JANUS synthesizes cross-layer defenses for deserialization attacks
Original title: JANUS: Synthesizing Cross-Layer Defenses Against Web Deserialization Attacks
On 16 Java and PHP deployments, held-out attack success fell to 6.2% while 98.4% of benign tests still passed.
JANUS is a red-blue framework that starts from a known deserialization exploit and iteratively refines deployment-specific policies offline. A black-box attacker searches for variants using only external feedback; the defender summarizes verified variants, uses counterfactual replay to drop redundant controls, and validates each policy against exploits and benign workflows. On sixteen deployments in six Java and PHP applications, JANUS cut held-out attack success to 6.2% versus 18.8-55.0% for baselines, fully mitigated 13 of 16, and preserved 98.4% of benign tests with a 6.9% targeted P95 latency increase.
- Baselines included gateway, application, system, and cross-layer defenses.
- Thirteen of sixteen vulnerability deployments were fully mitigated.
- Targeted P95 latency increased by 6.9%.
- Policies are checked against accumulated exploits and benign workflows.
From the original article
1 min read at arxiv.orgUnsafe deserialization turns untrusted data into attacker-controlled execution, and a single vulnerability can admit diverse exploit variants that evade defenses tailored to a known exploit. Existing defenses typically operate at a single enforcement point with limited visibility into the full attack.
By Ruozhao Yang · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.