Patent ID: 7386733

Claim:
An alert transmission apparatus for a policy-based intrusion detection and response, comprising a central policy server (CPS) and an intrusion detection and response system (IDRS), wherein the CPS includes: a policy management tool for generating security policy information and storing the generated security policy information in a policy repository; a COPS-IDR server for sending the security policy information provided from the policy management tool to the IDRS through a COPS-IDR protocol and providing an IDMEF-XML-type alert transmission message having an IDMEF-XML-type alert message provided from the IDRS to a high-level module; and an IDMEF-XML message parsing and translation module for parsing and translating the IDMEF-XML-type alert transmission message provided from the COPS-IDR server, and then storing the IDMEF-XML-type alert transmission message parsed and translated at an alert DB or providing the IDMEF-XML-type alert transmission message parsed and translated to an alert viewer corresponding to the high-level module, and wherein the IDRS includes: a COPS-IDR client for receiving the security policy information from the COPS-IDR server through the COPS-IDR protocol and providing the IDMEF-XML-type alert transmission message to the CPS through the COPS-IDR protocol, with the IDMEF-XML-type alert message being encapsulated into an alert object to generate the IDMEF-XML-type alert transmission message; an intrusion detection module for detecting an intrusion in case a hacker intrudes while the security policy information provided from the COPS-IDR client is being executed and generating a raw alert transmission message; an intrusion response module for responding to the intrusion in case the raw alert transmission message is transmitted thereto from the intrusion response module; and an IDMEF-XML message building module for generating the IDMEF-XML-type alert message by formatting the raw alert transmission message and providing the generated IDMEF-XML-type alert message to the COPS-IDR client; wherein an object of the COPS-IDR protocol includes a S-Num field for identifying the object, a S-Type field for distinguishing encoding methods and an object contents field having a variable length.