7. How can a firewall determine that traffic is a deserialisation attack?

By inspecting for fixed‑format strings in the payload: O:length:"value":attribute_count:{attribute_type:attribute_length:attribute_value;...}