information

Name Mingjie Shen
Email shen497@purdue.edu
Website https://szsam.github.io/

Experience

  • 2023 - present

    West Lafayette, IN

    Research Assistant
    Purdue University
    Static analysis and LLM-agent research under Prof. Aravind Machiry; responsible disclosure and upstream patching of defects in open-source software.
  • 2024 - 2024

    Hanover, NH

    Visiting Student Intern (full-time)
    Dartmouth College
    Worked with Prof. Christophe Hauser on Aithos, an LLM-agent SAST triage framework (RAID 2026).

Summary

  • PhD student in ECE at Purdue working on software security, static program analysis, and AI for software engineering. Built Aithos, a tool-augmented LLM-agent framework that filters 78% of SAST false positives while keeping 97.5% of true positives (RAID 2026); applied CodeQL to 258 open-source embedded projects, finding 709 defects (ISSTA 2025); currently building LLM agents that synthesize CodeQL queries and program-transformation rules for EDK2 UEFI firmware. Over 100 of my patches have been merged upstream into projects including Apache NuttX, Contiki-NG, Mbed OS, RIOT, SDL, zstd, and util-linux. Seeking full-time software security or systems engineering roles in industry.

Education

  • 2019 - present

    West Lafayette, IN, USA

    PhD
    Purdue University
    Electrical and Computer Engineering
    • Advisor: Prof. Aravind Machiry
    • GPA: Plan-of-Study 3.87, Overall 3.58
  • 2015 - 2019

    Nanjing, China

    BSc
    Nanjing University
    Computer Science and Technology
    • GPA: 4.58/5.0 (top 4%), Major GPA: 4.66/5.0

Projects

  • 2025 - present
    LLM Agents for Static Analysis of EDK2 UEFI Firmware
    • Building LLM agents that generate EDK2-specific CodeQL queries for UEFI vulnerability discovery.
    • Learning symbolic program-transformation rules to automate collateral evolution across EDK2.
  • 2024 - 2026
    Aithos: LLM-Agent Triage of Static Analysis Alerts
    • Designed an LLM agentic framework that classifies SAST alerts from natural-language guidelines, dynamically retrieving program context through LLVM-based analysis primitives.
    • Added a feedback loop that turns developer corrections into reusable, repository-specific examples.
    • Preserved 97.5% of true positives while filtering 78.0% of false positives across four SAST tools on real-world C/C++ projects, outperforming a state-of-the-art baseline.
    • Uncovered 90 unknown bugs in 28 popular Debian packages; fixes merged in zstd, util-linux, pciutils.
  • 2023 - 2024
    Detecting 709 Defects in Open-Source Embedded Software with CodeQL
    • Ran CodeQL across 258 GitHub projects; found 709 true defects at a 34% false positive rate, 535 (75%) likely security vulnerabilities (e.g., null pointer dereference, buffer overflow).
    • Got 376 (53%) defects confirmed by maintainers, mainly by submitting and merging pull requests to projects including those by Microsoft, Amazon, and the Apache Foundation; 2 CVEs issued.
    • Opened pull requests adding CodeQL scans to CI pipelines; 37 (71% of active repositories) merged.
  • 2022 - 2023
    Detecting Layering Violations in Embedded Systems
    • Developed a static analysis tool to detect MMIO accesses bypassing the HAL.
    • Analyzed 988 applications across 5 RTOSes; identified 369 violations.

Publications

Skills

Languages: C, C++, Python, Bash
Frameworks: CodeQL, LLVM, LangChain, GitHub Actions
Areas: Static Analysis, Software Security, LLM Agents, Embedded Systems