Patent ID: 11962606
Assignee: TWISTLOCK LTD.
Field: Digital communication (Electrical engineering)
Classification: CPC H | IPC H

Claim 0:
1. A method comprising:
based on detection of an event that is a trigger for a serverless function, an application firewall inspecting input for the serverless function prior to execution of the serverless function to determine whether the input contains unsafe data, wherein the serverless function and the application firewall are in a same runtime environment and wherein inspecting the input to determine whether the input contains unsafe data comprises determining whether the input conforms to a profile of normal input built from samples collected from past events determined to have safe data;
based on a determination that the input does not contain unsafe data, allowing the serverless function to execute with the input and collecting sample data from the event; and
based on a determination that the input includes unsafe data that is malicious or abnormal, raising a security action.