Towards Automated Intrusion Response: A PAMP - Based Approach

Most of the current Intrusion Detection Systems have mainly concentrated on detection ofintrusions with no mechanisms incorporated to respond to such intrusions. The major problem inautomating IDS responses has mainly been because currently IDS experience high false alarmswhich if automated would introduce denial of service or related problems. In this paper wepropose a mechanism that allows for some level of automation of intrusions response. Inparticular we emphasize that patterns exclusively associated with intrusions should be used asthe basis, thereby separating between the network connections that require further processing toestablish as to whether they are anomalous. We base our argument on the Human Immunesystem immune system and as such some biological overview of the same is presented. Finally,we demonstrate that our proposed approach incorporates most of the desired features that havefor long been considered advantageous from studies of the immune system.