Lightweight replicas for securing cloud-based services

A computer program product comprising:

• a plurality of instructions, comprising
• a first set of instructions, executable on a computer system, configured to detect whether an intrusion into an application server has occurred, wherein
• the application server is created using information from an application database;
• the application server is provisioned in a server system,
• the intrusion is an attack on one or more components of the application server,
• the attack is conducted via a datastream between a first computing system and the application server, and
• the attack has not compromised the one or more components of the application server;
• a second set of instructions, executable on the computer system, configured to dynamically create a replica application server in the server system in response to the intrusion being detected, wherein
• the replica application server is a container-based replica, wherein the container-based replica is a container virtualization where each container virtualization created executes under a same kernel and each container virtualization has its own file system, processes, and memory;
• the replica application server is created using information from the application database;
• the replica application server is provisioned with one or more replica components that correspond to the one or more components of the application server associated with the attack, and
• the replica application server is dynamically provisioned after the attack is detected;
• and
• a third set of instructions, executable on the computer system, configured to transition the datastream from the one or more components of the application server to the one or more components of the replica application server;
• and
• a non-transitory computer-readable storage medium, wherein the instructions are encoded in the non-transitory computer-readable storage medium.

A computer system comprising:

• one or more processors;
• a non-transitory computer-readable storage medium coupled to the one or more processors;
• and
• a plurality of instructions, encoded in the non-transitory computer-readable storage medium and configured to cause the one or more processors to
• create an application server using information from an application database and detect whether an intrusion into the application server has occurred, wherein
• the application server is provisioned in a server system,
• the intrusion is an attack on one or more components of the application server,
• the attack is conducted via a datastream between a first computing system and the application server, and
• the attack has not compromised the one or more components of the application server;
• and
• in response to the intrusion being detected,
• dynamically create a replica application server in the server system, wherein
• the replica application server is a container-based replica, wherein the container-based replica is a container virtualization where each container virtualization created executes under a same kernel and each container virtualization has its own file system, processes, and memory;
• the replica application server is dynamically created using information from the application database,
• the replica application server is provisioned with one or more replica components that correspond to the one or more components of the application server associated with the attack,
• the replica application server is dynamically created after the attack is detected;
• and
• transition the datastream from the one or more components of the application server to the one or more components of the replica application server.