Automatic backdoor vulnerability detection

A non-transitory machine-readable medium, comprising executable instructions that, when executed by a processor, facilitate performance of operations, the operations comprising:

• generating a directed graph defining discovered application programming interfaces (APIs) associated with a computer system;
• traversing, in a data environment, the directed graph and identifying an outgoing edge or an incoming edge of the directed graph;
• constructing a function call for an API of the discovered APIs and executing the function call;
• establishing an impact of the execution by monitoring a data flow of the system;
• and
• determining whether the impact is counter to a known functioning of the system.

A method, comprising:

• detecting, in a data environment of a computer system operatively coupled to a processor, an unapproved impact on the computer system as a result of an execution of a call function associated with an application programming interface (API) known to the computer system,
• wherein detecting the unapproved impact comprises detecting a defined unapproved effect on outgoing system traffic, an initiation of system process or a generation of a system file;
• generating, by the system, a suggested policy in response to the unapproved impact being determined to be counter to a known function associated with the unapproved impact on the computer system, wherein the suggested policy instructs restriction of access between at least part of the API, at least part of another API other than the API, and the computer system;
• and
• instructing, by the computer system, that the suggested policy be deployed at the computer system.