# A Highly Interactive Honeypot-Based Approach to Network Threat Management
## 2 Survey of Existing Network Threat Management Methods  
Before introducing the proposed network threat management method in this paper, it is necessary to compare and introduce the mainstream network threat management methods available in the market. This will help readers to understand the different network threat management methods, and their functions, and highlight the advantages and disadvantages of various network threat management methods. It is important to understand the principle construction of these methods in order to gain a better understanding of the proposed method. At the same time, studying other network threat management methods, can also further help the authors to improve our network threat management method. Currently, the main methods for managing network threats include intrusion detection systems, intrusion prevention systems, vulnerability scanners, log auditing systems, identity authentication, access control, honeypot protection, etc: Intrusion Detection System (IDS) is designed to detect and identify unauthorized access or attack activities. It is usually used to monitor network traffic, recognize malicious activities, and alert network administrators [4]. The main types of IDS include snort, Suricata, etc. IDS uses two main technologies: signature technology and behavior analysis technology. Signature technology identifies attacks by matching known malicious code signatures. Behavior analysis technology recognizes malicious activities by analyzing network and system behavior [5]. The intrusion prevention system (IPS) aims to detect and prevent unauthorized access and attacks. IPS is similar to an intrusion detection system (IDS), but IPS also has the ability to prevent attacks. IPS uses a rule engine that uses rules to detect specific network attack patterns and block them when detected. An intrusion defense policy is established and predefined policies are utilized to detect and prevent specific types of attacks. A signature database is formed that contains the digital signatures of known attacks for quick identification of known attacks. Network pattern analysis is performed by using algorithms to identify anomalous network patterns and block them when an attack is detected. IPS can be installed at the network edge for real-time monitoring of network traffic or on specific security devices to protect the network from attack. IPS is commonly used to prevent hacker attacks such as denial of service (DoS), viruses, malware, and network probing. It can effectively prevent these attacks and ensure the security and reliability of the network. A vulnerability scanner is an automated tool used to identify security vulnerabilities in a network. It scans the network and systems to identify weaknesses that may be vulnerable to attack and provides information to administrators so they can take action to fix the vulnerability. The vulnerability scanner detects the devices and services on the target network by performing a network scan. Then, it compares the results to a database of known vulnerabilities and runs vulnerability checks. If the scanner identifies a potential vulnerability, it generates a detailed report with recommendations for repairing the vulnerability and sends it to the administrator. A log auditing system is a tool used to record and analyze information about activities on the network. It helps administrators identify unusual activity, assess network security risks, and prevent malicious attacks and data breaches. The system collects detailed activity information, such as user logins, file access, and network traffic, from various devices on the network. The collected activity information is stored on a log server and analyzed using rules defined by the administrator. The system can provide visualized reports to help administrators identify abnormal activities, such as frequent login failures or malware activity. If any threat activities are detected, the log auditing system can send an alert to the administrator and automatically trigger corresponding preventive measures.