arXiv cs.AI· Ruozhao Yang, Minglang Li, Jiongchi Yu, Xinfeng Li, Xiaofei Xie·· 14 小时前AI 评分34
JANUS：自动合成跨层防御以抵御 Web 反序列化攻击
JANUS: Synthesizing Cross-Layer Defenses Against Web Deserialization Attacks
AI 导读
JANUS 是一个红蓝对抗框架，可从已知漏洞出发自动合成跨层防御策略，在隔离离线环境中迭代优化部署专属策略。在 6 个 Java 和 PHP 应用的 16 个漏洞部署上，JANUS 将留出攻击成功率降至 6.2%（基线为 18.8%-55.0%），完全缓解 16 个部署中的 13 个，同时保留 98.4% 的良性功能测试，针对性 P95 延迟仅增加 6.9%。
正文 · 原文
Abstract:Unsafe deserialization turns untrusted data into attacker-controlled execution, and a single vulnerability can admit diverse exploit variants that evade defenses tailored to a known exploit. Existing defenses typically operate at a single enforcement point with limited visibility into the full attack. Combining controls across layers offers complementary protection, but coordinating them to preserve legitimate functionality and adapting them to new variants requires substantial expert effort.
We propose JANUS, a red-blue adversarial framework for automated cross-layer defense synthesis. Starting from a known exploit, \sys iteratively refines deployment-specific policies in an isolated offline environment. A black-box attacker probes the current policy for exploit variants using only externally observable feedback. The defender summarizes each verified variant into its security-relevant effects, uses counterfactual replay to separate complementary coverage from redundant enforcement, and jointly selects and scopes controls across layers. Each candidate policy is validated against accumulated exploits and benign workflows.
We evaluate JANUS on sixteen vulnerability deployments across six Java and PHP applications against gateway, application, system, and cross-layer defenses. JANUS reduces held-out attack success to 6.2%, compared with 18.8-55.0% for the baselines, fully mitigates 13 of 16 deployments, and preserves 98.4% of benign functionality tests at a 6.9% targeted P95 latency increase.
| Subjects: | Cryptography and Security (cs.CR); Artificial Intelligence (cs.AI); Software Engineering (cs.SE) |
| Cite as: | arXiv:2610.35532 [cs.CR] |
| (or arXiv:2610.35532v1 [cs.CR] for this version) | |
| https://doi.org/10.48550/arXiv.2610.35532 arXiv-issued DOI via DataCite (pending registration) |
Submission history
From: Ruozhao Yang [view email]
[v1]
Mon, 26 Oct 2026 14:47:24 UTC (626 KB)
来源：arXiv cs.AI · arxiv.org