A method for establishing the attack group model by means of the relationship graph of various attacks has been proposed.Under the constraints of time characteristics as well as the causality relation it can determine the attack sequence and reconstruct the attack sequence of the cooperative intrusion.Beside

make a timely response without considering the ratio of damage cost and response cost of the individual attack

so as to achieve the maximal reduction of the response cost.