From a state-transition angle, the job of attack recovery
is to get a state of the database, which is determined by the
values of the data objects, where (a) no effects of the
malicious transactions are there and (b) the work of good
transactions should be retained as much as possible. In
particular, transactions transform the database from one
state to another. Good transactions transform a good
database state to another good state, but malicious
transactions can transform a good state to a damaged one.
Moreover, both malicious and affected (good) transactions
can make an already damaged state even worse. We say a
database state S1 is better than another one S2 if S1 has
fewer corrupted objects. The goal of on-the-fly attack
recovery is to get the state better and better, although during
the repair process new attacks and damage spreading could
(temporarily) make the state even worse. (A state-oriented
object-by-object attack recovery scheme is proposed in
[38].)