Sustaining Intrusion-Tolerance by Proactive Replacement