A Comprehensive Architecture for Mitigating Denial of Wallet, Control-Flow, and AI Vulnerabilities in Serverless Environments

The transition toward serverless computing provides dramatic operational benefits but introduces novel attack surfaces defined by ephemeral execution, distributed coordination, and cost-based auto-scaling. Legacy security postures are structurally incapable of defending against highly specific, cloud-native threats such as Denial of Wallet, warm-container control-flow hijacking, and adversarial AI poisoning. The comprehensive architecture proposed in this research establishes a resilient, multi-tiered defense tailored explicitly for the constraints and mechanics of Function-as-a-Service environments. By combining automated N-Variant generation with runtime CFI enforcement and TLS offloading, the system effectively isolates and neutralizes code execution vulnerabilities. The application of NVP and MTD disrupts deterministic exploit chains, preventing lateral movement across microservices. Furthermore, the integration of deep learning anomaly detection successfully neutralizes stealthy financial exhaustion campaigns, while global provenance graphing enables high-fidelity post-incident forensic analysis despite the rapid termination of containers. Extensive empirical simulations prove that the architecture can yield a 96.8% aggregate interception rate for critical threats with a manageable average latency penalty of 14.2%. Ultimately, securing the serverless paradigm requires acknowledging its unique economic and architectural properties and implementing deeply integrated, cost-aware security enforcement mechanisms.

[1] P. Datta, I. Polinsky, M. A. Inam, A. Bates, and W. Enck, "ALASTOR: Reconstructing the provenance of serverless intrusions," in Proceedings of the USENIX Security Symposium, 2022. [2] D. S. Jegan, L. Wang, S. Bhagat, and M. Swift, "Guarding serverless applications with Kalium," in Proceedings of the USENIX Security Symposium, 2023. [3] K. Alpernas et al., "Secure serverless computing using dynamic information flow control," in Proceedings of the ACM on Programming Languages, 2018. [4] P. Escaleira, V. A. Cunha, J. P. Barraca, D. Gomes, and R. L. Aguiar, "Enhancing Serverless Function Resilience Against Vulnerabilities with MoFaaS," Journal of Network and Systems Management, 2026. [5] D. Kelly, F. Glavin, and E. Barrett, "DoWNet - classification of Denial-of-Wallet attacks on serverless architectures," Journal of Cybersecurity, 2024. [6] Pathade, Lavi, et al., "Serverless AI Security & Compromised Functions." [7] Li et al., "The Serverless Computing Survey: A Technical Primer." [8] M. Xiong, Z. Lu, and Y. Liu, "Warmonger: inflicting denial-of-service via serverless functions in the cloud," in Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security, 2021. [9] A. S. Cassel et al., "Serverless computing for Internet of Things: A systematic literature review," Future Generation Computer Systems, 2022. [10] Y. Li et al., "Serverless computing: state-of-the-art, challenges and opportunities," IEEE Transactions on Services Computing, 2022.