Patent ID: 11962606
Assignee: TWISTLOCK LTD.
Field: Digital communication (Electrical engineering)
Classification: CPC H | IPC H

Claim 15:
16. A system comprising:
a processor;
one or more machine-readable media having program code for a serverless function and program code for an application firewall stored thereon, the program code for the application firewall executable by the processor to cause the system to,
based on detection of an event that is a trigger for the serverless function, inspect input for the serverless function to determine whether the input contains unsafe data, wherein the application firewall and the serverless function are in a same runtime environment and wherein the program code to inspect the input to determine whether the input contains unsafe data comprises the program code executable by the processor to cause the system to determine whether the input conforms to a profile of normal input built from samples collected from past events determined to have safe data;
based on a determination that the input does not contain unsafe data, allow the serverless function to execute with the input and collect sample data from the event; and
based on a determination that the input includes unsafe data that is malicious or abnormal, raise a security action.