Ariadne: Reconstruction of Stateful Web Attacks via Goal-Oriented State Search

Ariadne is a framework that helps security teams reconstruct full attack sequences on web applications by working backward from a detected malicious request. Modern web attacks often require multiple preparatory requests to set up the backend state before the final harmful payload is sent, but security systems typically only detect the final malicious request while the earlier setup requests get lost in traffic logs. Ariadne automatically finds these hidden prerequisite requests using a state-space search method (a technique that explores possible system configurations to find the target state), successfully reconstructing complete attack chains up to 8 steps long where existing tools failed.