# A Highly Interactive Honeypot-Based Approach to Network Threat Management
## 4 Implementation and Results Analysis of High Interactivity Honeypot System
### High Interaction Honeypot Implementation  
For the implementation of highly interactive honeypots, it is necessary to implement a full amount of logs, a high degree of forgery, self-protection [15], version selection, and other features. The full amount of logs is the cornerstone of the honeypot system. Adequate collection and preservation of system operation logs, alarm messages, and error messages are necessary to identify potential threats to the honeypot and collect sufficient information for analysis to be sent back to the central node. In our honeypot, we choose to record comprehensive and complete log information to ensure a thorough analysis. To achieve this, we record program runtime logs in both the high-privilege kernel state and low-privilege user state. This includes, but is not limited to, runtime messages, warning messages, error messages, output streams, input streams, and error streams. High interactivity is guaranteed by high forgery, and if an attacker suspects that the system is a honeypot, then the collected information becomes meaningless. In our honeypot, we run a complete and genuine system, which is fundamentally not forged and thus naturally has high interactivity. Self-protection is to protect the security of the whole honeynet. Only when the honeypot has a sufficiently high level of security line controllability can it prevent the attacker from breaching the central node and other honeypots through the honeypot itself. To achieve this, we utilize a daemon within the honeypot to execute the service and lock the process in the event of abnormal termination, preventing its automatic restart and any network interactions. Version selection is then to allow easy and fast construction of patterned honeypots. Modern products are characterized by frequent version updates and lower security line stability, making them more vulnerable to attacks by threat actors. In the case of highly interactive honeypots, creating new versions of the honeypot system that align with the attacker's preferences is necessary, even if the honeypot lacks support for version selection, which can be challenging to achieve. Virtualization technologies such as Docker can be utilized to rapidly deploy a range of honeypots with distinct versions but identical functional structures via configuration files, thereby supporting version selection. The specific workflow is shown in Figure 9 below. In terms of specific honeypot selection, we used Shadow Daemon and Ehoney as our concrete implementation targets. Shadow Daemon is a collection of tools for detecting, recording and preventing attacks on network applications. Technically, Shadow Daemon is a network application firewall that intercepts requests and filters out malicious parameters. It is a modular system that separates web applications, analysis, and interface to improve security, flexibility, and scalability. The software can accurately identify attacks such as SQL injection, XML injection, code injection, command injection, backdoor access, etc., and accurately record them. This firewall also incorporates a honeypot. Although most honeypots on the market excel in attracting and documenting attacks, dynamic network applications expose significant information compared to conventional network services. As a result, it is easy for hackers to determine if the application is actively running or if the website's behavior appears unnatural, thereby revealing that it is a honeypot and deterring attackers from taking action. Thus, the existing solutions are primarily useful for gathering information on trusted self-propagating malware, which represents only a fraction of all attacks. Consequently, the collected data is incomplete and non-conclusive. To overcome this challenge, the system must be capable of detecting and logging malicious requests on the production server, as the authentic target is the only reliable source of information. The collected information is more meaningful and suitable for research because they are not distorted. Figure 9: Schematic diagram of attack.