Physical layer security offers an efficient means to decrease the risk of confidential information leakage through wiretap links. In this paper, we address the physical-layer security in a cooperative wireless subnetwork that includes a source-destination pair and multiple relays, exchanging information in the presence of a malevolent eavesdropper. Specifically, the eavesdropper is active in the network and transmits artificial noise (AN) with a multiple-antenna transmitter to confound both the relays and the destination. We first analyse the secrecy capacity of the direct source-to-destination transmission in terms of intercept probability (IP) and secrecy outage probability (SOP). A decode-andforward incremental relaying (IR) protocol is then introduced to improve reliability and security of communications in the presence of the active eavesdropper. Within this context, and depending on the availability of channel state information, three different schemes (one optimal and two sub-optimal) are proposed to select a trusted relay to improve the achievable secrecy rate. For each one of these schemes, and for both selection and maximum ratio combining at the destination and eavesdropper, we derive new and exact closed-form expressions for the IP and SOP. Our analysis and simulation results demonstrate the superior performance of the proposed IR-based selection schemes for secure communication. They also confirm the existence of a floor phenomenon for the SOP in the absence of AN.Artificial noise, incremental relaying, network, physical-layer security.S. Vahidian is with the