## 3 Common Solutions to Intrusions
### Intrusion Detection System
A generalized intrusion detection and prevention (GIDP) mechanism for mobile ad hoc-networks [35] combines anomaly detection, signature-based approaches and responds to intrusions in a predetermined static manner by isolating intrusive nodes. An intrusion detection and adaptive response mechanism [36] uses a hybrid approach, responds to intrusions in a flexible adaptive manner. That is, it selects a response on the basis of IDS confidence and attack severity, and conducts network performance degradation. Figure 3 presents the basic architecture of intrusion detection system. \begin{table}
\begin{tabular}{c c c c} \hline \hline
**Types of IDS** & **Description** & **Pros** & **Cons** \\ \hline \multirow{6}{*}{Host-Based} & Host-based IDSs are installed on a specific machine such as a server & \(\bullet\) & At the transport layer, it \\  & and mobile devices that monitor & & monitors network traffic. & \(\bullet\) & Formation at a host may cause severe \\  & the operating system’s audit & \(\bullet\) & Does not require & \(\bullet\) & Lunation-of-the network. \\  & information for any sign of & & additional hardware. & \(\bullet\) & \(\bullet\) \\  & intrusion. In addition, they detect & \(\bullet\) & Can deal with switched and & \(\bullet\) & \(\bullet\) \\  & which programs are accessing & & encrypted environments. & \(\bullet\) & involve software \\  & which part of the system & \(\bullet\) & Can help with the detection & & integrity breaches. \\  & or resources. & & of a Trojan horse. & \\ \hline \multirow{6}{*}{Network-Based} & Network-based IDSs monitor & \(\bullet\) & Cost-effective. & \(\bullet\) & It is far from the \\  & network traffic and application & \(\bullet\) & NIDS can detect attacks that & \(\bullet\) & individual host. \\  & protocol activity between any two & \(\bullet\) & AWS for quick response. & \(\bullet\) & Unable to monitor \\  & computers for any type of & \(\bullet\) & It is easy to deploy as it does & & and analyze \\  & intrusion. & & not affect & \(\bullet\) & encrypted packets. \\  & & & existing infrastructures. & \(\bullet\) & Requires \\ \hline \multirow{6}{*}{Hybrid} & This is combination of both HIDS & & \multirow{2}{*}{\begin{tabular}{c} Provides in-depth defense. \\ of anomaly- and misuse-based \\ approaches. A system log file \\ checker is performed by the \\ mobile agent traveling to each \\ host, while the overall network \\ can be checked by a central agent \\ for the existence of anomalies. \\ \end{tabular} } & \multirow{2}{*}{\
\begin{tabular}{c} Provides in-depth defense. \\ Gives administrators the \\ ability to quantify attacks. \\ \end{tabular} } & \multirow{2}{*}{
\begin{tabular}{c} Generates false positives \\ and false negatives. \\ \end{tabular} } \\  & & & \(\bullet\) & Reacts to attacks rather \\  & & & \(\bullet\) & than prevents them. \\  & & & \(\bullet\) & Generates an enormous \\  & & & \(\bullet\) & amount of data to \\  & & & \(\bullet\) & be analyzed. \\  & & & \(\bullet\) & It is most expensive. \\ \hline \multirow{6}{*}{Distributed} & Various IDS (HIDS and NIDS) are combined by working as faraway sensors and constructing a report about intrusions. Later submits report to a centralized control, called distributed IDS. Uses remote sensors that can be host-based, network-based or even a combination of host- and network-based. & \(\bullet\) & It utilizes traffic information from various sources. & \(\bullet\) & The flow of data may \\  & & & \(\bullet\) & generate huge network \\  & & & \(\bullet\) & movement overheads. \\ \cline{1-1}  & & & \(\bullet\) & The system uses data \\ \cline{1-1}  & & & & \(\bullet\) \\ \cline{1-1}  & & & & \(\bullet\) \\ \cline{1-1}  & & & \(\bullet\) & packets that may be \\ \cline{1-1}  & & & \(\bullet\) & obtained from a network. \\ \cline{1-1}  & & & \(\bullet\) & A program can be edited \\ \cline{1-1}  & & & \(\bullet\) & or interrupted by \\ \cline{1-1}  & & & \(\bullet\) & an intruder. \\ \cline{1-1}  & & & \(\bullet\) & attack data. \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Intrusion detection system types.