Abstract: State of art of intrusion response is analyzed before a new classified method ofintrusion response is proposed. A new adaptive intrusion response model is built which adopts XML to describe complex attack in heterogeneous network, fuses intrusion data with Theory of Evidence and responds based on Theory of Cost Sensitive Response. The problems of intrusion response system in large-scale networkare discussed.

Key words: intrusion response, theory of evidence, cost sensitive response