Recon: Efficient Intrusion Recovery for Web Applications

ABSTRACT In the present systems, recovery from intrusions usually takes much time. Hosted web applications are vulnerable to cyberattacks and may be at risk due to HTTP requests that exploit these vulnerabilities. In this article, we present an approach to recovering web systems from cyberattacks using machine learning approaches. Our approach is called Reconstruct (Recon). Users and administrators of web applications can benefit from the Recon system that helps recover from intrusions while protecting authorized user changes. The recovery mechanism used in Recon involves carrying out the compensation operations to remove the effects of the attack and re‐do the subsequently authorized actions. A system administrator can carry out the recovery operation that does not require any changes to be made to the software. In this article, a convolutional neural network is used with long short‐term memory to map the requests that the application receives to the database statements executed in the database. Two extensively utilized web applications, that is, WordPress and LimeSurvey, were used to evaluate Recon. According to the findings, it is possible to remove the impact of malicious requests while maintaining legitimate application data with minimum user input at an expense of 1%–2% in throughput, 2.24–3.1 GB/day in storage, and achieving an F1‐score of up to 98.56%. The obtained performance results outperform past research studies' performance overhead by up to 20×.