Runtime application self-protection

A system comprising:

• an agent repository for storing an allow list;
• at least one computer processor;
• a monitor of a software agent connected to a target application, the monitor executing on the at least one computer processor and configured to:
• collect a first set of observations of executing the target application while in a logging mode, wherein the first set of observations identifies a first plurality of instances of a first plurality of operations of the target application, and
• transmit the first set of observations to a security service;
• and
• configuration code of the software agent, the configuration code executing on the at least one computer processor and configured to:
• receive the allow list and a confidence estimator model from the security service, wherein the security service generalizes the first plurality of operations into a plurality of general operations in the allow list and trains the confidence estimator model based on the first set of observations, and
• transition the monitor to a blocking mode, and
• wherein the monitor further controls, according to the allow list and output of the confidence estimator model, performance by the target application of a second plurality of instances of a second plurality of operations while in blocking mode.

A method comprising:

• receiving, from a software agent in a logging mode, a set of observations of a target application, wherein the software agent instruments the target application, wherein the set of observations identifies a first plurality of instances of a first plurality of operations of the target application;
• generalizing the first plurality of operations into a plurality of general operations in an allow list;
• training a confidence estimator model using the set of observations;
• transmitting the allow list and the confidence estimator model to the software agent;
• and
• transitioning the software agent to a blocking mode, wherein the software agent controls performance of a second plurality of instances of a second plurality of operations by the target application according to the allow list and the confidence estimator model.