CloudFlow: Identifying Security-sensitive Data Flows in Serverless Applications

Giuseppe Raffa, Royal Holloway, Jorge Blasco, Dan O'Keeffe, Royal Holloway, Santanu Kumar Dash

The rapid adoption of the serverless computing paradigm has revolutionized cloud application development, offering developers the advantage of focusing solely on business logic while abstracting away infrastructure management. However, this shift introduces novel and complex security challenges, particularly concerning the static analysis of application security. Traditional static analysis tools struggle with the event-driven, asynchronous nature of serverless functions, the intricate web of cloud service interactions, and the black-box proprietary code of cloud platforms. This paper introduces **CloudFlow**, a groundbreaking framework designed to statically detect security-sensitive data flows in serverless applications, directly addressing these critical challenges.

AI review

Solid static analysis research that solves a real problem — serverless apps are a mess to analyze statically, and CloudFlow actually does something about it. The async-to-sync transformation is clever, the eval is honest, and 11 confirmed vulns in the wild is real signal. Not paradigm-shifting, but it's competent work that moves the field.