## 4 Comparison of Attacks According to Affected Parameters  
Without considering actual attacks, the response options for attacks cannot be evaluated; therefore, Table 6 is used to illustrate the effects of some of the most popular attacks and their effects on CIA [29; 48]. Intrusion attacks on PCs usually violate the security parameters, previously referred to as CIA [58]. Attackers try to breach the confidentiality by approaching a computer system or data storage without approval (either implicit or explicit). When cyber-attackers try to edit any information residing in or passing through a computer system or to change the-system-state, these attacks are tantamount to integrity contravention. An intrusion/attack is considered a violation of resources when cyber-attackers try to make resources unavailable to the target or users. Some attacks affect the confidentially and integrity of data, whereas some affect service availability. For instance, flooding attacks (e.g., DoS and DDoS) make the resources of a system unavailable to its intended users, as shown in Table 6. Therefore, to mitigate these types of attacks IRS must be designed to improve performance and service availability. Similarly, network sensors are more vulnerable to availability and confidentiality attacks. The attackers try to overload the network sensor by generating more packets to flood it, so it fails to process the successive packets. This prevents the network sensors from getting unauthorized access to the web server and uses a database server to exploit valuable information. Hence, network-based IDS is implemented to reduce the effects of flooding (DoS or DDoS) attacks and increase the network bandwidth [59]. Attackers in spoofing attacks and distributed attacks try to access and modify stored data. Therefore, response options should be selected according to affected parameters that can improve data confidentiality, availability, and integrity, as shown in Table 6. \begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Domain** & **Ref** & **IRS** & \begin{tabular}{c} **Underlying Detection** \\ **Techniques** \\ \end{tabular} & \begin{tabular}{c} **Description** \\ \end{tabular} \\ \hline \begin{tabular}{c} IRS in \\ Networks \\ \end{tabular} & [54] & NetSTAT & Misuse & To propose IRS, in which stream of audit data is matched with a stored signature of attacks descriptions for the evidence of the occurring attacks. \\ \hline \hline \multirow{3}{*}{} & [55] & A-NIDS & Anomaly & To detect intrusion events that are previously unobserved, but for which the false alarm rate is high. \\ \hline \multirow{3}{*}{} & [56] & AIDP & Anomaly & To propose AIDP in MANET for the detection and mitigation of DDoS attacks. \\ \hline \multirow{3}{*}{} & [36] & IDAR & Hybrid & To provide a flexible response to attacks instead of a static response without isolating the effected node. \\ \hline \multirow{3}{*}{} & [57] & \
\begin{tabular}{c} A-NIDS \\ using Fuzzy \\ \end{tabular} & Anomaly & To propose intelligent techniques with the help of machine learning such as fuzzy logic to prevent and classify network attacks. \\ \hline \multirow{3}{*}{} & [35] & GIDP & Hybrid & To propose a fixed response approach to intrusions by isolating the intruding node. \\ \hline \multirow{3}{*}{} &
\begin{tabular}{c} Network \\ IRS \\ \end{tabular} & N/A & To compare intrusion severity and response cost, an assessment algorithm is proposed. \\ \end{tabular}
\end{table} 
Table 5: IRSs in networks.