JANUS: Synthesizing Cross-Layer Defenses Against Web Deserialization Attacks

Motivation

• A single deserialization vulnerability can admit alternative gadget chains, while deployment libraries, runtime, and legitimate features constrain viable mitigations.Gateway, application, and system controls each observe only part of an attack; broad restrictions risk disrupting legitimate features.Source: §1 · p. 1

Our Approach

• JANUS pairs a black-box attacker exploring variants with a defender that uses execution evidence and benign-workflow feedback to revise deployment-specific controls.The attacker adapts gadget chains and payload representations from externally observable feedback; verified variants become counterexamples for defense refinement.Source: §1 · p. 2
• The defender summarizes exploit effects, uses counterfactual replay to distinguish complementary coverage from redundant enforcement, and jointly scopes controls subject to exploit, functionality, and latency checks.The framework evaluates 16 deployments across six applications against gateway, application, system, and cross-layer defenses.Source: §1 · p. 2

Evaluation

• 6.2% held-out attack success versus 18.8–55.0% for baselines; JANUS fully mitigates 13 of 16 deployments and passes 98.4% of functionality tests.It is breached on 5 of 48 unseen-attacker/deployment pairs.Source: §1 · p. 2

2.1 Deserialization Attacks and Defenses

• Gadget chains are sequences of existing methods leading to sensitive operations, and exploit variants can differ in input location, encoding, framing, or execution path.Their viability depends on the deployed libraries and runtime.Source: §2.1 · p. 2
• Gateway controls inspect request representations, application controls constrain accepted objects, and system controls restrict resulting operations, each with distinct blind spots and deployment availability.A composition must account for supported controls and legitimate behavior within their scopes.Source: §2.1 · p. 2

2.2 Threat Model

• The threat model gives the attacker HTTP access and bounded adaptive probing, while the defender may change configuration but not application source or business logic.Trusted independent oracles verify success through controlled state or effects; protection is assessed only for specified consequences, attackers, and budgets.Source: §2.2 · p. 3

2.3 Cross-Layer Defense Synthesis

• JANUS alternates defense configuration and bypass exploration, accumulating verified attacks and seeking a supported policy with zero archived-attack success and bounded benign-workflow and P95-latency impact.The final configuration is frozen before evaluation against attacks excluded from refinement; failure to meet the constraints within budget is unsuccessful.Source: §2.3 · p. 3

3 Design of Janus

• Janus alternates attack exploration and defense revision, accepting a configuration only when it blocks every archived attack and meets both workflow thresholds.New verified bypasses expand the archive and trigger another revision.Source: §3 · p. 3, §3.3 · p. 4

3.1 Black-Box Attack Exploration

• The attacker explores deployment-eligible fixtures using only response, timing, and its own out-of-band signals, while an independent oracle verifies candidate exploits.A candidate counts as a counterexample only if it succeeds both with and without the defense; oracle uncertainty is not credited as prevention.Source: §3.1 · p. 3

3.2 Evidence-Guided Defense Refinement

• Attack-effect summaries link oracle-confirmed consequences and exercised capabilities to application and system events, avoiding the need to reconstruct gadget chains.Missing or unlinked observations remain unknown.Source: §3.2 · p. 3
• Counterfactual replay masks blocking rules to reveal downstream coverage, identify single points of failure and redundancy candidates, and record workflow breakage.Because attribution is pairwise, a removal is confirmed only by checking the complete revised configuration.Source: §3.2 · p. 4

3.3 Regression-Guarded Evolution

• The defender may add, remove, narrow, or retune rules across layers, then accepts a revision only if the complete configuration passes regression checks.Refinement stops at budget exhaustion, stagnation, or catalog exhaustion; none proves that no bypass exists.Source: §3.2 · p. 4, §3.3 · p. 4
• Janus supports layer-specific controls for attack blocking or limiting a specified effect, and repeated runs can vary in coverage beyond their verified archives.Every returned configuration blocks its own archive and passes training workflows.Source: §3.3 · p. 4, Table 1 · p. 5

4 Implementation

• Per-layer adapters compile supported rules into native configurations and count a rule as active only when its enforcement event appears during replay.The implementation uses Docker Compose replicas, restores snapshots before replays, and does not modify application code.Source: §4 · p. 5

4.1 Running Example

• The J06 example uses a Jenkins XStream deserialization exploit that posts job-configuration XML and checks for a marker file at the sink.The application rebuilds a build-trigger object graph from the XML.Source: §4.1 · p. 5
• In the Jenkins example, an XML-character-reference encoding bypasses a literal gateway match, so v2 adds a decoded-name gateway rule, an application class filter, and a write restriction.The revised policy is accepted only after blocking both archived attacks and passing benign workflows; four further variants end in HTTP 403.Source: §4.1 · p. 5
• Janus’s v2 defense blocks all four held-out J06 attacks and passes all four functionality tests, while the baselines either miss variants or restrict required behavior.CRS blocks one re-encoded variant and flags a legitimate post; both RASPs block no attacks, while Kintsugi and Tetragon block three but break a build workflow.Source: §4.1 · p. 5
• Masked replay finds that each archived attack has at least two covering rules, while held-out replays show the lower-layer rules add coverage beyond the gateway.The system rule misses a write inside Jenkins home and a variant outside its workflow-preserving scope.Source: §4.1 · p. 5

5.1 Experimental Setup

• The study covers 16 application-vulnerability deployments across six applications, with 64 held-out attacks and disjoint functionality tests.Baselines include gateway, application, system, and cross-layer defenses; synthesis is bounded by query, replay, time, rule, and round budgets.Source: §5.1 · pp. 5–6

5.2 RQ1: Effectiveness

• 6.2% held-out ASR versus 18.8-55.0% for the baselines; JANUS mitigates 13/16 deployments and is breached on 5/48 attacker/deployment pairs.Under consequence switching, JANUS’s ASR rises to 9.7%, versus 31.9% for Kintsugi and 36.8% for Tetragon; with policies revealed, attackers breach 10/48 JANUS pairs versus 23-38 for the baselines.Source: §5.2 · p. 6

5.3 RQ2: Functionality and Overhead

• JANUS passes 98.4% of functionality tests at a 6.9% targeted P95 increase and has no regression on 15/16 deployments.Its median offline cost is 60 minutes per deployment and workflow version; it adds 1.2% non-targeted latency and lowers throughput by 3.0%.Source: §5.3 · pp. 6–7

5.4 RQ3: Refinement Dynamics

• Eight refinement rounds reduce held-out ASR from 21.9% to 6.2% as new verified bypasses fall from 9 to 1.Three of 45 never-rediscovered attacks succeed, all on synthesis failures; none succeeds on the 14 accepted syntheses.Source: §5.4 · p. 7

5.5 RQ4: Ablation and Sensitivity

• Without counterfactual replay, ASR rises to 10.9% and BPR falls to 94.8%; seed-only and one-shot variants reach 21.9% and 24.0% ASR, respectively.The gaps among attribution, greedy, and no-archive variants are comparable to run-to-run variation, so they indicate direction rather than a strict ranking.Source: §5.5 · p. 7
• Disabling application, system, or gateway controls raises ASR from 6.2% to 14.1%, 31.2%, or 20.3%, respectively.A-only ASR is at least 37.5%; S-only re-optimization reaches 40.1%, while gateway rules alone leave 50.0% open on the 15 HTTP deployments versus 55.0% for CRS.Source: §5.5 · p. 7
• Across backends, ASR stays within 5.7-6.8%; raising the query cap from 600 to 900 lowers ASR to 5.7% at 13% more offline time.Lowering the cap to 150 raises ASR to 10.9%, while rotating the training seed on six deployments leaves 4.2-8.3% ASR versus none under the default seed.Source: §5.5 · p. 7

6.1 Implications

• Figure 4 examines held-out ASR across refinement rounds, query caps, backends, component ablations, and layer subsets.Its error bars show the largest single-run deviation over three runs.Source: Figure 4 · p. 8
• A type constraint after decoding covers equivalent encodings, while a gateway signature can serve as a cheap pre-filter that permits narrower downstream rules.Disabling the application layer raises ASR from 6.2% to 14.1%.Source: §6.1 · p. 8
• Mitigations should be evaluated on held-out paths, unseen attackers, and functionality together because seed-only evaluation overstates protection.Tetragon has 81.2% BPR, whereas RASP preserves 96.9% of workflows but misses about half of held-out attacks.Source: §6.1 · p. 8
• Counterfactual replay can expose redundant rules and single points of failure in hand-written policies; 94% of its entries were conclusive in these runs.Rule count is a poor proxy for protection because an upstream rule can hide whether downstream rules hold.Source: §6.1 · p. 8

6.2 Limitations and Future Work

• JANUS preserves only behavior expressed by its expert-written workflows, and its protection is empirical rather than proven; frozen configurations are temporary until a root-cause fix.The benchmark covers six applications, only one in PHP, so results are reported per deployment rather than with statistical tests.Source: §6.2 · p. 8

7.1 Deserialization Defenses

• Deserialization defenses span gadget discovery and runtime filters, but filters act only at hooked call sites and parsers; JANUS uses them as one of three layers.Discovery-tool applicability depends on classpath and version prerequisites.Source: §7.1 · p. 8

7.2 Runtime Mitigation

• Earlier runtime mitigations use network or host filters, disable vulnerable paths, rewrite code, or apply generic policies, while JANUS revises deployment-specific controls across layers against an adaptive attacker.Kintsugi places kernel-enforced policies at application code locations; these systems fix enforcement points in advance.Source: §7.2 · p. 8

7.3 Cross-Layer Synthesis

• Prior cross-layer policy work reasons over static rule models, whereas JANUS uses counterfactual replay to identify whether apparently redundant rules uniquely stop variants.Its synthesis loop feeds verified adversarial variants into deployable configurations and gates revisions on benign workflows.Source: §7.3 · p. 8

Ethical Considerations

• Experiments target publicly disclosed vulnerabilities in isolated, resettable environments without Internet access or real user data.Oracles use controlled canaries, and the attacker runs only against these replicas.Source: Ethical Considerations · p. 9
• Any undisclosed issue is to be reported to maintainers before publication; new variants are released only to vetted researchers.The defense side is released openly, while attack sequences are released only in already-public form or to vetted researchers.Source: Ethical Considerations · p. 9
• The human-expert attacker was a team member, and the paper states that IRB review did not apply.Source: Ethical Considerations · p. 9

8 Conclusion

• 6.2% held-out attack success, 13 of 16 deployments mitigated, and 98.4% of functionality tests passed at a 6.9% targeted latency increase.The evaluation spans sixteen deployments across six Java and PHP applications; JANUS was breached on 5 of 48 unseen-attacker pairs.Source: §8 · p. 9

• Candidates come from the Kintsugi artifact, PACEbench, CVE-Bench, and public advisories.Source: A Benchmark Details · p. 10
• A candidate is retained only if its seed reproduces three consecutive times from a fresh snapshot and meets the evaluation criteria.Source: A Benchmark Details · p. 10
• Table 4 lists the benchmark manifest, while Table 3 reports enforcement reach and gadget families per application.Source: A Benchmark Details · p. 10

B Evaluation Details

• Held-out attacks vary gadget family when deployments expose multiple families, and each attack reaches its consequence on the undefended replica before testing.The benchmark excludes denial of service because a non-destructive oracle cannot confirm it; the oracle checks monitored consequences, not alerts or post-consequence failures.Source: B Evaluation Details · p. 10

C Attack-Effect Summary

• Janus links each archived attack to application and system events, recording its oracle-confirmed consequence, exercised capabilities, decisive parameters, and enforcement events.The reduced summary ties behavior to intervention points without requiring reconstruction of the gadget chain; unlinked or missing observations remain unknown.Source: C Attack-Effect Summary · p. 10

D Validation Procedures

• Counterfactual replay masks rules that blocked an archived attack; only a preceding enforcement event with no observed consequence counts as a block.Replays that reach the consequence show enabled rules failed to stop it; unreached or failed replays leave entries unknown, and rules are declared redundant only from rows without unknown entries.Source: D Validation Procedures · pp. 10–12
• Table 4 lists catalog enforcement points on each seed’s exploit path, and system controls cannot limit P01 file reads or J07–J09 state changes inside writable Jenkins home.Source: Table 4 · p. 11

E Agent Inputs

• Table 6 summarizes what each agent sees, does not see, and returns, and the prompt templates are slated for release with the artifact.Source: E Agent Inputs · p. 12, Table 6 · p. 12

F Baselines

• The tunable baselines receive the same 12-trial allowance on the evolved archive, while Kintsugi requires trigger markers in application code.The greedy and one-shot ablations share Janus’s candidates, model, evidence, and budget; greedy accepts edits only when archive ASR and all thresholds are maintained.Source: F Baselines · p. 12, Table 7 · p. 12

• 92.7–97.9% of ablations’ functionality tests pass, below the full policy’s 98.4%, while breached pairs range from 15 for the full policy to 69 for one-shot synthesis.Figure 6 complements held-out ASR with utility and breach counts for ablations and disabled-layer subsets.Source: G Additional Results · pp. 12–13
• 100% BPR is observed whenever system controls are disabled because the full policy’s only failing functionality test comes from a system rule.For layer subsets, targeted latency grows nearly additively.Source: G Additional Results · p. 13