# A Highly Interactive Honeypot-Based Approach to Network Threat Management
## 1 Introduction
This model is designed to enhance the ease of use of the system for specific purposes. We conducted extensive research on the popular open-source honeypot products available in the market, including Hfish, SSH-mtim, and Shadow Daemon. Our analysis revealed that each of these products has certain limitations. In terms of interactivity, Shadow Daemon and SSH-mtim are categorized as high-interactivity honeypots, which simulate genuine operating environments and significantly enhance the attractiveness and concealment of the honeypots for potential attackers. High-interactivity honeypots offer more comprehensive and detailed data, but their susceptibility to being compromised by attackers creates a high risk of losing the ability to record attack information in the event of a breach. The low-interactivity honeypot Hfish lacks the ability to simulate a real operating environment, resulting in low concealment and attractiveness compared to high-interactivity honeypots such as Shadow Daemon and SSH-mtim. As a consequence, the Hfish honeypot is prone to collecting misleading or incomplete attack data. However, due to its low interactivity, the logging system is relatively separated from the honey bait and cannot be easily breached by attackers to collect data. In terms of simplicity, honeypots such as Hfish, SSH-mtim, Shadow Daemon, Dionaea, etc. are all managed through the command line. Requiring concise commands (e.g.,shutdown or disconnect) to be issued to perform specific actions, the management of the honeypot can be challenging, rendering it unsuitable for large-scale deployment. Secondly, the lack of a graphical interface also prevents the data from being represented visually, which is not conducive to the user's analysis of the attack data. In contrast, honeypots such as Honeyd employ a graphical user interface for configuration and display, enabling the emulation of various systems and services with customized virtual host configurations. This greatly reduces the difficulty for users to operate and analyze. In terms of versatility, honeypots such as Honeyd offer versatility by supporting multiple operating systems, including Linux, Unix, and Windows systems. On the other hand, honeypots such as Kippo and Dionaea can only run on Linux operating systems, making their versatility relatively narrow. In terms of information collection, Honeyd and Hfish [3] can only collect the attacker's IP address and port information, with relatively small amounts of information collected; honeypots such as Kippo and Dionaea can capture the attacker's IP address, login information, and command inputs. Furthermore, Kippo has the ability to analyze collected attack information to provide users with valuable insights. Our research on the aforementioned products indicates that traditional low-interaction honeypot systems struggle to handle the growing complexity of network environments. Conversely, our proposed high-interaction honeypot system provides greater interactivity by simulating open and realistic operating systems and services. This approach confuses attackers and enables the capture of realistic attack data. To enhance network security, honeypots are encapsulated using modular technology, and a modular and high-interaction honeypot threat management system is designed with the integration of various honeypots. After a large number of comparative experiments, it was found that our method has significant advantages compared to traditional network threat management methods: As the core module, the central node implements various functions such as data storage, deployment of multiple honeypots, connection control, and data processing. Through performing these operations on the honeypots, data is collected, organized, summarized, and analyzed to generate event reports and attacker profiles. This facilitates easy viewing and usage of attack information templates. The proposed method for constructing a highly interactive honeypot system involves using multiple highly interactive honeypots as tools for information sniffing.