Patent ID: 7200866

Claim:
A system for defending against a distributed denial-of-service attack comprising: an intrusion detection system for generating alert data if a denial-of-service attack is detected; an active security management system for managing a domain, analyzing the alert data to determine whether the denial-of-service attack is the distributed denial-of-service attack, generating and transmitting a backtracking sensor for backtracking an attacker of the distributed denial-of-service attack in a case of the distributed denial-of-service attack, transmitting mobile sensors to a host backtracked by the backtracking sensor to remove a master or an agent program within the host, generating and transmitting a backtracking sensor by using an IP address of a host that has transmitted a packet to the removed master or agent program; and an active security node located at a boundary of the domain, executing the transmitted backtracking sensor to backtrack an attacking host of the distributed denial-of-service attack and, if the backtracked host is determined as a real attacker, intercepting a traffic generated from the real attacker.