Janus coordinates web defenses against changing exploits
JANUS: Synthesizing Cross-Layer Defenses Against Web Deserialization Attacks · arXiv:2610.35532
In plain words
The paper introduces Janus, a framework that helps build defenses for web applications vulnerable to unsafe deserialization, where untrusted data can trigger harmful actions as objects are rebuilt.
On isolated copies of an application, an attacker role tries variations of known exploits while a defender role adjusts protections and checks that ordinary workflows still work.
Across 16 deployments, attacks set aside during refinement succeeded less often under Janus than under five tested defenses. The results apply to these deployments and tested workflows; they do not prove general security.
The research
A defense that blocks one exploit can miss another route through the same vulnerability, while broad restrictions may break features people rely on. Can a web application’s defenses adapt to the exploit variants its deployment permits and still preserve the legitimate behavior its workflows require?
Janus pairs black-box exploit exploration with coordinated revision of gateway, application, and system controls, accepting only defenses that block archived attacks and pass workflow and latency checks.
Researchers tested four attacks per deployment, excluded from refinement, across 16 vulnerable deployments; success meant reaching the specified consequence. Janus averaged 6.2% attack success across deployments, versus 18.8% to 55.0% for five baselines.
Janus also passed 98.4% of separate functionality tests; targeted-endpoint 95th-percentile latency rose 6.9% during workflow replay at 50 requests per second. This supports stronger measured protection while retaining most tested workflows.
The evidence is empirical and covers six applications, only one of them in PHP. Janus preserves behavior expressed by its benign workflows, so these results do not prove general protection; frozen defenses are temporary measures until the underlying vulnerability is fixed.
What the evidence shows
- One flaw, many variants
Janus is a red-blue framework for building defenses against unsafe deserialization, where untrusted data can trigger unintended actions as an application rebuilds objects. The challenge is that one vulnerability may allow several exploit variants, while restrictions broad enough to stop them can disrupt legitimate features.
Janus aims to coordinate protections across gateway, application, and system layers for the particular deployment.
- Verify each bypass
Janus pairs an attacker role, which adapts reviewed exploit examples using external observations, with a defender role that revises controls on an isolated replica. An independent oracle checks whether an exploit reaches its specified consequence with and without the current defense.
Only a candidate that works on the undefended replica and still succeeds against the defense becomes a counterexample, so an inherently failing exploit is not credited as blocked.
- Coordinate the controls
The defender uses attack summaries and counterfactual replay to judge which controls contribute protection. Replay masks an upstream rule and tries the attack again from the same snapshot, revealing whether a downstream control also blocks it.
The defender can then revise controls across layers, but accepts a configuration only when it blocks every archived attack and meets workflow and latency checks.
- Compare held-back attacks
Researchers evaluated Janus on 16 vulnerable application and CVE deployments, with four attacks held back from refinement and four separate functionality tests per deployment. The attack success rate, meaning the share of held-back attacks that still reached their specified consequence, averaged 6.2% across deployments.
Five baseline defenses ranged from 18.8% to 55.0%; ModSecurity’s comparison covered 15 deployments because it did not apply to one OpenWire deployment.
- Check function and attribution
Janus passed 98.4% of functionality tests, while the targeted endpoint’s 95th-percentile latency rose 6.9% during workflow replay at 50 requests per second. In a component ablation, removing counterfactual replay raised attack success to 10.9% and lowered functionality-test passes to 94.8%.
These results support the value of the tested combination, but the workflow and application coverage limit what can be concluded beyond this evaluation.
Deep
- Original paper authors
- Ruozhao Yang, Minglang Li, Jiongchi Yu, Xinfeng Li, Xiaofei Xie
- Submitted to arXiv
- License
- CC BY 4.0