Automated IDS response

["Michael B. Rash" <mbr () math umd edu>]

Having your IDS respond automatically to an IP that is generating
questionable traffic by dynamically managing your router ACLs (or other
similar action; tcpwrappers, ipchains, etc...) to deny all traffic from
the IP can be a risky thing to do from a DoS perspective; nmap's decoy
option comes to mind.

It would seem that any IDS should only block traffic from an IP
based on an attack signature that requires bi-directional communication,
like a CGI exploit over http/80 or something.  Are there guidelines for
deploying IDS response that discusses methods for minimizing false
positives?  Are there any *good* ways of doing this?

--Mike
http://www.math.umd.edu/~mbr