  Web servers are a popular target for adversaries as they are publicly
accessible and often vulnerable to compromise. Compromises can go unnoticed for
months, if not years, and recovery often involves a complete system rebuild. In
this paper, we propose n-m-Variant Systems, an adversarial-resistant software
rejuvenation framework for cloud-based web applications. We improve the
state-of-the-art by introducing a variable m that provides a knob for
administrators to tune an environment to balance resource usage, performance
overhead, and security guarantees. Using m, security guarantees can be tuned
for seconds, minutes, days, or complete resistance. We design and implement an
n-m-Variant System prototype to protect a Mediawiki PHP application serving
dynamic content from an external SQL persistent storage. Our performance
evaluation shows a throughput reduction of 65% for 108 seconds of resistance
and 83% for 12 days of resistance to sophisticated adversaries, given
appropriate resource allocation. Furthermore, we use theoretical analysis and
simulation to characterize the impact of system parameters on resilience to
adversaries. Through these efforts, our work demonstrates how properties of
cloud-based servers can enhance the integrity of Web servers.
