| CPC H04L 63/1433 (2013.01) [H04L 63/1441 (2013.01)] | 18 Claims |

|
1. A method, comprising:
receiving, at a cloud-based application vulnerability detection service, a first request from a first requesting device to access a first resource hosted by an origin server, the origin server belonging to a customer;
determining that the first request has indications of including malicious content based on a signature for the first request generated based on extracted attributes of the first request;
in response to determining that the first request has the indications of including the malicious content, blocking the first request;
sending a second request to a test environment of the origin server, wherein the second request is based on the first request;
receiving a first response from the origin server responsive to the second request;
determining that the first response indicates that the origin server has a vulnerability; and
providing information for the customer that indicates that the vulnerability has been blocked by the cloud-based application vulnerability detection service and the origin server is subject to the vulnerability.
|