## 3 Common Solutions to Intrusions
### Intrusion Detection System  
Different phases that can be deployed as defensive mechanisms are shown in Figure 2. These phases include preventing, detecting, and responding to intrusions [30]. In the prevention phase, attacks are prevented before they happen. In the detection phase, analysis tools are developed to monitor network and host information and also identify intrusions. Response tools are used to mitigate possible intrusions detected by IDS. As stated by [4], an intrusion is a set of actions that violate security policies. Any defensive mechanism that prevents attacks before they occur is called an IPS. IPSs are IDSs that possess the same features of IDS along with the capability of preventing detected attacks. However, in the prevailing distributed environment, early prevention of attacks is impractical. An IDS is usually a hardware or software set that monitors events occurring in a computer system and identifies intrusions. Based on IDS alerts, a security countermeasure (IRS) is used to thwart detected intrusions. As presented in Table 4, IDSs are classified based on the monitoring environment into two sub-classes, namely network-based IDSs and host-based IDSs, that is, whether they monitor network traffic or a host system log file. IDSs are also divided into distributed-based IDSs and hybrid-based IDSs depending on the data source. According to the detection approach, IDSs are categorized into three subcategories: anomaly-detection, misuse-detection, and hybrid-detection. IDSs for anomaly detection \begin{table}
\begin{tabular}{c c c c} \hline \hline
**Intrusion Solution** & **Intrusion Types** & **Description** & **Attack Examples** \\ \hline Firewall & External & It is a system designed to stop & IP spoofing, eavesdropping, DOS, \\  & External & unauthorized access. & port scan, and fragmentation attacks. \\ \hline Access Control & External & These are systems that control or & Unauthorized access, password \\  & External & limit illegal access to a system. & attacks, dictionary attacks, rainbow \\  & External & To stop the coding or decoding of & table attacks, and sniffer attacks. \\ \hline Cryptography & External & To stop the coding or decoding of & Meet-in-the-middle attacks, brute \\  & External & secret messages. & force attacks, and birthday attacks. \\ \hline IDS & Internal + External & A system or device that controls & DOS, DDOS, user to root (U2R), port \\  & External & and monitors a system. & scanning, and flooding. \\ \hline IPS & Internal + External & Network security appliances that & ICMP storms, ping to death, SSL \\  & External & monitor network and/or system & evasion, and SMTP mass \\  & External & activities for malicious activity. & mailing attacks. \\ \hline IDPS & Internal + External & Also known as IPS & DOS and DDOS. \\ \hline IRS & Internal + External & & DOS, user to root, remote to local, \\  & External & & and prob. \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Solutions to intrusions. Figure 2: Defensive life cycle. monitor systems for abnormality and are used for unknown attacks. ADEPTS is an anomaly-based approach that simulates an intrusion based on an attack graph used in identifying and locating possible attack paths and interdependencies between resources services [31; 32]. In misuse detection, the signature of an attack is matched with the signatures of attacks stored in a database; signature-based IDSs are used only for known attacks. The IRS developed by [PERSON] [33] is a signature-based IDS that introduces a response goodness parameter to group a response as either a success or a failure. USTAT [34] is also a signature-based IDS that uses a state transition diagram for the detection of attacks; in this IDS, known attacks are represented by the state of the diagram. The hybrid approach is used for detecting firstly known and then unknown attacks. The mobile visualization hybrid IDS [4] is an adaptive hybrid IDS that uses an artificial neural network for intrusion detection.