An In-depth Study of Java Deserialization Remote-Code Execution Exploits and Vulnerabilities
I. Sayar, A. Bartel, E. Bodden, Y. Le Traon, ACM Transactions on Software Engineering and Methodology (2022).