To tackle challenge 1, we must ensure that a later on
cleaning transaction will not accidentally damage an object
cleaned by a previous cleaning transaction. To tackle
challenge 2, we must not mistake a cleaned object as
damaged, and we must not mistake a re-damaged object as
already cleaned. To tackle challenge 3, our study in [2]
shows that when the damage spreading speed is quicker
than the repair speed, the repair may never terminate.
Otherwise, the repair process will terminate, and under the
following three conditions we can ensure that the repair
terminates: (1) every malicious transaction is cleaned; (2)
every identified damaged object is cleaned; (3) further
(assessment) scans will not identify any new damage (if no
new attack comes).