## 3 Common Solutions to Intrusions
### Intrusion Response System  
An IDS basically generates an alert in the form of a report and notification upon the detection of an intrusion. Without an appropriate security countermeasure, IDS is useless. A response system should be integrated with IDS to assist and find the source of an attack [38]. An IDS is classified as either passive or active depending on the response system. Passive response is further divided into notification and manual response, whereas active response is considered automatic. Similarly, an IRS has three main types: notification, manual, and automatic [39]. In a notification system, a response in the form of an alert and a report is generated and sent through e-mail or notification. By contrast, in a manual response system a predefined set of response options exists and is triggered by a security controller with the detection of an intrusion. In these two systems, the time duration within the detection and response activation opens an opportunity for attackers. The Audit Expert System [30] is a host-based misuse detection system that employs an expert system to detect intrusions. However, it simply forwards e-mails, notifications, and reports to system administrators and occasionally generates and sends urgent notifications to mobile phones. In contrast to a manual response system, an automatic response system does not involve a human interface between the detection and response systems. Automatic IRS is further categorized into adaptive, expert, and association-based. In an adaptive system a feedback loop is used to evaluate the previous response. Expert system rules are usually applied-as-a-series-of if-then statements. Furthermore, an expert system uses the signature and anomaly-based approach to detect intrusions. The distinguishing feature of an expert system-based IRS is the separation of control reasoning from the formulated solution to the problem. The expert system has a drawback: it requires excessive initial training and extraordinary care during the lifetime, while in associative-based IRS when an attack occurs a specific predefined response associated to that specific attack is activated [40]. This approach is highly static and the basic type is based on an automated response system that initiates a static automated response upon detection of an attack. These systems are more vulnerable to attackers as the response option is static and the attackers can easily adapt the signature of the stored response strategy [41]. Network IRS [42] and USTAT [34] are associative-based response systems. Decision table and rule-based are the two approaches for automatic systems. The majority of IRSs based on a decision table are implemented where a specific response is associated with each initially known intrusion. A number of the existing IRSs [42; 43] are implemented as automatic response mechanisms by using a rule-based approach for determining how to react to possible detected intrusions. Figure 3: Intrusion detection system architecture [37]. Event Monitoring Enabling Responses to Anomalous Live Disturbances (EMERALD) [44] is an automatic IRS that provides interoperability, high scalability, and applicability to large network infrastructures [44]. It is a distributed IDS for large-scale heterogeneous computing environments. EMERALD overcomes previous IDS limitations and is capable of detecting distributed, coordinated attacks. Furthermore, it is suitable for detecting attacks in large global networks. A signature engine, profiler engine, resolver, and resource object are the four main components of EMERALD. The resolver component is an expert system responsible for analyzing response plans to invoke various response handlers for global response selection. However, an automatic response system has a problem with the generation of inappropriate responses, which has a negative effect on response cost and network performance. Response cost refers to the effect of a generated response option on a system.