Automatic intrusion response system based on aggregation and cost

One of the most significant issues in intrusion detection is automating responses to intrusions, but has so far been largely overlooked and therefore requires further research in its own right. And another main weakness of current intrusion detection systems is that they often generate too many same or similar alerts for one intrusion and system immune alerts. This will use a lot of time to respond repeatedly. As a result, a better method to solve above problem is making use of the aggregation to classify the alerts and the Response Cost to decrease the system immune alerts. At last, this paper presents a modal of automatic intrusion response system and introduces the implement in detail.