High-interaction deception defense and attack tracing method based on RASP technology

Abstract

The invention discloses a high-interaction deception defense and attack tracing method based on an RASP technology, and the method specifically comprises the following steps: S1, RASP implantation and bait deployment, S2, attack detection and simulation triggering, S3, attack session redirection and high-interaction deception, S4, attack behavior monitoring and tracing data collection, and S5, tracing analysis and threat disposal. The invention relates to the technical field of network and information security. According to the high-interaction deception defense and attack tracing method based on the RASP technology, a deception mechanism is embedded into a real application / system in operation, and high fusion of a real business environment and a false trapping environment is achieved. Different from a traditional'main-auxiliary separation 'mode that a honeypot is placed in an independent network or a host, the method has the advantage that the application can be changed to generate a'trap' during running through the RASP. The seamless embedded spoofing makes attackers difficult to distinguish true and false: the attackers attack a part of a production system initially, and then are introduced into a parallel simulation space unconsciously.

Description

Technical Field

[0001] This invention relates to the field of network and information security technology, specifically to a highly interactive deception defense and attack tracing method based on RASP technology. Background Technology

[0002] With cyberattacks escalating, traditional passive defense methods often struggle to detect advanced intrusions in a timely manner. Deception defense, as a proactive defense strategy, lures attackers by deploying decoys and simulated environments within the system, monitoring and guiding their attack behavior to achieve the goals of early intrusion detection, delaying attack progress, and collecting attack evidence. A typical implementation of deception defense is honeypot technology: deploying meticulously disguised fake hosts or services to induce hackers to treat them as real targets. The value of honeypots lies in their "being attacked" nature—any interaction with a honeypot can essentially be considered malicious behavior, allowing defenders to obtain crucial information such as the intruder's attack path and tools, supporting security response and attack attribution. Highly interactive honeypots, due to their behavior and services closely resembling real systems, are more likely to retain attackers for in-depth intelligence gathering, but this also places higher demands on the realism and security isolation of the deception environment.

[0003] While deception defenses have demonstrated unique advantages in practical applications, existing technologies still suffer from several shortcomings: First, the real production environment and the decoy environment are largely separate, lacking integration. For security reasons, honeypots are often deployed in isolation on networks or hosts different from the real business environment. This separation of primary and secondary environments allows attackers to detect environmental differences during deep penetration, thus exposing the deception. Second, many deception systems have poor simulation capabilities, resulting in unrealistic trapping environments. For example, early honeypots were often simple simulated services or low-interaction virtual machines, failing to provide the same interactive details as the real system. Experienced intruders can easily identify the "fake" by querying system information and network configurations, causing them to quickly leave the honeypot and failing to extend their stay to gather more clues. Third, existing solutions generally lack precise attack attribution methods. Although honeypots can record attack traffic and behavior logs, attackers often use jump servers, proxies, etc., to hide their true identities. Traditional honeypots can only obtain limited source clues (such as IP addresses and malicious samples), making it difficult to directly identify the hacker behind the attack and thus hindering further sanctions or prosecutions. These problems significantly limit the deeper impact of deception defense technologies.

[0004] To address these challenges, industry and academia have proposed several improved deception defense solutions and invention patents. For example, patent CN111756742B, "A Honeypot Deception Defense System and its Deception Defense Method," proposes setting up a special service response mechanism within the honeypot to spoof its network attributes and mislead attackers. Specifically, this solution intercepts and responds to network configuration viewing commands sent by attackers without altering the actual network connection settings of the honeypot, returning pre-set spoofed data to mislead attackers into believing that the honeypot host "can access the external network." By creating the illusion that the honeypot has internet connectivity, attackers' doubts about its authenticity are reduced, making them more likely to launch a deeper attack. This solution improves the realism of the honeypot environment at the network layer to some extent, delaying the time it takes for attackers to uncover the deception. However, its simulation is limited to the illusion at the network configuration level; the honeypot's system and business behavior are not fully simulated, and experienced attackers may still discover flaws through more in-depth operations. Furthermore, this method focuses on deception and inducement, without providing a robust tracing mechanism for attacker identity information. Ultimately, it only obtains attack traffic and behavior records, making it difficult to accurately pinpoint the source of the attack.

[0005] Patent CN115277068B, "A Novel Honeypot System and Method Based on Deception Defense," proposes a scheme to construct a highly realistic decoy environment and combine it with multiple methods for attack tracing. This scheme builds an independent simulation system (which can be a software simulation environment, container, or virtual machine) and deploys decoys to guide attackers, inducing / redirecting their traffic to a highly interactive virtual honeypot. For example, multiple virtual IP addresses are bound to a single physical host, and these IPs are mapped to the honeypot environment in the background to generate a large number of virtual assets in batches, expanding the decoy surface. When attackers scan or use the decoys to access these virtual assets, they fall into the carefully constructed simulation environment and are subjected to a controlled attack. Simultaneously, the patent also designs multiple countermeasures to analyze and trace the information collected during the attack process and generate threat intelligence. Compared to traditional honeypots, this scheme excels in improving the realism of the decoy environment and enriching the decoy methods, extending the time intruders stay in the trap, and allowing for a certain degree of tracking of their attack behavior. However, this solution still has shortcomings: its decoy environment is separated from the real system. Although it employs highly realistic simulation methods such as containers / virtual machines, it is ultimately disconnected from production environment data and business activities. For advanced persistent threats (APTs) with clear objectives, if the honeypot lacks real business data or cannot interact with the real production chain, attackers may notice the anomaly during in-depth penetration and abandon the attack. Furthermore, the attribution tracing mentioned in patent CN115277068B mainly relies on embedding special decoys (such as encrypted decoy data packets) in attack traffic and monitoring the attacker's decryption behavior. While this can obtain some attack tools or key information, it may not be able to accurately pinpoint the attacker's true identity. For example, attackers can use proxy IPs and anonymization tools to operate the decoy without exposing key identity information, and existing countermeasures are still unable to detect their identity. Therefore, the attribution tracing capability of this solution still falls short of "accuracy."

[0006] Patent CN110493238A, "Honeypot-Based Defense Method, Device, Honeypot System, and Honeypot Management Server," attempts to improve deception defense from a primary-secondary integration perspective. This solution deploys several physical devices as honeypot nodes in a real-world network environment, integrating the honeypot into the real-world scenario. For example, real servers, cameras, and other physical devices are placed in different segments of the enterprise intranet to act as decoy points, making it difficult for attackers to distinguish between legitimate devices and honeypots. When attackers compromise these devices, the defender can monitor their behavior. This approach significantly improves the realism and deceptiveness of the deception environment—the honeypot device itself is part of the actual network, making it difficult to distinguish between real and fake. However, it requires additional hardware and maintenance costs, and modifications to existing systems, resulting in high implementation complexity and difficulty in flexibly scaling to large-scale, dynamically changing environments. Furthermore, this solution focuses on hiding the "fake" identity of the honeypot on a macro level, with relatively less emphasis on capturing and finely tracing the details of attacks. While this solution can record attack behavior and identify the source network segment to some extent when an attack occurs, it doesn't offer new technical means to proactively obtain more information about the attacker. In other words, attackers can still use traditional methods to hide their true location and identity. The solution's ability to locate the attack source remains at the level of general network tracing, failing to meet the needs of precise attribution.

[0007] In summary, existing deception defense technologies have significant shortcomings in terms of the integration of real business with the deceptive environment, the depth of simulation interaction, and the accuracy of attack attribution: the real system and the trap system are relatively isolated (master and slave separation), the deception environment is often not realistic enough to induce high-level attack behavior in the long term, and there is a lack of effective means to obtain clues about the attacker's true identity. These are the core technical challenges that this invention aims to solve. Summary of the Invention

[0008] (a) Technical problems to be solved To address the shortcomings of existing technologies, this invention provides a highly interactive deception defense and attack tracing method based on RASP technology, overcoming defects such as separation of primary and secondary environments, insufficient simulation capabilities, and inaccurate attack tracing. By introducing Runtime Application Self-Protection (RASP) technology into the field of deception defense, this invention aims to achieve seamless integration of the deceptive environment and the real business environment, significantly improving the realism and interactive depth of the deceptive environment; simultaneously, it captures and transfers attack behavior in real time without affecting normal business operations, providing ample material for in-depth attacker analysis; finally, through innovative monitoring and tracking mechanisms, it accurately pinpoints the source of attacks, compensating for the deficiencies of existing honeypot systems in attacker identity tracing. In short, the core objective of this invention is to construct an embedded, highly realistic active deception method that can lure attackers into a "false trap" at runtime during an attack and deeply monitor their behavior, achieving highly interactive deception of the attack process and accurate tracking of the attacker's identity.

[0009] (II) Technical Solution To achieve the above objectives, the present invention provides the following technical solution: a highly interactive deception defense and attack tracing method based on RASP technology, specifically comprising the following steps: S1. RASP Implantation and Decoy Deployment: Pre-implant RASP monitoring and decoy logic in the target application or host system; S2, Attack Detection and Simulation Trigger: When a running application is subjected to malicious input or operation by an attacker, the RASP monitoring unit intercepts and determines the malicious nature of the attack in real time. S3. Attack Session Redirection and High-Interaction Deception: After the simulation environment is ready, the attacker's session is seamlessly switched to this environment to continue execution, thereby achieving guidance and control of the attack behavior; S4. Attack behavior monitoring and source tracing data collection: During the interaction between the attacker and the simulation environment, the entire attack process is recorded in fine detail through RASP probes and monitoring components within the simulation environment, and evidence required for source tracing is collected. S5. Source Tracing Analysis and Threat Management: After successfully capturing and recording the entire attack process, the collected data is comprehensively analyzed to extract valuable source tracing conclusions and security decision-making information.

[0010] Preferably, in step S1, RASP probe code is loaded during application startup or system runtime to hook key function calls and system interfaces, enabling real-time monitoring of the running process. Through RASP technology, the application itself possesses security monitoring capabilities, detecting suspicious behaviors such as SQL injection, code execution, unauthorized operations, and abnormal system calls without the need for external agents. Furthermore, while deploying RASP, decoy information is strategically placed within the system as an incentive to attract attackers. The decoy is disguised sensitive data (such as fake accounts, fake configuration files, seemingly valuable database entries, etc.) or hidden interfaces or command entry points. Hidden management ports are reserved in the application, or simulated confidential files are placed in the file system. When attackers scan ports or traverse files, the decoy increases the probability of triggering monitoring. Once an attacker attempts to access the decoy, the RASP probe can quickly detect it, preparing for subsequent capture.

[0011] Preferably, in step S2, the RASP monitoring unit determines the malicious nature of an operation based on preset security policies and behavioral characteristics. For example, it may detect a judgment (1=1) in an SQL statement, an abnormal character sequence in the command line, an abnormal function call order, or a system call attempting to perform sensitive operations (adding an administrator account, modifying critical configurations, etc.). Once RASP determines that an operation is an attack (or highly suspicious), it triggers the simulation environment preparation process. The simulation environment uses one of two strategies for simulation. In specific implementation, the solution can be selected based on the actual scenario: for scenarios with extremely high response requirements, a hidden simulation instance is pre-enabled to shorten the switching delay; for general scenarios, the current application process is quickly cloned or a lightweight container is enabled when triggered, making it a new carrier for the attacker's interaction. The goal is to prepare a parallel space highly similar to the real environment at the moment the attack occurs, laying the environmental foundation for subsequent deception. This simulation environment is isolated from the real system in terms of network and permissions, ensuring that the attacker's subsequent malicious operations will not damage the production system.

[0012] Preferably, when the simulation environment adopts strategy one for simulation, it specifically involves: pre-creating a high-interaction trap environment and keeping it on standby; and pre-deploying an isolated container or virtual machine image on the same host, which has the same software environment and initial data as the real system.

[0013] Preferably, when the simulation environment uses Strategy Two for simulation, it specifically involves: dynamically generating the simulation environment and immediately copying the current system or application's running state to an isolated container when an attack is detected.

[0014] Preferably, in step S3, after detecting malicious input, RASP does not simply block or issue an alarm. Instead, it redirects the attacker's subsequent requests to the simulation environment via hook functions. For example, for an attacker's session in a web application, RASP can modify its session context or connection forwarding policy, so that the interface accessed by the attacker is actually responded to by the simulation container. For local process privilege escalation attacks, RASP can start a controlled child process (located in a sandbox environment) to take over the execution of the attack payload and falsely report success to the attacker. Through this transparent redirection, the attacker is unaware that they have been guided to a "fake" environment and still believes that the attack is proceeding smoothly on the original target. Then, the simulation environment acts as a highly interactive honeypot, fully responding to the attacker's various operational requests. For example, when an attacker attempts to execute system commands in a web application, the simulation environment returns a seemingly realistic system response (file list, user permissions, etc.), simulating behavior consistent with the real host. If the attacker uploads a backdoor program, the simulation environment allows it to run and provides the expected results, but in reality, the program is restricted to the sandbox.

[0015] Preferably, the simulation environment strives for high fidelity, inheriting most of the environmental parameters of the original system (hostname, user account, directory structure, data format returned by service interface, etc.) to minimize the exposure of false vulnerabilities. This is achieved through the highly interactive deception defense in step S3. Attackers are deeply trapped in the fake environment and continue to make their attack attempts, unaware that the real production system has already isolated them.

[0016] Preferably, in step S4, the system meticulously records every operational instruction, input parameter, and low-level behavior triggered by the attacker, such as system calls and network connections, and organizes them into a time-series log. This provides a basis for post-attack analysis of attack techniques. During the interaction process, the system proactively embeds source-tracing markers to obtain more information about the attacker. For example, when an attacker attempts to download a "sensitive file" in the simulation environment, the system can provide a file with pre-embedded watermark tracking code (such as a document with hidden links or an executable file) for download. Once the attacker brings the file back to their local host and opens it, the hidden code in the file will attempt to connect to a predetermined listening server, sending back intelligence such as the attacker's terminal's network address and system environment fingerprint to the defender, thus achieving reverse detection of the attack source. For specific data input by the attacker in the simulation environment (such as the key used to decrypt a decoy file, the password used to attempt to log in to the backend, etc.), the system immediately records and analyzes this data, extracting clues such as commonly used password features and tool fingerprints of the attacker.

[0017] Preferably, external intelligence sources are used to conduct correlation analysis on attack traffic. For example, captured malware samples are compared with known threat intelligence databases to determine the hacker organization the attacker may belong to or the attack framework used. Through monitoring and data collection methods, not only is the complete behavioral chain obtained when an attack occurs, but also multiple layers of tracking mechanisms are embedded, exposing more identity-related information unintentionally to the attacker. All of this data lays the foundation for subsequent in-depth source tracing analysis.

[0018] Preferably, the specific processing steps for source tracing analysis and threat handling in step S5 are as follows: T1. First, locate the attack source IP and its network environment based on the return results of the attack traffic. Combine the geographic location database and ISP information to determine the approximate physical location or affiliated organization of the attacker. If the watermark tracking of the decoy document obtains the attacker's hostname, MAC address and hardware information, it further corroborates its identity characteristics. T2. Analyze the toolchain and techniques used by the attackers, compare them with the feature database of known attack groups, determine the possible background of the attackers, organize the account and key information exposed during the attack, and find the attackers' activity trajectory on other platforms. For example, use the usernames they try to log in to search for corresponding accounts on the dark web or open source intelligence in order to uncover deeper identity clues. T3. After obtaining the above analysis results, a threat intelligence report on the attack is generated, including the attack path, the exploited vulnerabilities, and the possible identity and intent of the attacker. This intelligence is used for further security response decisions, such as adding the attack source IP to the blocking list, raising the alert level of relevant business systems, and even submitting clues to law enforcement agencies to track down the attacker. Thus, this method completes a full process from attack discovery to entrapment and tracing, significantly improving the ability to identify and combat attackers while ensuring the security of production systems.

[0019] (III) Beneficial Effects This invention provides a highly interactive deception defense and attack tracing method based on RASP technology. Compared with existing technologies, it has the following advantages: (1) This highly interactive deception defense and attack tracing method based on RASP technology achieves a high degree of integration between the real business environment and the fake trapping environment by embedding the deception mechanism into the running real application / system. Unlike the traditional "master-slave separation" mode that places honeypots on independent networks or hosts, this invention uses RASP to transform the application into a "trap" at runtime. This seamless embedded deception makes it difficult for attackers to distinguish between the real and fake: their initial attack is indeed part of the production system, and they are then unknowingly introduced into a parallel simulation space. For attackers, the whole process is as if it is still taking place on the original target, without obvious traces of environment switching, which greatly improves the concealment and credibility of the deception. Correspondingly, the defender no longer needs a large number of additional physical honeypot devices to achieve a realistic effect, reducing deployment and maintenance costs.

[0020] (2) This highly interactive deception defense and attack tracing method based on RASP technology has a higher degree of interactive realism. The decoy environment provided by this invention has high interactivity and high fidelity, which is significantly better than low-interaction honeypots with poor simulation capabilities. Since the simulation environment is directly derived from real applications (through process cloning or container replication, etc.), it inherently inherits the configuration and state of the real system, such as the real system version, network architecture, file directory, and business data format. Attackers can perform complex attack steps (such as multi-step penetration, lateral movement, etc.) in it, and the system will respond reasonably. It will not expose its vulnerabilities when encountering unconventional operations, unlike a simple simulated honeypot. The highly interactive and realistic deception effectively delays the attacker's vigilance, prompting them to be deeply "hit" and continue to invest attack resources. This not only buys valuable reaction time for the defender, but also enables the capture of more comprehensive attack chain information. For example, in this method, the attacker may execute a complete action chain from initial vulnerability exploitation, privilege escalation, a series of internal probing, to data theft. Our simulation environment can simulate the corresponding scenarios and record them. This depth of interaction is something that traditional deception defenses with limited simulation capabilities cannot achieve.

[0021] (3) This highly interactive deception defense and attack tracing method based on RASP technology has precise attack tracing capabilities. While trapping attacks, this invention integrates multi-layered methods to achieve precise tracing of attackers. Through RASP monitoring and implanted tracing markers, this method not only records the attack behavior itself, but also obtains fingerprint information of the attacker's environment and potential identity clues. For example, by using the "bait file return" technology to obtain hard intelligence such as the attacker's host identifier and network location, it goes a step further than traditional honeypot tracing that only has the IP address of the attack source. Combined with the collected tool fingerprints, behavioral characteristics and external intelligence correlation analysis, the defender can more accurately infer the attacker's background attributes (organization, habitual methods) and even lock down specific suspects. In other words, this invention deeply integrates deception defense with threat intelligence, achieving a tracing accuracy that is difficult to achieve with traditional honeypot systems. In contrast, most existing solutions can only provide limited clues, while this method is expected to directly provide a basis for subsequent law enforcement evidence collection or countermeasures, and more effectively deter and combat malicious attack behavior.

[0022] (4) This highly interactive deception defense and attack tracing method based on RASP technology has real-time protection and security reliability. Relying on RASP runtime monitoring, this invention achieves real-time response to attack identification and trapping, bringing the attack into a controllable track as soon as it occurs, transforming defense from passive to proactive. While ensuring a high degree of deception, the real production system is effectively protected: once an attack is triggered, it is transferred to an isolated environment, and even if the attacker acts recklessly afterward, it will not cause any harm to the actual business. Compared with the traditional process of first detecting and alarming and then manually isolating, this invention automates the response chain to the millisecond level, avoiding damage to the system during the gap between the initial intrusion and isolation processing. Furthermore, this solution is mainly implemented through software, with minimal intrusion into existing systems: the RASP probe has low resource overhead and does not affect the normal function of applications; the simulated trapping environment is triggered on demand and is normally in a silent or low-power state, without interfering with business operations. Overall, the method of this invention is secure, lightweight, and efficient, and can be smoothly integrated into various production environments. While significantly improving the deception defense effect, it ensures the stability and reliability of the real system and does not introduce new security risks.

[0023] (5) This highly interactive deception defense and attack tracing method based on RASP technology innovatively combines RASP technology with deception trapping strategies to achieve highly interactive honeypotting in real business environments, effectively compensating for the shortcomings of existing deception defenses in terms of authenticity, interaction depth, and tracing capabilities. This method can trap and subjugate attackers without affecting normal business operations, providing a new proactive approach to network security defense, and has significant practical value and promotional significance. Attached Figure Description

[0024] Figure 1 The flowchart below shows the high-interaction deception defense and attack tracing method based on RASP technology of this invention. Figure 2 This is a schematic diagram illustrating the fusion and switching between the real environment and the simulated trapping environment of this invention. Detailed Implementation

[0025] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0026] Please see Figure 1-2 The present invention provides five technical solutions: a highly interactive deception defense and attack tracing method based on RASP technology, specifically including the following embodiments: Example 1: RASP probe deployment and trap entry point setup.

[0027] This invention embeds a RASP (Runtime Application Self-Protection) probe into a real business application to monitor and control the application's runtime environment in a seamless manner. Using techniques such as bytecode instrumentation, decoy code is embedded into the business application process without modifying the source code, allowing the probe to run alongside the application throughout its lifecycle. With this probe, the invention pre-sets several decoy entry points (e.g., fake management ports, test interfaces, or hidden paths containing typical vulnerability characteristics) under the real business domain. These entry points do not exist in normal business functions but are attractive to attackers. When hackers conduct information probing, they are likely to access or attack these carefully designed decoy entry points. The RASP probe intercepts all requests received by the application in real time. Once suspicious traffic or malicious attack payloads accessing the decoy entry points are detected, they are marked as attack behavior and the decoy process is initiated. By actively "disguising" decoy targets at the application layer, Example 1 achieves the initial inducement and capture of attack traffic, laying the foundation for subsequent steps.

[0028] Example 2: Integration of primary and secondary environments and request-driven processes.

[0029] Upon detecting a malicious request, the method enters the primary-secondary fusion deception phase. The RASP probe utilizes internal redirection or proxy forwarding mechanisms to seamlessly redirect captured attack requests from the real business environment to the corresponding page or service in a pre-deployed simulated decoy environment (honeypot). During this process, the attacker receives a response that appears to originate from the original target system, but is actually provided by the simulated environment. Because the redirection occurs within the application, the attacker is unaware of the change in domain name or context, mistakenly believing they are still attacking within the original system. Through this primary-secondary fusion deception method, this invention tightly integrates the real business system with the simulated decoy system: the real environment continues to provide services to normal users, while all malicious traffic targeting the decoy entry point is intelligently diverted to the auxiliary honeypot environment. This phase effectively isolates the attack threat, protecting real assets while ensuring the attacker remains trapped and continues their subsequent actions without remorse.

[0030] Example 3: Highly interactive simulation trapping and behavior monitoring.

[0031] Once the attack traffic enters the simulated trap environment, the method uses highly interactive simulation technology to lure attackers deeper into a pre-set trap. The simulated trap environment is highly simulated and customized for the target business scenario, internally running simulated business applications or service instances (e.g., simulating a real database, application backend, etc.), and intentionally retaining several exploitable vulnerabilities. At this point, the attacker sees exactly what they want in the honeypot: the interface and data provided by the simulation system are very similar to the real system, enough to deceive the attacker. Attackers may use brute-force attacks, SQL injection, command execution, and other attack methods to probe system weaknesses. The method of this invention ensures high interactivity—the simulation environment provides realistic feedback to these attack actions. For example, when an SQL injection attempt is detected, the simulated database can return seemingly real data results, or provide a fake success message during a brute-force attempt. All of this satisfies the attacker's "expectations," enticing them to delve deeper into the attack, while avoiding premature exposure of their deceptive intentions. During this process, the RASP probe and honeypot monitoring module work together to record every step of the attacker's operation with fine granularity: including request packets, input malicious payloads, exploited vulnerabilities, and executed commands. Through comprehensive behavioral monitoring, Example 3 obtained detailed data on the entire attack process, laying the foundation for subsequent analysis and tracing.

[0032] Example 4: Attack chain reconstruction and multidimensional source tracing analysis.

[0033] As the highly interactive honeypot continues to engage with the attacker, this invention begins to perform correlation analysis on the collected attack data, entering the precise source tracing stage. First, a complete intrusion attack chain is reconstructed based on clues obtained during the attack: the attacker's reconnaissance, vulnerability exploitation, privilege escalation, and lateral movement are arranged chronologically, connecting scattered events into a causally related attack trajectory. Based on this, terminal fingerprinting and identification technologies are used to obtain multi-dimensional characteristic information of the attacker. For example, when the attacker first visits the decoy page, the RASP probe implants a hidden fingerprint script to collect the attacker's browser and device information (operating system type, browser version, screen resolution, language settings, etc.) and plants a bot cookie as a persistent identifier in the attack session. If the attacker attempts to change their IP address or proxy to masquerade, the bot cookie and device fingerprint can re-associate their new access with previous behavior, ensuring the continuity of the attack chain. Simultaneously, the method of this invention combines network layer and application layer clues to perform aggregate analysis on the attack source IP, the characteristics of the tools used, and the attack payload patterns, identifying common features to merge different attack attempts by the same attacker. Through multi-dimensional data fusion, Example 4 constructs an attacker profile, including their common attack methods, possible hacker organization affiliation, and characteristics of previously attacked industry targets. The innovation of this stage lies in simultaneously monitoring attack behavior and extracting identity clues, not only reconstructing the full picture of the attack event but also preparing for identifying the attacker.

[0034] Example 5: Precise Attacker Tracing and Evidence Solidification.

[0035] Based on a complete attack chain and abundant fingerprint intelligence, this invention further implements a proactive attribution strategy to lock down the attacker's true identity and obtain reliable evidence. The simulated trapping environment deploys countermeasures at appropriate times: for example, disguised as sensitive documents or tools for the attacker to download, or embedding browser backdoor code that utilizes cross-site scripting (XSS) in the simulated page. Once the attacker executes the downloaded countermeasure file, or loads the malicious script returned by the honeypot in the browser, this method can reverse-engineer their terminal information without alerting them. Through these means, the system may collect more detailed intelligence on the attacker's device or exercise a certain degree of remote control over their terminal. Simultaneously, combined with the aforementioned acquired botnet cookies and social engineering techniques, the method can further query and compare clues such as the attacker's nickname and email address on external intelligence platforms to uncover their activities on social networks or hacker forums, thereby inferring the attacker's true identity. The entire deception and attribution process is automatically recorded: including timestamps of key steps, recordings of the attacker's actions, interaction logs, and all extracted evidence data. Finally, the system generates a complete attribution forensics report, detailing the attack path, attack methods, and identified attacker identity clues. These solidified chains of evidence can be used not only for post-incident accountability and legal recourse, but also provide valuable threat intelligence for security operations teams. Through Example 5, this invention achieves precise attribution and location of attackers, significantly enhancing the proactiveness and deterrent effect of network defense.

[0036] Compared to the three existing patents mentioned in the background section, this invention has outstanding innovation in its design concept and technical solution, mainly reflected in the following three aspects: 1. A Master-Slave Integrated Deception Approach: Traditional publicly available deception defense solutions often deploy honeypot systems in independent, isolated environments, lacking integration with the real business system. For example, some existing patents only provide independent honeypot decoys, redirecting attacks to the honeypot via network redirection when an attack occurs. This method is easily detected by attackers during the switching process and requires additional traffic forwarding devices, resulting in insufficient stealth. Another type of existing solution embeds simple decoy information into the application, but without forming a systematic redirection strategy, attackers can easily distinguish between genuine and fake information with a little probing. In contrast, this invention creatively utilizes RASP probes to deeply integrate the honeypot simulation environment with the real business environment: the deception entry point is directly embedded in the real application context, and attack traffic is seamlessly guided to the simulation environment within the application. Attackers operate entirely under the original business domain, unaware of any environment switch. This master-slave integrated dynamic deception approach greatly improves the stealth and deception effect of the trap, representing a completely new strategy combination not found in existing technologies, and even for those skilled in the art, it is not something easily conceived based on existing teachings.

[0037] 2. High-Interaction Simulation Decoy Capability: Existing honeypot patents often focus on deploying a large number of low-interaction decoys (such as opening simulated ports, returning fixed responses, etc.) to induce attacks, but these suffer from low simulation fidelity and difficulty in attracting advanced attackers for extended periods. Implementing high-interaction honeypots in existing technologies requires significant resources to simulate real system behavior, and ensuring secure isolation while maintaining high simulation fidelity has always been a technical challenge. Therefore, some publicly available solutions sacrifice interaction depth to reduce implementation complexity. This makes it easy for attackers to identify vulnerabilities when engaging in deeper interactions, leading them to abandon their attacks or switch to targeting real targets. This invention achieves a breakthrough in the field of high-interaction honeypots: by directly reusing some logic or interface elements from real application environments through RASP technology and combining it with virtualization sandbox technology to ensure isolation, it presents the most realistic interactive experience at the lowest cost. Attackers can perform complex actions in the simulation environment, including login, querying, uploading, and database operations, and the simulation system provides reasonable responses, creating an "authentic system" operating experience. Furthermore, this invention introduces an intelligent feedback mechanism, such as adjusting the decoy output based on attacker input, making the interaction more dynamic and deceptive. This highly realistic and interactive trapping capability significantly outperforms existing static or shallow deception methods in publicly available patents, enabling it to retain and guide experienced hackers deep into the trap for extended periods. The design combining high-fidelity simulation with secure isolation is quite complex; this invention cleverly utilizes RASP probes and cloud sandbox technology to achieve a balanced integration of the two, and its technical architecture and implementation approach are non-obvious.

[0038] 3. Precise Attacker Source Tracing Capability: This invention also demonstrates significant innovation in attack source tracing. Some existing patents only offer simple source tracing based on logs and IP addresses, roughly locating the attack source by recording the attacking IP and geographical location. However, this often fails against proxies and botnets. Other solutions attempt to obtain partial attacker identity information, such as using Trojan software to collect the attacking host name and MAC address. However, these methods lack real-time integration with honeypots and have relatively limited access methods, making it difficult to form a complete chain of evidence. In contrast, this invention combines passive source tracing with proactive countermeasures: on the one hand, it uses methods such as zombie cookies and device fingerprinting to achieve continuous tracking of attackers across sessions and nodes—a refined tagging technique not typically used in honeypot systems. On the other hand, it innovatively integrates browser vulnerability exploitation techniques (such as XSS scripts) into the trapping process to reverse-engineer attacker information. This "offense-driven defense" approach is rare in existing patents. This invention utilizes a secondary development of a browser phishing framework, enabling honeypots to go beyond simply collecting attack behavior data and proactively acquire attacker host intelligence, achieving precise attribution tracing capabilities. Furthermore, this method emphasizes the integrity and reliability of the evidence chain, automatically generating forensic reports containing a complete record of the attack process and multi-source data, ensuring the credibility and legal validity of the attribution conclusions. In its overall approach, it integrates RASP deception, defensive honeypots, and counter-attribution tracing techniques into a closed-loop attacker capture and identification system, far exceeding the fragmented framework of existing technologies and demonstrating a high degree of creativity and non-obviousness.

[0039] In summary, this invention proposes a novel combination of technologies that differs from existing solutions, whether in the integrated deception mechanism, the highly realistic interactive trapping capability, or the multi-dimensional and precise attack tracing. Its overall defense approach breaks down the boundaries between traditional honeypots and security monitoring, achieving an organic integration of proactive deception and precise tracing through cross-level and cross-domain innovation. This is not obvious to those skilled in the art and demonstrates significant innovation and progress.

[0040] Furthermore, any content not described in detail in this specification is existing technology known to those skilled in the art.

[0041] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus.

[0042] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. A highly interactive deception defense and attack tracing method based on RASP technology, characterized in that: Specifically, the following steps are included: S1. RASP Implantation and Decoy Deployment: Pre-implant RASP monitoring and decoy logic in the target application or host system; S2, Attack Detection and Simulation Trigger: When a running application is subjected to malicious input or operation by an attacker, the RASP monitoring unit intercepts and determines the malicious nature of the attack in real time. S3. Attack Session Redirection and High-Interaction Deception: After the simulation environment is ready, the attacker's session is seamlessly switched to this environment to continue execution, thereby achieving guidance and control of the attack behavior; S4. Attack behavior monitoring and source tracing data collection: During the interaction between the attacker and the simulation environment, the entire attack process is recorded in fine detail through RASP probes and monitoring components within the simulation environment, and evidence required for source tracing is collected. S5. Source Tracing Analysis and Threat Management: After successfully capturing and recording the entire attack process, the collected data is comprehensively analyzed to extract valuable source tracing conclusions and security decision-making information.

2. The highly interactive deception defense and attack tracing method based on RASP technology according to claim 1, characterized in that: In step S1, RASP probe code is loaded during application startup or system runtime to hook key function calls and system interfaces, enabling real-time monitoring of the running process. The application itself possesses security monitoring capabilities through RASP technology, allowing detection without the need for external agents. Furthermore, while deploying RASP, decoy information is strategically placed within the system to attract attackers. The decoy is disguised sensitive data, hidden interfaces, or command entry points. Hidden management ports are reserved in the application, or simulated confidential files are placed in the file system. When attackers scan ports or traverse files, the decoy increases the probability of triggering monitoring. Once an attacker attempts to access the decoy, the RASP probe can quickly detect it, preparing for subsequent capture.

3. The highly interactive deception defense and attack tracing method based on RASP technology according to claim 1, characterized in that: In step S2, the RASP monitoring unit determines the malicious nature of an operation based on a preset security policy and behavioral characteristics. Once RASP determines that an operation is an attack, it triggers the simulation environment preparation process. The simulation environment uses one of two strategies for simulation. For scenarios with extremely high response requirements, a hidden simulation instance is pre-enabled to shorten the switching delay. In general scenarios, the current application process is quickly cloned or a lightweight container is enabled upon triggering, making it a new carrier for the attacker's interaction. The goal is to prepare a parallel space that is highly similar to the real environment at the moment the attack occurs, laying the environmental foundation for subsequent deception. This simulation environment is isolated from the real system in terms of network and permissions, ensuring that the attacker's subsequent malicious operations will not damage the production system.

4. The highly interactive deception defense and attack tracing method based on RASP technology according to claim 3, characterized in that: When the simulation environment adopts strategy one for simulation, it specifically involves: creating a high-interaction trap environment in advance and keeping it on standby; and deploying an isolated container or virtual machine image on the same host in advance, which has the same software environment and initial data as the real system.

5. The highly interactive deception defense and attack tracing method based on RASP technology according to claim 3, characterized in that: When the simulation environment adopts Strategy 2 for simulation, it specifically means: dynamically generating the simulation environment and immediately copying the current system or application's running state to an isolated container when an attack is detected.

6. The highly interactive deception defense and attack tracing method based on RASP technology according to claim 1, characterized in that: In step S3, after detecting malicious input, RASP does not simply block or issue an alarm, but instead uses a hook function to redirect the attacker's subsequent requests to the simulation environment.

7. A highly interactive deception defense and attack tracing method based on RASP technology according to claim 6, characterized in that: The simulation environment strives for high fidelity, inheriting most of the environmental parameters of the original system to minimize the exposure of false vulnerabilities. This is achieved through the highly interactive deception defense in step S3, where attackers are deeply immersed in the spoofed environment and continuously attempt to launch their attacks.

8. A highly interactive deception defense and attack tracing method based on RASP technology according to claim 1, characterized in that: In step S4, the system records in detail every operation instruction, input parameter, and low-level behavior such as system calls and network connections triggered by the attacker, and organizes them into a time-series log to provide a basis for post-attack analysis of attack techniques. During the interaction, the system actively embeds tracing markers to obtain more information about the attacker. For specific data input by the attacker in the simulation environment, the system immediately records and analyzes the data to extract clues such as commonly used password features and tool fingerprints of the attacker.

9. A highly interactive deception defense and attack tracing method based on RASP technology according to claim 8, characterized in that: By combining external intelligence sources to conduct correlation analysis of attack traffic, and through monitoring and data collection methods, not only can the complete behavioral chain be obtained when an attack occurs, but also multiple layers of tracking mechanisms can be embedded to expose more identity-related information to the attacker unintentionally.

10. A highly interactive deception defense and attack tracing method based on RASP technology according to claim 1, characterized in that: The specific steps for source tracing analysis and threat handling in step S5 are as follows: T1. First, locate the attack source IP and its network environment based on the return results of the attack traffic. Combine the geographic location database and ISP information to determine the approximate physical location or affiliated organization of the attacker. If the watermark tracking of the decoy document obtains the attacker's hostname, MAC address and hardware information, it further corroborates its identity characteristics. T2. Analyze the toolchain and techniques used by the attackers, compare them with the feature database of known attack groups, determine the attackers' possible background, organize the account and key information exposed during the attack, and find the attackers' activity trajectory on other platforms. T3. After obtaining the above analysis results, a threat intelligence report on this attack is generated, including the attack path, the exploited vulnerabilities, and the possible identity and intent of the attacker. This intelligence is used for further security response decisions.

Images