Adapters for runtime application self-protection

A system comprising:

• a processing device;
• and
• a memory to store instructions that, when executed by the processing device cause the processing device to:
• train an artificial intelligence model (AIM) using training data to produce a generalized AIM, wherein the training data comprises log-collected data corresponding to a plurality of application types and the generalized AIM is trained to detect one or more cross-platform cybersecurity threats, the plurality of application types comprising a first application type;
• identify a plurality of application-specific training data sets, wherein each one of the plurality of application-specific training data sets comprises labeled application logs corresponding to one application type from the plurality of application types;
• fine-tune the generalized AIM using the plurality of application-specific training data sets to produce a plurality of dedicated AIMs, wherein the plurality of dedicated AIMs comprise a first dedicated AIM that corresponds to the first application type, and wherein each one of the dedicated AIMs from the plurality of dedicated AIMs is trained to detect one or more application-centric cybersecurity threats targeted at a corresponding one of the plurality of application types;
• intercept a request targeted to a first application from an external entity, wherein the first application is the first application type;
• determine, by the first dedicated AIM, whether the request indicates at least one of the one or more application-centric cybersecurity threats;
• and
• quarantine the external entity responsive to determining that the request indicates at least one of the one or more application-centric cybersecurity threats.

A non-transitory computer readable medium, having instructions stored thereon which, when executed by a processing device, cause the processing device to:

• train an artificial intelligence model (AIM) using training data to produce a generalized AIM, wherein the training data comprises log-collected data corresponding to a plurality of application types and the generalized AIM is trained to detect one or more cross-platform cybersecurity threats, the plurality of application types comprising a first application type;
• identify a plurality of application-specific training data sets, wherein each one of the plurality of application-specific training data sets comprises labeled application logs corresponding to one application type from the plurality of application types;
• fine-tune, by the processing device, the generalized AIM using the plurality of application-specific training data sets to produce a plurality of dedicated AIMs, wherein the plurality of dedicated AIMs comprise a first dedicated AIM that corresponds to the first application type, and wherein each one of the dedicated AIMs from the plurality of dedicated AIMs is trained to detect one or more application-centric cybersecurity threats targeted at a corresponding one of the plurality of application types;
• intercept a request targeted to a first application from an external entity, wherein the first application is the first application type;
• determine, by the first dedicated AIM, whether the request indicates at least one of the one or more application-centric cybersecurity threats;
• and
• quarantine the external entity responsive to determining that the request indicates at least one of the one or more application-centric cybersecurity threats.