Many computing services need to be accessed through the Internet, which makes them inherently exposed to a large number of cybersecurity threats. Several attacks are thwarted by intrusion prevention mechanisms, but with the size and complexity of current systems, an attacker can break in sooner or later. Attackers can exploit a system vulnerability or steal user access credentials. Once the intrusion occurs, it is very likely that the state of the system is corrupted by the attacker. The classical solution against these corruptions is to keep regular backups to allow the reversal of the effects of intrusions. However, changes to the state made since the last backup are permanently lost. This situation has led to the development of work on intrusion recovery systems that revert the effect of attacks on the state of the system without losing legitimate changes. We present a survey of the literature in the area, explaining the different approaches and suggesting open directions for future research.

Web applications are exposed to many threats and, despite the best defensive efforts, are often successfully attacked. Reverting the effects of an attack on the state of such an application requires a profound knowledge about the application, to understand what data did the attack corrupt. Furthermore, it requires knowing what steps are needed to revert the effects without modifying legitimate data created by legitimate users. Existing intrusion recovery systems are capable of reverting the effects of the attack but they require modifications to the source code of the application, which may be unpractical. We present Sanare, a pluggable intrusion recovery system designed for web applications that use different data storage systems to keep their state. Sanare does not require any modification to the source code of the application or the web server. Instead, it uses Matchare, a new deep learning scheme we introduce to learn the matches between the HTTP requests and the database statements, file system operations and web services requests that the HTTP requests caused. We evaluated Sanare with three open source web applications: WordPress, GitLab and ownCloud. In our experiments Matchare achieved precision and recall higher than 97.5%.