System and method for defending applications invoking anonymous functions

1. A method for defending an application configured to invoke anonymous functions, comprising:

analyzing the application to determine at least one branch of the application, wherein each branch is an instruction that deviates from a default behavior of the application;

identifying, based on the at least one branch of the application and at least one first anonymous function, at least one potential threat branch, each potential threat branch including a call to one of the at least one first anonymous function; and

rewiring at least one first function call of the application to create a secured instance of the application, wherein each of the at least one first function call is to one of the at least one first anonymous function prior to rewiring, wherein rewiring the at least one first function call further comprises replacing each of the at least one first function call with at least one second function call, wherein each second function call is to one of at least one second anonymous function, wherein each of the at least one second anonymous function is triggered in response to potentially unsecured flows by the secured application, wherein each of the at least one second anonymous function is triggered when anomalous behavior has occurred, wherein the secured instance of the application is configured to detect the anomalous behavior based on inputs, outputs, and characteristics of each anonymous function.

2. The method of claim 1 , wherein the potentially unsecured flows include at least one of: long execution cycles, inconsistent flows, and calling new engine methods.

3. The method of claim 1 , wherein the secured application is configured to apply a machine learning model for detecting the anomalous behavior, wherein the machine learning model is trained using a training set including training anonymous function inputs, training anonymous function outputs, and training anonymous function characteristics.

4. The method of claim 1 , wherein the anomalous behavior includes an anomalous input and output combination, wherein the anomalous input and output combination deviates from a wrapping of an anonymous function input with a corresponding anonymous function output.

5. The method of claim 1 , wherein analyzing the application further comprises at least one of: static analysis, and dynamic request simulations.

6. The method of claim 1 , wherein the application is a serverless application.

7. The method of claim 1 , wherein each anonymous function is a function that is not bound to an identifier.

8. A non-transitory computer readable medium having stored thereon instructions for causing a processing circuitry to execute a process, the process comprising:

analyzing the application to determine at least one branch of the application, wherein each branch is an instruction that deviates from a default behavior of the application;

identifying, based on the at least one branch of the application and the at least one first anonymous function, at least one potential threat branch, each potential threat branch including a call to one of the at least one first anonymous function; and

rewiring at least one first function call of the application to create a secured instance of the application, wherein each of the at least one first function call is to one of the at least one first anonymous function prior to rewiring, wherein rewiring the at least one first function call further comprises replacing each of the at least one first function call with at least one second function call, wherein each second function call is to one of at least one second anonymous function, wherein rewiring the at least one first function call further comprises replacing each of the at least one first function call with at least one second function call, wherein each second function call is to one of at least one second anonymous function, wherein each of the at least one second anonymous function is triggered in response to potentially unsecured flows by the secured application, wherein each of the at least one second anonymous function is triggered when anomalous behavior has occurred, wherein the secured instance of the application is configured to detect the anomalous behavior based on inputs, outputs, and characteristics of each anonymous function.

9. A system for defending an application configured to invoke anonymous functions, comprising:

a processing circuitry; and

a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to:

analyze the application to determine at least one branch of the application, wherein each branch is an instruction that deviates from a default behavior of the application;

identify, based on the at least one branch of the application and the at least one first anonymous function, at least one potential threat branch, each potential threat branch including a call to one of the at least one first anonymous function; and

rewire at least one first function call of the application to create a secured instance of the application, wherein each of the at least one first function call is to one of the at least one first anonymous function prior to rewiring, wherein rewiring the at least one first function call further comprises replacing each of the at least one first function call with at least one second function call, wherein each second function call is to one of at least one second anonymous function, wherein rewiring the at least one first function call further comprises replacing each of the at least one first function call with at least one second function call, wherein each second function call is to one of at least one second anonymous function, wherein each of the at least one second anonymous function is triggered in response to potentially unsecured flows by the secured application, wherein each of the at least one second anonymous function is triggered when anomalous behavior has occurred, wherein the secured instance of the application is configured to detect the anomalous behavior based on inputs, outputs, and characteristics of each anonymous function.

10. The system of claim 9 , wherein the potentially unsecured flows include at least one of: long execution cycles, inconsistent flows, and calling new engine methods.

11. The system of claim 9 , wherein the secured application is configured to apply a machine learning model for detecting the anomalous behavior, wherein the machine learning model is trained using a training set including training anonymous function inputs, training anonymous function outputs, and training anonymous function characteristics.

12. The system of claim 9 , wherein the anomalous behavior includes an anomalous input and output combination, wherein the anomalous input and output combination deviates from a wrapping of an anonymous function input with a corresponding anonymous function output.

13. The system of claim 9 , wherein analyzing the application further comprises at least one of: static analysis, and dynamic request simulations.

14. The system of claim 9 , wherein the application is a serverless application.

15. The system of claim 9 , wherein each anonymous function is not bound to an identifier.