Abstract: A system and method for protecting against flow manipulation of serverless functions. The method includes creating a profile for a serverless function, wherein the profile is created as an empty profile; generating a plurality of policies based on a plurality of log entries, wherein the plurality of policies defines allowable operations for the serverless function, wherein the plurality of log entries is recorded during monitoring of operation of the serverless function; updating the profile based on the plurality of policies to create a final profile, wherein the final profile includes at least one of the plurality of policies; monitoring operation of the serverless function to detect at least one violation of the profile, wherein the at least one violation includes a deviation from the allowable operations; and performing at least one mitigation action when the at least one violation of the profile is detected.