While traditional security mechanisms rely on preventive controls and those are very limited in surviving malicious attacks, we propose a novel approach of the security issue to cluster recovery. In this paper, we present the cluster recovery model with a software rejuvenation methodology, which is applicable in security field. We propose two formal approaches, stochastic and Markov decision process. And we estimate the possibility of surviving under unknown attacks. The basic idea of rejuvenation is to investigate the consequences for the exact respond time in face of attacks and rejuvenating the running software/service, refresh its internal state, and resume or restart it. These actions deter the intruder's progress, prevent from more serious damages and provide time to perform more detailed analysis.