## 3 Common Solutions to Intrusions
### Intrusion Response System
Therefore, in an automatic response system a response option strategy is necessary in selecting appropriate response. From the response options, the optimum response is selected according to the attack statistics. IRS in networks ensures security is one of the main issues in any computer networks due to heterogeneous devices that can be easily accessed and utilized. Unsecured communication in a network allows potential attackers to access the private data of users. Meanwhile, different communication networks are available, such as Wi-Fi, LTE 3G/4G, and wireless networks, which connect end users to network resource [45]. The process of transferring data from a PC (source) to the server (destination) goes through various network communication devices such as routers and switches, from which possible attackers can capture useful information. However, firewall, encryption, and access controls are common solutions offered to protect different communication networks from unauthorized access. These defensive mechanisms are unable to secure the network from malicious traffic and insider attacks [46; 47]. Therefore, the installation of an IRS on the network is necessary to protect the network from malicious traffic and network-based attacks. Attacks on the network exploit physical, network, data link, and transport communication protocols. Moreover, the open nature of the network and the lack of centralized monitoring control make wireless ad hoc networks more vulnerable to attacks such as DoS, DDoS, sniffer, port scan, and spoofing attacks [36; 48; 49]. Common attacks on the network comprise active and passive attacks [35]. Active attacks disrupt the operation of the attacked network and causes serious damage to the network. In passive attacks the attackers collect valuable information from the communication link to attack the functioning element in the network. Jamming, flooding, DoS, hole attacks (wormhole, blackhole, sinkhole, etc. ), and Sybil types are the most common examples of active attacks. Node malfunctioning, eavesdropping, and node tampering/destruction are examples of passive attacks. Both passive and active attacks degrade the performance and operation of the entire network. Designing a single security system or IDS for a large enterprise heterogeneous network is often not practical. This is due to several challenges associated with existing IDS due to the centralized paradigm architecture that need to be overcome. Some of these challenges could be addressed by using a distributed architecture and considering network performance in the design of this architecture. Therefore, to resolve the aforementioned security issues in the computer network, an IRS must have automatic countermeasures to continuously monitor network traffic for various types of malicious activities. The IRS can be divided into two types: autonomous and cooperative [50]. Autonomous IRSs handle intrusion independently at the time of detection, while cooperative IRSs have the ability to autonomously configure response systems in finding intrusions in the network. Most of the IRSs in the network are built based on a cooperative approach. The network-based IRS is deployed in the transport layer to monitor network traffic for various types of intrusions. A layered security system can reduce the possibilities of being hacked as it provides multiple ways of integrating security [51]. In addition, the IRS terminates network connections when any network traffic matches the stored signature of malicious behavior in its database [52]. CSM, ADEPT, and network-based IRS are designed for the network environment in detecting any malicious behavior in the network and also provide useful countermeasure responses [31; 42; 53]. IDAR [36] is a flexible and adaptive approach that takes the benefits of both knowledge-based and anomaly-based techniquesto secure MANET from a variety of attacks. The selection response is based on the confidence level of the detected intrusions, the attack severity, and the network performance degradation.