Back to results
US 11,962,606 B2Granted
Protecting serverless applications
AssigneeTwistlock, Ltd.
InventorsAvraham Shulman, Ory Segal, Shaked Yosef Zin
Life of this patent
Estimating the term…
Abstract
A system and methods for protecting a serverless application, the system including: (a) a serverless application firewall configured to inspect input of the serverless function so as to ascertain whether the input contains malicious, suspicious or abnormal data; and (b) a behavioral protection engine configured to monitor behaviors and actions of the serverless functions during execution thereof.
Claims22
A method comprising:
- based on detection of an event that is a trigger for a serverless function, an application firewall inspecting input for the serverless function prior to execution of the serverless function to determine whether the input contains unsafe data, wherein the serverless function and the application firewall are in a same runtime environment and wherein inspecting the input to determine whether the input contains unsafe data comprises determining whether the input conforms to a profile of normal input built from samples collected from past events determined to have safe data;
- based on a determination that the input does not contain unsafe data, allowing the serverless function to execute with the input and collecting sample data from the event;
- and
- based on a determination that the input includes unsafe data that is malicious or abnormal, raising a security action.
1 more element
A non-transitory computer-readable medium having program code for an application firewall stored thereon, the application firewall program code comprising instructions to:
- based on detection of an event that is a trigger for a serverless function, inspect input for the serverless function prior to execution of the serverless function to determine whether said input contains unsafe data, wherein the serverless function and the application firewall program code are in a same runtime environment and wherein the instructions to inspect the input to determine whether the input contains unsafe data comprise instructions to determine whether the input conforms to a profile of normal input built from samples collected from past events determined to have safe data;
- based on a determination that the input does not contain unsafe data, allow the serverless function to execute with the input and collect sample data from the event;
- and
- based on a determination that the input includes unsafe data that is malicious, raise a security action.
1 more element
A system comprising:
- a processor;
- one or more machine-readable media having program code for a serverless function and program code for an application firewall stored thereon, the program code for the application firewall executable by the processor to cause the system to,
- based on detection of an event that is a trigger for the serverless function, inspect input for the serverless function to determine whether the input contains unsafe data, wherein the application firewall and the serverless function are in a same runtime environment and wherein the program code to inspect the input to determine whether the input contains unsafe data comprises the program code executable by the processor to cause the system to determine whether the input conforms to a profile of normal input built from samples collected from past events determined to have safe data;
- based on a determination that the input does not contain unsafe data, allow the serverless function to execute with the input and collect sample data from the event;
- and
- based on a determination that the input includes unsafe data that is malicious or abnormal, raise a security action.
3 more elements
Dependencies are inferred from the claim text.