Active Response

An excellent article on the application of laws to intrusion response (generally regarding physical intrusions of homes/businesses)

S. D. Mitchell and E. A. Banker, "Private Intrusion Response," Harvard Journal of Law and Technology, vol. 11, pp. 700-7

Porras and Neumann's EMERALD IDS

P. A. Porras and P. G. Neumann, "EMERALD: Event Monitoring Enabling Responses to Anomalous Live Disturbances," presented at 20th National Information Systems Security Conference, 1997.

A method to dynamically alter the exposure of a host to contain an intrusion when it occurs

A. Gehani and G. Kedem, "RheoStat: Real-time Risk Management," presented at 7th International Symposium, RAID 2004, Sophia Antipolis, France, 2004.

A short bibliography of intrusion detection research