Patent ID: 7093290

Claim:
A security system on a network, comprising: intrusion detecting means for detecting an intrusion through an analysis of a packet, adding intrusion information associated with the intrusion into the packet, creating an active packet and transmitting the active packet to an address of an intruder which transmitted the packet; and routing means for tracking the intrusion, for all routes through which the intruder passed, based on the active packet transmitted thereto from the intrusion detecting means, and filtering the packet associated with the intruder, thereby isolating the intruder, wherein the routing means includes active nodes on a local networks of a user to be attacked and the intruder; wherein the intrusion detecting means includes: collection means for collecting packets which pass therethrough; analysis means for receiving the packet from the collecting means and determining whether the packet is one associated with intrusion or an active packet; and processing means for processing the intrusion information or the active packet, which is received from the analysis means; wherein the processing means, if the data received from the analysis means is one associated with the intrusion information, creates an active packet associated with the intrusion information and transmits it to another local network, and if the data received from the analysis means is the active packet, analyzes whether the active packet is concerned with the intrusion information, and wherein if the intrusion is made via an authenticated server, the processing means creates a mobile agent, transmits the same to the server and retrieves information for the intruder.