Xin-Feng Li

JANUS: Synthesizing Cross-Layer Defenses Against Web Deserialization Attacks

Unsafe deserialization turns untrusted data into attacker-controlled execution, and a single vulnerability can admit diverse exploit variants that evade defenses tailored to a known exploit. Existing defenses typically operate at a single enforcement point with limited visibility into the full attack. Combining control...