Research and Application of High Interaction Deception Defense and Traceability Based on RASP Technology

This article explored a high interaction deception defense mechanism based on RASP (runtime application self-protection) technology and its application in network attack tracing. Traditional network security defense methods face some limitations, such as insufficient detection of complex attack patterns and difficult traceability. The purpose of this study was to enhance defense capabilities and improve the tracking efficiency of attack sources by integrating RASP technology and high interaction deception strategies. The experimental study demonstrated the potential of this comprehensive method in real-time attack detection, response, and traceability, and its effectiveness was verified through experiments. This study comprehensively evaluated the performance of a high interaction deception defense and traceability system based on RASP technology through three experiments during the research phase. In the first experiment, defense effectiveness tests against SQL (structured query language) injection, XSS (cross site scripting), and DDoS (distributed denial of service) attacks showed that the system exhibited high detection rates of 95%, 90%, and 92%, respectively, with response times of 0.3 seconds, 0.5 seconds, and 0.4 seconds, and false alarm rates maintained at a low level of 2%-4%. In the second experiment, the evaluation of interaction effects on different types of honeypots showed that high interaction honeypots were the most effective in attracting attackers, with an average dwell time of 30 minutes and 10 interaction operations, far exceeding other types of honeypots. Finally, the accuracy and speed testing of traceability revealed the traceability ability of the system under different types of attacks. Among them, the traceability accuracy of malicious software attacks was the highest, reaching 95%, but the longest required time was 50 seconds; the traceability accuracy of fishing attacks was 85%, taking 45 seconds. The above data conclusions collectively demonstrated the efficient capabilities of RASP based systems in real-time attack detection, efficient interactive deception defense, and accurate and fast attack tracing.