# A Highly Interactive Honeypot-Based Approach to Network Threat Management
## 2 Survey of Existing Network Threat Management Methods
### Interactivity Comparison
It provides a web interface that allows users to search and analyze log data and customize rules to monitor log messages and generate alerts. Graylog also supports the visualization of log data, including charts and dashboards. It also offers a flexible plugin architecture that can extend its functionality and integrate with other tools. Overall, Graylog is a powerful log auditing system that provides an effective way for enterprises to centrally manage and analyze log data. However, like Snort, Graylog also requires users to set up the log auditing mechanism in advance and uses a command-line form for user-system interaction. Additionally, the defense mechanisms of both Snort and Graylog can only react after the intrusion has taken place, and they have a lag in protecting security objects. In response to the relative passiveness of intrusion detection systems, intrusion prevention systems (IPS) were developed. IPS is similar to intrusion detection systems (IDS), but also has the ability to prevent attacks. Here we take the Controller Area Network Intrusion Prevention System Leveraging Fault Recovery method proposed by [PERSON], [PERSON], and [PERSON] as an example. This is a new type of IPS for the CAN bus that can prevent remote message injection attacks and trigger remote damaged ECU based on reboot recovery. This method combines CAN and IDS and measures their ability to detect attacks in the delay within the bus speed. The detector node can decide the message frame that is broadcast between the last transmission of the arbitration field and the end of the message frame. Its actual recovery period can reach 20 milliseconds. The recovery mechanism converts the abnormal node to a bus shutdown state in about 6 milliseconds, which is less than the period of a valid message frame. This IPS can be integrated into real car systems, mitigating the impact of attacks while identifying them and measuring the performance degradation of reboot-based recovery, and preventing future attacks [7]. In terms of interactivity, this method offers several advantages. Firstly, it provides detailed information on the intrusion detection system. This level of detail enables users to have a more comprehensive understanding of the system's performance and any potential security threats. Additionally, the method has the ability to predict potential intrusions, which allows for more proactive security measures. Moreover, this approach includes a graphical user interface, which enhances the user-system interaction experience. The interface provides users with an intuitive and easy-to-use platform to interact with the system. This convenience can improve overall system usability and promote user adoption. Identity authentication and access control are currently the most commonly used network threat management methods, widely used in systems such as Windows, Linux, and Unix-like systems. This method has undergone significant market improvements and now features a robust graphical user interface with a user-friendly design, which enhances user-system interaction. Specifically, the method typically includes a graphical user interface with 280 different graphical elements that make it easier for users to navigate and interact with the system. Notwithstanding its benefits, this method has a significant drawback. Specifically, it employs a passive protection approach that does not actively monitor security objects or record intrusion behavior. As a result, any intrusion information is left for security personnel to refer to after the fact, rather than being detected and prevented in real-time. There is a serious lack of interaction between the system and security objects. Compared to previous network threat management methods, which interact passively with attack behaviors, vulnerability scanners offer a proactive approach to protecting networks by actively interacting with security objects. Here we take MoScan as an example, it is a model-based scanner for detecting security vulnerabilities in SSO implementations.