基于主动防御策略的安全传输模型

提出了一种基于主动防御策略的安全传输模型．在该模型中，以动态覆盖路由器所支撑的安全域为基本单元，定义了智能代理／管理网元及其具有自相似性的多级、分布式管理的体系结构；引入了诱骗报文，使攻击者无法跟踪到发送的真实加密数据报文；根据检测报文的摘要信息，及时地发现攻击并对其进行有效的跟踪定位，并对支撑安全域的覆盖路由器进行动态管理．该模型不仅提高了网络数据传输的安全性，而且增加了网络管理的有效性，分级、分布式的管理模式使得各层管理可根据实际中不同的需求选择适合本层的路由管理策略，增加了管理的灵活性，提高了路由器的转发效率．

Security transfer model based on active defense strategy

This paper proposed a security transfer model on the basis of the active defense strategy. In the unit of security domains mainly made up of dynamic overlaying routers, the intelligent agent/management of network element together with the self-similar hierarchical and distributed management structure were defined in the model. Deceptive packets were used so that the attackers could not trance the encrypted data packets. According to the digested information from data packets, this model is capable of detecting attacks and tracing back to the attackers immediately. In the meantime, the overlaying routers in the security domain are dynamically administrated. The model not only improves the security of data transfer on the Web, but also enhances the effectiveness of the network management and switching efficiency of routers as well, and in virtue of the hierarchical and distributed management pattern makes it feasible that every layer can choose specifically routing strategy which fits itself independently according to various demand, this model advances the flexility of management furthermore.