WARP is a system that helps users and administrators of web applications recover from intrusions such as SQL injection, cross-site scripting, and clickjacking attacks, while preserving legitimate user changes. WARP repairs from an intrusion by rolling back parts of the database to a version before the attack, and replaying subsequent legitimate actions. WARP allows administrators to retroactively patch security vulnerabilities-i.e., apply new security patches to past executions-to recover from intrusions without requiring the administrator to track down or even detect attacks. WARP's timetravel database allows fine-grained rollback of database rows, and enables repair to proceed concurrently with normal operation of a web application. Finally, WARP captures and replays user input at the level of a browser's DOM, to recover from attacks that involve a user's browser. For a web server running MediaWiki, WARP requires no application source code changes to recover from a range of common web application vulnerabilities with minimal user input at a cost of 24-27% in throughput and 2-3.2 GB/day in storage.
In REF , a mechanism to recover from intrusion attacks for webapplications by rolling back the database and replaying subsequent legitimate actions to correct the state of the database is proposed.
Intrusion recovery for database-backed web applications
SOSP '11
Computer Science