A network security system and method for reacting to unauthorized data access in an inner data system by combining a redirect system is described. The examples of the redirect system include modified firewalls, IP sharing devices and gateways with examining mechanism. A user request is transmitted to the inner data system via the redirect system if the user request satisfies a certain safety condition. Otherwise, the user request is transmitted to a reaction system which provides virtual data similar to real data so that unauthorized users have the illusion of successfully hacking the inner data system. Meanwhile, the illegal activities are recorded and certain programs like Trojan programs can be used for executing reactions.