  Serverless computing is an emerging cloud paradigm with serverless functions
at its core. While serverless environments enable software developers to focus
on developing applications without the need to actively manage the underlying
runtime infrastructure, they open the door to a wide variety of security
threats that can be challenging to mitigate with existing methods. Existing
security solutions do not apply to all serverless architectures, since they
require significant modifications to the serverless infrastructure or rely on
third-party services for the collection of more detailed data. In this paper,
we present an extendable serverless security threat detection model that
leverages cloud providers' native monitoring tools to detect anomalous behavior
in serverless applications. Our model aims to detect compromised serverless
functions by identifying post-exploitation abnormal behavior related to
different types of attacks on serverless functions, and therefore, it is a last
line of defense. Our approach is not tied to any specific serverless
application, is agnostic to the type of threats, and is adaptable through model
adjustments. To evaluate our model's performance, we developed a serverless
cybersecurity testbed in an AWS cloud environment, which includes two different
serverless applications and simulates a variety of attack scenarios that cover
the main security threats faced by serverless functions. Our evaluation
demonstrates our model's ability to detect all implemented attacks while
maintaining a negligible false alarm rate.
