JANUS: Synthesizing Cross-Layer Defenses Against Web Deserialization Attacks

Ruozhao Yang; Minglang Li; Jiongchi Yu; Xinfeng Li; Xiaofei Xie

cs.CROct 26, 2026

JANUS: Synthesizing Cross-Layer Defenses Against Web Deserialization Attacks

Authors: Ruozhao Yang, Minglang Li, Jiongchi Yu, Xinfeng Li, Xiaofei Xie

Organizations: Singapore Management University, Singapore · UESTC, China · Nanyang Technological University, Singapore · The Hong Kong Polytechnic University, China

Abstract

Unsafe deserialization turns untrusted data into attacker-controlled execution, and a single vulnerability can admit diverse exploit variants that evade defenses tailored to a known exploit. Existing defenses typically operate at a single enforcement point with limited visibility into the full attack. Combining controls across layers offers complementary protection, but coordinating them to preserve legitimate functionality and adapting them to new variants requires substantial expert effort. We propose JANUS, a red-blue adversarial framework for automated cross-layer defense synthesis. Starting from a known exploit, \sys iteratively refines deployment-specific policies in an isolated offline environment. A black-box attacker probes the current policy for exploit variants using only externally observable feedback. The defender summarizes each verified variant into its security-relevant effects, uses counterfactual replay to separate complementary coverage from redundant enforcement, and jointly selects and scopes controls across layers. Each candidate policy is validated against accumulated exploits and benign workflows. We evaluate JANUS on sixteen vulnerability deployments across six Java and PHP applications against gateway, application, system, and cross-layer defenses. JANUS reduces held-out attack success to 6.2%, compared with 18.8-55.0% for the baselines, fully mitigates 13 of 16 deployments, and preserves 98.4% of benign functionality tests at a 6.9% targeted P95 latency increase.

Figures & tables

Figure 1. Motivating example. Each layer’s defense stops some exploit variants, but one variant passes all three layers and reaches RCE, while the legitimate request is served. An attacker and a user send requests down through gateway, application, and system bands. Three attack attempts stop at different bands, one reaches RCE, and the user's request is served.

Figure 2. Overview of Janus , which alternates black-box attack exploration and evidence-guided defense refinement under regression checks. An attacker explores bypasses against a fixed configuration. A defender analyzes attack evidence, proposes controls, and refines them using benign-workflow feedback. Regression checks determine whether an update is accepted or returned for revision.

ID	Control	Configurable Policy	Effect
G1	Ingress Limits	Allowed routes and methods, body-size cap	B
G2	Virtual Patch	Request-match rules and action	B
A1	Class Filtering	Class allowlist, others rejected	B
A2	Graph Limits	Depth, references, bytes, array length	B
A3	Parser Filter	Class blocklist in the parser’s own filter	B
S1	Execution Limits	Deny process-execution system calls	L

Table 1. Defensive controls supported by Janus at each layer. B: attack blocking. L: limitation of a specified effect.

Figure 3. Recorded run on Jenkins CVE-2026-84645. A re-encoded payload bypasses the literal gateway rule of v1. The defender revises from the exploited effect into the three-layer v2, which stops every later variant at the gateway while benign workflows still pass. Four panels: seed check, round 1 with a gateway-only policy and one bypass, round 2 with a three-layer policy blocking all candidates, and the layer status showing only the gateway acted while workflows reach Jenkins.

	Held-out security			Changed attack settings				Functionality and latency				Overhead
Method	ASR	Mitigated	Breached	Main	Switch	Aware	Human	FPR	BPR	$\Delta$ P95	No regr.	Other P95	RPS	Offline
ModSecurity + CRS	55.0	0/15	32/45	45.5	59.1 $\,\pm$ 2.3	38/45	13/15	4.5	88.3	3.2	8/15	2.0	-1.5	15
Datadog RASP	48.4	0/16	29/48	39.6	55.6 $\,\pm$ 1.4	34/48	12/16	0.6	96.9	9.9	8/16	5.5	-4.8	18
OpenRASP	50.0	0/16	32/48	41.7	59.7 $\,\pm$ 1.4	37/48	13/16	0.8	96.9	10.9	7/16	6.0	-5.5	18
Kintsugi	20.3	6/16	17/48	14.6	31.9 $\,\pm$ 2.8	23/48	9/16	0.5	95.3	9.3	12/16	1.8	-2.5	12
Tetragon	18.8	8/16	18/48	12.5	36.8 $\,\pm$ 1.4	24/48	10/16	1.2	81.2	4.6	4/16	3.5	-2.0	5

Table 2. Frozen defenses on the 16 deployments. Rates are in percent and Offline in minutes. Main and Switch are ASRs on the 12 deployments with an unused monitored consequence, Aware counts breached attacker pairs with the frozen policy revealed, and Human counts deployments breached by the expert. Other P95 is the non-targeted latency increase.

Figure 4. Refinement, sensitivity, and ablations (held-out ASR, %). (a) Round cap, with new verified bypasses found after each snapshot. (b) Attacker-query cap and (c) backend, default circled or dark, with median offline minutes below. (d) Component ablations. (e) Layer subsets, disabled in the frozen policy or re-optimized. Error bars show the largest single-run deviation over three runs. Five panels of held-out ASR: round cap, query cap, backend, ablation variants, and layer subsets.

Appendix figures & tables7 assets

Supplementary material from the paper’s appendix.

Appendix

Application	Format	A	Layers	Gadget families
OFBiz	Java-native	✓	GAS	CommonsBeanutils, ROME, MozillaRhino
Jenkins	XStream	✓	GAS	nested PersistenceRoot, OfflineCause, ListView, Agent identity, lazy render
Liferay	JSON	✗	GS	C3P0/ReferenceSerialized, JdbcRowSetImpl
Metabase	Java-native	✓	GAS	Java URLDNS, Clojure comparator
ActiveMQ	JMX / OpenWire	✗	GS / S	Jolokia MBean, ClassPathXmlApplicationContext
Snipe-IT	PHP object	✗	GS	Laravel, Monolog, Guzzle chains

Appendix

Table 3. Enforcement reach per application. A covers Java-native paths (A1/A2) and the Jenkins XStream path (A3); G needs an HTTP entry. ActiveMQ’s Jolokia CVE admits GS , its native OpenWire CVE only S .

ID	CVE	Application (version)	Format	Consequence	Auth	Points
Java
J01	CVE-2020-9496	Apache OFBiz 17.12.01	Java-native	RCE	No	G,A,S
J02	CVE-2021-26295	Apache OFBiz 17.12.01	Java-native	RCE	No	G,A,S
J03	CVE-2021-29200	Apache OFBiz 17.12.01	Java-native	RCE	No	G,A,S
J04	CVE-2021-30128	Apache OFBiz 17.12.01	Java-native	RCE	No	G,A,S
J05	CVE-2026-53435	Jenkins 2.567	XStream	RCE	Yes	G,A,S

Appendix

Table 4. Benchmark manifest. Auth indicates whether the attack requires authentication, and Points lists the catalog enforcement points on the seed’s exploit path. S is listed only where the consequence involves process execution, a write outside writable volumes, or egress, so it cannot limit the file read of P01 or the state changes of J07-J09 inside the writable Jenkins home. P01 assumes the default APP_KEY, and J12 a user permitted to run native H2 queries.

Capability	Raw operations	Interceptable by
proc_exec	execve , execveat (also via posix_spawn )	S1
file_write	openat (write/create), rename , unlink , chmod	S2, outside writable volumes only
file_read	openat (read-only)	none
net_egress	connect , sendto (non-loopback)	S3
other	(collapsed to a count)	none

Appendix

Table 5. Capability vocabulary of the attack-effect summary. The last column lists the catalog control that can intercept each capability.

Figure 5. Per-deployment results. (a) Held-out successes out of 4 test attacks, all of which succeed undefended; (b) failed functionality tests out of 4; (c) targeted P95 increase (%), with $>$ 10% exceeding the latency gate; (d) breached attackers out of 3. N/A marks B1 on the native OpenWire deployment J14. Four heatmaps of 16 deployments by six methods.

Figure 6. Utility and breach counts of the ablations (a-c) and the disabled-layer subsets (d), complementing the held-out ASR in Figure 4 (d-e). Dashed lines mark the 95% BPR and 10% latency references. Means over three runs; breaches are summed over 48 attacker/deployment pairs per run. Dot plots of BPR and latency and bars of breached pairs for nine ablation variants, and latency bars for seven layer subsets.

	Attacker	Defender
Sees	Vulnerability description, reviewed fixtures and prerequisites, own requests and external feedback	Attack-effect summaries, coverage matrix, failed workflow assertions, incumbent rules, catalog
Never sees	Oracles, defense logs, coverage results, policy text	Held-out attacks, test workflows
Returns	Fixture choice and parameters in a request schema	Typed edits with evidence and expected effect

Appendix

Table 6. Information available to the two agents.

ID	Method	Layer	Coverage	Configuration
B1	ModSecurity + CRS ( OWASP Foundation, 2026 )	G	15/16	Tuned paranoia, exclusions
B2	Datadog RASP ( Datadog, 2025 )	A	16/16	Tuned detection rules, thresholds
B3	OpenRASP ( Baidu Security, 2024 )	A	16/16	Tuned detection rules, thresholds
B4	Kintsugi ( Peng et al., 2026 )	A + S	16/16	Reproduced per target
B5	Tetragon ( Cilium Authors, 2025 )	S	16/16	One fixed service-wide policy

Appendix

Table 7. Baseline applicability and configuration.

Autonomous Cyber Defense

Autonomous cyber defense uses AI agents to detect, investigate, and contain attacks while balancing operational safety, latency, and human oversight.

See all 72 papers

Explainable Adaptive Zero Trust Framework for AWS with Adversarial Robustness Evaluation
Aug 21, 2026Om Singh, Yagyaraj Pandey, Nandini PathakCybersecurity Zero-Trust Security
Department of Computer Science and Engineering, Dr. A.P.J. Abdul Kalam Technical University, Lucknow, Uttar Pradesh, India
WADE: An LSTM-Based Anomaly Detection Engine for WebAssembly Applications
Oct 22, 2026Ilaria Campestrini, Stefano Zanero, Engin KirdaSoftware Security Anomaly Detection
Politecnico di Milano, Milan, Italy · Northeastern University, Boston, MA, USA
Shielded Analysis: Certification and Characterization of Defensibility in Systems under Adversarial Interaction
Jun 11, 2026Achraf Hsain, Sultan AlmuhammadiAutonomous Cyber Defense Adversarial Robustness
Information and Computer Science Department King Fahd University of Petroleum and Minerals Dhahran, Saudi Arabia

Aug 21, 2026J/K move · Enter open · S save

Explainable Adaptive Zero Trust Framework for AWS with Adversarial Robustness Evaluation

Om Singh, Yagyaraj Pandey, Nandini Pathak

Department of Computer Science and Engineering, Dr. A.P.J. Abdul Kalam Technical University, Lucknow, Uttar Pradesh, India

Cybersecurity Zero-Trust Security Adversarial Robustness Anomaly Detection

Open paper AskPDF arXiv

Cloud environments built on Amazon Web Services face a structural security vulnerability: once a credential passes authentication, the resulting session is often treated as trusted for its entire duration. This assumption fails when credentials are stolen. We introduce the Explainable Adaptive Zero Trust Framework (EAZTF), a cloud-native security layer that continuously reevaluates the legitimacy of API actions throughout a session. EAZTF combines Isolation Forest and XGBoost to evaluate eight CloudTrail and IAM-derived behavioral features in real time and produce a Trust Risk Score (TRS) that determines whether a session continues, requires step-up MFA, or is restricted. Each decision is accompanied by a SHAP or LIME explanation, providing human-readable audit records for security analysis and compliance. The framework is also evaluated against four adversarial evasion strategies: credential theft, behavioral mimicry, API rate evasion, and privilege escalation. Experiments on an 8,500-record synthetic CloudTrail dataset show that Isolation Forest achieves 94.4% precision, 91.2% recall, and an F1 score of 0.928. Across the four adversarial scenarios, the mean detection rate is 91.0%, with behavioral mimicry being the most difficult at 83.9%. SHAP analysis identifies IP reputation, login-time deviation, and API call velocity as the three dominant features. A structured NIST SP 800-207 self-assessment gives EAZTF a mean compliance score of 93%, compared with 38% for a traditional perimeter baseline. Mean time to detect decreases from hours to under one minute. Because the evaluation uses synthetic data, these results should be interpreted as indicative rather than validated production performance.

Abstract

Autonomous Cyber Defense

Explore similar work

Explainable Adaptive Zero Trust Framework for AWS with Adversarial Robustness Evaluation

WADE: An LSTM-Based Anomaly Detection Engine for WebAssembly Applications

Shielded Analysis: Certification and Characterization of Defensibility in Systems under Adversarial Interaction