Intrusion Recovery Systems: A survey

Many computing services need to be accessed through the Internet, which makes them inherently exposed to a large number of cybersecurity threats. Several attacks are thwarted by intrusion prevention mechanisms, but with the size and complexity of current systems, an attacker can break in sooner or later. Attackers can exploit a system vulnerability or steal user access credentials. Once the intrusion occurs, it is very likely that the state of the system is corrupted by the attacker. The classical solution against these corruptions is to keep regular backups to allow the reversal of the effects of intrusions. However, changes to the state made since the last backup are permanently lost. This situation has led to the development of work on intrusion recovery systems that revert the effect of attacks on the state of the system without losing legitimate changes. We present a survey of the literature in the area, explaining the different approaches and suggesting open directions for future research.