Realising Response to IT system intrusions

According to CERT Incidents statistics report on the intrusion of the computer system are growing, with 137,529 reported incidents in 2003 in contrast to 82,094 reported incidents in 2002. In the view of the growing number of incident, the work of securing the network system from the intrusion is a tried job for the system administrator a lone. To ease this job an automated Intrusion Response System (IRS) could handle some of the incident and apply the right countermeasure. In this thesis IDS and IRS are described in general. Generally automated IRS is dependent on an Intrusion Detection System (IDS), and applies responses on the incidents reported by the IDS. These responses can range from collecting data of the incident to launching a counterattack. In order to further our understanding on the subject, we have also explored the existing work on intrusion responses system and look into the classification of IRS that classifies systems in more fine grained categories. We also presented the classification of each type of intrusion and it available automated responses as an overview of our discussion on the subject To further our discussion on the subject of automated response, we then define the require information that the responder need in its decision making process. We also define a 3x3 matrix as a way to calculated and integrated two matrix together to produce and overall view of the whole severity and the impotency of that particular information towards the decisions making of the responder to conjure an appropriate response to counter an attack in the view of the given contextual constrain.School of Computing, Communications and Electronic