Classifying and responding to network intrusions