An Intelligent Intrusion Detection and Response System Using Network Quarantine Channels: Firewalls and Packet Filters

There major challenges for current intrusion detection systems (IDS) which attempt to identify suspicious network traffic. Due to the high percentage of alerts generated by such systems, the level of false positives is among the significant problems. We present intelligent strategies for reduction of false positives and infrastructure protection using a novel approach using adaptive responses from firewall packet filters in what we call, network quarantine channels(NQC). The focus of this paper is on the responses from the packet filters which collaborate with the NQC to reply to suspicious hosts and them deny access to sensitive data servers in the infrastructure. The firewall packet filters provide effective intelligent responses by to granting access to the normal packets and denying malicious traffic access to the network, after the identity of the connections are verified through the statistical analysis in the NQC. These effective strategies reduce false positives and increases detection capability of the IDS.