Patent ID: 11962606
Assignee: TWISTLOCK LTD.
Field: Digital communication (Electrical engineering)
Classification: CPC H | IPC H

Claim 12:
13. A non-transitory computer-readable medium having program code for an application firewall stored thereon, the application firewall program code comprising instructions to:
based on detection of an event that is a trigger for a serverless function, inspect input for the serverless function prior to execution of the serverless function to determine whether said input contains unsafe data, wherein the serverless function and the application firewall program code are in a same runtime environment and wherein the instructions to inspect the input to determine whether the input contains unsafe data comprise instructions to determine whether the input conforms to a profile of normal input built from samples collected from past events determined to have safe data;
based on a determination that the input does not contain unsafe data, allow the serverless function to execute with the input and collect sample data from the event; and
based on a determination that the input includes unsafe data that is malicious, raise a security action.