ATTACK RESPONSES

Attacks propagated against IT systems and how they can be curbed has been an important information security issue in recent times. Intrusion Detection Systems (IDSs) are employed in the monitoring of computer systems for indications of security violations. On detecting such signs, alerts are triggered by the IDSs which are reported to the human analyst for further actions to be carried out. In some cases, such intrusions may go undetected thereby compromising the system or network. A n approach seen to be useful in identifying compromised systems as well as addressing the problem of the large number of false alerts generated by IDS systems is by looking at the type of responses that compromised systems may generate. However, not all generated alerts are true indications of a propagated attack. This research thesis reviewed existing research in the area of utilising detection of attack responses. Carrying out the project also involved researching threats facing IT systems as well as highlighting a broad classification of attacks that can be propagated against IT systems and networks. A number of attack responses rules and scenarios where they can be triggered were also researched. This was done in order to investigate ways that may enhance intrusion detection with attack responses thereby improving IT security in a general context. It was also done with the aim of highlighting the problems inherent with use of the detection of attack responses and how they can be addressed. The findings from the research analysis mostly centered on the various impacts vulnerability exploits had in aiding propagation of attacks on IT systems. Based on the analysis of the findings, the project put forward recommendations that may aid detection of intrusions amongst which were more effort to be made in automating IDS responses to attacks and a better interoperability between various IDS models. Adequately educating and training IT security personnel involved with IDS operations was also recommended by the project. Finally, the carrying out of this project is solely to contribute to the growing IDS technology knowledge and awareness as well as arouse the interest of any interested reading audience in the field of IT security. iiiSchool of Computing, Communications and Electronic