Qi Liu Email and Phone Number

Overall responsibility for the work of the company’s Network and Information Security Department, serving as the department head and guiding the department’s goals and pathways.In 2019, I started researching the concept of AI-driven cybersecurity, leading the team to analyze and mine alert logs from more than 30 different types of cybersecurity products. Using algorithm models (mainly a combination of several algorithms including LightGBM), we conducted analyses such as attack alert classification and attack threat detection, and performed risk profiling and scoring of attacker source IPs. This work resulted in the prioritization of security alerts and brought revolutionary success to BestPay’s security operations, increasing operational efficiency by dozens of times.In 2020, I led the formation of China Telecom’s advanced attack and defense team, providing ample opportunities for team selection, training, and development. The team identified over 3,000 security risks for the group’s various companies and provided expert personnel for national-level event security (such as the Beijing Winter Olympics and Hangzhou Asian Games). In 2021, I guided the team to apply AI to the Security Orchestration, Automation, and Response (SOAR) platform, achieving the integration of hundreds of different types of data sources, real-time analysis (using multiple modes of AI models or traditional rules), log indexing (processing billions of logs, abandoning ElasticSearch…), and the coordinated scheduling of over 30 security devices. So far, our solution has been deployed as a technological achievement in over a dozen units, resulting in contracts worth tens of millions of yuan, and has analyzed data on a scale approaching 200 billion.Starting in 2023, I have been focusing on large language models (LLMs), leading the team in research and development work around data security and network security scenarios.

I mainly work for BestPay, a subsidiary of China Telecom. Due to the recognition of my technical expertise, China Telecom Group awarded me an internal part-time position titled: Chief Expert (Security Attack and Defense Specialty). China Telecom has over 500,000 employees, and there are fewer than 30 Chief Experts in total, with only two in the security specialty. This position is second only to Chief Scientist in technical ranking and is directly managed by the Deputy General Manager of China Telecom Group.My main achievements:Leading the construction of a high-level security attack and defense team system for China Telecom, cultivating and managing a security attack and defense team of hundreds of people, participating in and guiding the team to successfully complete several major national task guarantees. Responsible for security response and investigation of major security incidents for China Telecom, leading the team to win special prizes, first and second prizes in various competitions in the telecommunications and internet industries multiple times. Leading the development of cybersecurity products, with achievements recognized as the “2022 Future Network Leading Innovative Scientific and Technological Achievements” by the China Institute of Communications and “Outstanding Achievements” by “Sci-Tech Innovation China,” and receiving multiple technology awards from the Ministry of Industry and Information Technology and the China Academy of Information and Communications Technology.

Led three technical partners to jointly establish this technology company. We secured 10 million yuan in venture capital, built a team of 27 people (mostly R&D personnel).I started researching the JVM agent detection logic based on the characteristics of JVM’s JNI. Consequently, I founded China’s first company specializing in real-time application self-protection (RASP) products, which was also the first company to obtain a sales license for such products in this field. Until now, our research on the functionalities and technologies of this product remains leading-edge.In 2018, we began developing a product called Security Insight. The main purpose was to analyze the mixed security market products, providing customers with appropriate solutions, market insights, and product understanding. Due to certain reasons, we had to discontinue this project. During this period, we also attempted to develop a rare disease mutual aid community mini-program because a colleague’s child had a rare genetic disease, but we had to discontinue it due to the company’s operational requirements.

I joined BestPay as the third employee in the security position, mainly responsible for web application and software security-related work. I constructed BestPay’s software security lifecycle system and vulnerability management system, and developed BestPay’s security vulnerability bounty platform, vulnerability management platform, and vulnerability scanning platform. I managed and led a team of 7 people, and frequently delivered speeches and shared insights in the industry.And I began building a security analysis platform based on big data technology (ELK), introducing Flink technology for real-time analysis, which saved the company some security investments and mitigated some security risks.

Before this, I worked as a freelance ethical hacker, submitting hundreds of high-risk vulnerabilities for dozens of companies on China’s largest vulnerability bounty platforms, Wooyun and Butian.This was my first formal job at the age of 18. At that time, I was the only person in the company responsible for web application security. My main responsibilities were to provide security training, penetration testing, and formulate security protection plans for the company’s clients. I often had to go to client sites for emergency response and traceability. During this year, I learned many skills. One of the tasks was to provide CTF (Capture The Flag) training for clients, helping them achieve 6th place (out of over 100 participants) in the competition.I proposed and developed a password management platform. This platform supports mainstream security encryption algorithms and the generation and management of robust random passwords. Users can create and generate passwords within the platform and audit password access. It can be integrated into cloud platforms, hosts, servers, web applications, and database applications in the form of plugins, achieving efficient and secure password management and supporting Android scanning to retrieve passwords.