Dr Surya Nepal

Dr Surya Nepal is a Senior Principal Research Scientist at CSIRO, where he has worked since 2000. His research focuses on the development and deployment of cybersecurity technologies. He holds a BE from the National Institute of Technology, Surat (India), an ME from the Asian Institute of Technology (Thailand), and a PhD from RMIT University (Australia).

Dr Nepal has authored 400+ publications in top-tier venues, including ACM CCS, NDSS, IEEE S&P, ASIACCS, RAID, VLDB, and ICDE, and journals such as IEEE TSC, IEEE TPDS, ACM TOIT, IEEE TC, CACM, and ACM Computing Surveys. Several of his papers have received Best Paper Awards. He has 24,800+ citations, an h-index of 73, and an i10-index of 325 (Google Scholar), and has received multiple CSIRO publication and invention awards.

He currently leads the Cybersecurity and Quantum Systems group, comprising 40+ researchers and 40+ students, with research spanning critical technology security (including AI and quantum systems) and critical infrastructure protection. He is a co-inventor of 8 patents, has edited three books, and actively serves as a program chair and committee member for major international conferences. He has delivered keynotes, invited talks, and tutorials globally. He has served as Interim Editor-in-Chief of IEEE Transactions on Service Computing and as an editorial board member of IEEE Transactions on Dependable and Secure Computing. He is currently an Associate Editor of ACM Transactions on Internet Technology and a steering committee member of ACM AsiaCCS.

Dr Nepal’s research is widely adopted in practice by both academia and industry. This is evidenced by real-world problem solving through client applications, technology licensing to industry, and deployment of developed solutions in operational environments. His work has attracted multi-million-dollar competitive funding from government and industry sources, including ARC, the Australia–India Strategic Research Fund, US Army, Boeing, AFP, NSF, Home Affairs, NATO, and CRCs.

Dr Nepal has held several leadership roles within CSIRO, nationally and internationally. Within CSIRO, he has served as Project Leader, Team Leader, Group Leader, Program Director, Mission Leader, and Deputy Director over more than 25 years. Nationally, he served as Theme Leader and Deputy Research Director of the Cyber Security Cooperative Research Centre (CRC). He currently serves as Theme Leader for the Responsible AI Research Centre (RAIR), a joint initiative of CSIRO and UoA, and holds positions as Adjunct Professor at UNSW and Honorary Professor at Macquarie University. Internationally, he has been invited to serve on several IEEE and ACM award committees. He is a Fellow of IEEE.

Some Key Publications (last five years):

1. Singh, R., Tariq, S., Jalalvand, F., Chhetri, M. B., Nepal, S., Paris, C., & Lochner, M. (2026). LLMs in the SOC: An empirical study of human-AI collaboration in Security Operations Centres. In Proceedings of the 2026 IEEE Symposium on Security and Privacy (S&P '26).

2. Duong, M., Chesser, M., Farrelly, G., Nepal, S., & Ranasinghe, D. C. (2026). FirmReBugger: A benchmark framework for monolithic firmware fuzzers. Proceedings of the 35th USENIX Security Symposium.

3. Vo, V., Ma, M., Bai, G., Ko, R., & Neplal, S. (2025). Practical poisoning attacks with limited Byzantine clients in clustered federated learning. 2025 IEEE Symposium on Security and Privacy (SP), 1751–1769.

4. Chesser, M., Nepal, S., & Ranasinghe, D. C. (2024). MultiFuzz: A multi-stream fuzzer for testing monolithic firmware. In Proceedings of the 33rd USENIX Security Symposium (USENIX Security 24) (pp. 4165-4182).

5. Ma, H., Wang, S., Gao, Y., Zhang, Z., Qiu, H., Xue, M., Abuadbba, A., Fu, A., Nepal, S., & Abbott, D. (2024). Watch out! Simple horizontal class backdoor can trivially evade defense. Proceedings of the 2024 ACM SIGSAC Conference on Computer and Communications Security, 3625–3639.

6. Gao, Y., Qiu, H., Zhang, Z., Wang, B., Ma, H., Abuadbba, A., Xue, M., Fu, A., & Nepal, S. (2024). DeepTheft: Stealing DNN model architectures through power side channel. 2024 IEEE Symposium on Security and Privacy (SP), 3311–3326.

7. Wang, S., Abuadbba, S., Agarwal, S., Moore, K., Sun, R., Xue, M., Nepal, S., Camtepe, S., & Kanhere, S. (2023). PublicCheck: Public integrity verification for services of run-time deep models. 2023 IEEE Symposium on Security and Privacy (SP), 1348–1365.

8. Wang, S., Almashor, M., Abuadbba, A., Sun, R., Xue, M., Wang, C., Gaire, R., Nepal, S., & Camtepe, S. (2023). DOITRUST: Dissecting on-chain compromised Internet domains via graph learning. Proceedings of the 2023 Network and Distributed System Security Symposium.

9. Thapa, C., Jang, S. I., Ahmed, M. E., Camtepe, S., Pieprzyk, J., & Nepal, S. (2022). Transformer-based language models for software vulnerability detection. Proceedings of the 38th Annual Computer Security Applications Conference, 481–496

10. Buchholz, E., Abuadbba, A., Wang, S., Nepal, S., & Kanhere, S. S. (2022). Reconstruction attack on differential private trajectory protection mechanisms. Proceedings of the 38th Annual Computer Security Applications Conference, 279–292.

11. Moore, K., Christopher, C. J., Liebowitz, D., Nepal, S., & Selvey, R. (2022). Modelling direct messaging networks with multiple recipients for cyber deception. 2022 IEEE 7th European Symposium on Security and Privacy (EuroS&P), 1–19.

12. Zhang, Z., Cheng, Y., Wang, M., He, W., Wang, W., Nepal, S., Gao, Y., Li, K., Wang, Z., & Wu, C. (2022). SoftTRR: Protect page tables against rowhammer attacks using software-only target row refresh. 2022 USENIX Annual Technical Conference (USENIX ATC 22), 399–414.