the damage may spread from one host to another
host. The distributed cooperative layer trace the distributed
damage based 011 the workflow specification &d
notify the corresponding hosts. New obtained knowledge
from exchanged information will forces the recovery
manager to revise its recovery transactions, and adjust
its recovery strategies to the new environment. With
information exchanging, we trace damage spreading and
generate recovery trans:ictions of the distributed computing
systems in a cooperative way. In the figure, the
local recovery system locates local damage based on
reports from both the intrusion detection system, and the
, distributed cooperative manager.