Janus automates layered web defenses against complex deserialization attacks
JANUS: Synthesizing Cross-Layer Defenses Against Web Deserialization Attacks
Cryptography and SecurityArtificial IntelligenceSoftware Engineering
Summary
Unsafely turning stored data back into running programs can let hackers take control. The authors introduce Janus, a system that automatically builds protections spread out across multiple parts of a web application. Starting from a known hacking method, Janus learns to spot and block related attacks while still letting normal users do their work. This makes it harder for hackers to slip through defenses that only watch one part of the system.
What this means in practice
- •For web security engineers: Automatically generate coordinated protections across multiple system layers to prevent varied deserialization attacks without blocking normal user actions.
- •For enterprise application developers: Integrate a tool that continually adjusts security policies to defend against new exploit variants on complex Java and PHP applications.
Authors
Ruozhao Yang, Minglang Li, Jiongchi Yu, Xinfeng Li, Xiaofei Xie
Abstract
Unsafe deserialization turns untrusted data into attacker-controlled execution, and a single vulnerability can admit diverse exploit variants that evade defenses tailored to a known exploit. Existing defenses typically operate at a single enforcement point with limited visibility into the full attack. Combining controls across layers offers complementary protection, but coordinating them to preserve legitimate functionality and adapting them to new variants requires substantial expert effort. We propose JANUS, a red-blue adversarial framework for automated cross-layer defense synthesis. Starting from a known exploit, \sys iteratively refines deployment-specific policies in an isolated offline environment. A black-box attacker probes the current policy for exploit variants using only externally observable feedback. The defender summarizes each verified variant into its security-relevant effects, uses counterfactual replay to separate complementary coverage from redundant enforcement, and jointly selects and scopes controls across layers. Each candidate policy is validated against accumulated exploits and benign workflows. We evaluate JANUS on sixteen vulnerability deployments across six Java and PHP applications against gateway, application, system, and cross-layer defenses. JANUS reduces held-out attack success to 6.2%, compared with 18.8-55.0% for the baselines, fully mitigates 13 of 16 deployments, and preserves 98.4% of benign functionality tests at a 6.9% targeted P95 latency increase.