## 5 Responses to Attacks
The percentage of successful responses in the past is denoted by SF, whereas the risk factor shows the impact the considered response will have on legal users. EV(Expected value) is the basis of the ideal response selection for response rS of a sequence where  
\[\text{S: EV (rS) = Prsucc(S) \times SF+(Prrisk(S) \times(-RF)),}\]  
where Prsucc is the probability of the occurrence of sequence S. This study selects the optimum response only if the (EV (Rs)) value is high, whereas a higher EV indicates a better response. Protecting network and computer systems against exploitation before such an exploitation occurs is impossible because vulnerabilities are not known in advance. Intrusions can occur in a PC without any connectivity to a network. With the development of a global network and information sharing, security problems have become more serious than ever. Modern network-based IDSs [73; 74] and host-based IDSs [31; 44] can initiate responses in addition to simple alarms or notifications. Analysis results recorded in a log file are used to generate a report based on the attack response type. Immediate responses trigger an alarm linked to the network manager console, after which a message is promptly displayed in the security manager's page and an e-mail is also sent to a system administrator. These are possible examples of response options [75]. This section presents some common response options for host- and network-based IDSs. These responses are summarized in the Table 7 as follows:  
Figure 4: Response selection process. In report/alarm generation, intrusive behavior is communicated through reports, e-mail messages, pager messages, or a console window that provides critical information to system administrators. Next the intruding node should be completely and immediately isolated from the network. Although the main disadvantage of this technique is attributed to the network performance degradation. A GIDP mechanism responder should be installed to detect incidents in all cases in a predetermined fixed mode by isolating the intrusive nodes that may cause a variety of attacks [35; 76]. In some cases the direct isolation of critical attackers could cause the whole network to shut down; thus, in avoiding such a case, a relocation response is adopted for securing the network system [77]. Furthermore, in a no-punishment response an intrusion is simply ignored when the performance of the network is not affected by the intrusion. In addition, if the cost of the response is greater than the cost of damage from attack, the no-punishment response option is activated from pre-stored response options. In a service denial response a network node terminates the services offered by or provided to intruders. The locking of user accounts is a response in which the account of a user is locked and the session of the user is terminated to prevent future attacks. The purpose of an ICMP response is to ensure that the attacking host identifies the victim network or prevents a \"requested service is unavailable\" response [78]. However, differentiating true attackers from normal users is difficult, so enabling remote logging in to another system is the best method to collect additional information about attackers. Blocking the IP addresses of specific attackers is also an alternative. The shutdown response option is the most suitable mechanism for protecting a network or a computer system under active attack from being further compromised. Network disconnection is an appropriate solution against network-based attacks when shutting down the host or the network system is not an option. In a response involving the disabling of attacked ports, a specific port used as the basis for attack generation is disabled. These responses effectively stop attacks without affecting other system resources. Symmetec Security Response systems protect computer systems from Code Red attacks. Code Red [79] is an attack on the IIS (Microsoft Internet Information) web server.