Smart exposure of data to known attacker sessions

A system, comprising:

• a processor;
• and
• one or more computer-readable storage media storing computer-readable instructions that, when executed by the processor, perform operations comprising:
• during a session with an application in which a web browser interacts with the application and the application accesses a dataset, recording path data for the session, the path data representing interactions among the web browser, application, and dataset, wherein the path data includes one or more queries made by the application;
• detecting malicious activity in the session;
• based on the recorded path data, determining a compromised portion of the dataset that was provided to the web browser prior to detection of the malicious activity;
• and
• transferring the session to a cloned application session, where the cloned application session has access to the compromised portion of the dataset but not to other data in the dataset.

One or more computer-readable storage media storing computer-executable instructions for securing an application, the securing comprising:

• during a session with an application, recording path data for the session, the path data including at least two of:
• one or more queries made by the application, one or more commands made by an application programming interface (API) in response to the one or more queries made by the application, information representing a response sent by the API to the application, or information sent to a web browser by the application;
• determining that the session is a malicious session;
• constructing a refined query based on the path data, wherein the refined query corresponds to a compromised portion of a first dataset that was provided to the web browser prior to the determination that the session is a malicious session;
• executing the refined query against the first dataset;
• storing the results of the refined query as part of a second dataset;
• and
• transferring the session to a cloned application session, wherein queries in the cloned application session are made against the second dataset rather than the first dataset.